안녕하세요, 여러분.
커뮤니티에 새로 참여하여 배우고 있는 중입니다.
최근에 Cisco ISR1100 (기본 라이센스)으로 일반적인 인터넷 트래픽 설정을 했습니다.
그런데 내부에서 서버 포트를 여는 데 어려움을 겪고 있습니다.
다른 컨피그레이션으로 이것저것 시도했습니다만 아무 소용이 없습니다.
ip route and acl's,
제가 뭘 잘못하고 있는 지 도와주실 수 있으면 감사하겠습니다.
VLAN101(외부)에서 HTTPS 서버가 실행중인 VLAN777(내부)까지 트래픽을 가져오려고 합니다.
VLAN777, VLAN101, 모든 물리적 인터페이스에 심지어 NAT에도 ACL "SEC-OPEN"을 배치하려고 시도했지만 아무것도 변경되지 않았습니다. 외부에서 내부 장치를 ping할 때 연결이 거부되었다는 메시지가 계속 표시됩니다.
미리 감사합니다.
제 컨피그레이션은 다음과 같습니다.
R1-1100#show run
Building configuration...
Current configuration : 8337 bytes
!
! Last configuration change at 23:34:32 UTC Sun Jan 16 2022
!
version 16.12
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service call-home
platform qfp utilization monitor load 80
platform punt-keepalive disable-kernel-core
!
hostname R1-1100
!
boot-start-marker
boot-end-marker
!
!
enable secret 9 XXXXXXXX
!
no aaa new-model
!
ip name-server 8.8.8.8 8.8.4.4
ip domain name R1-1100
ip dhcp excluded-address 192.168.0.255 255.255.255.255
ip dhcp excluded-address 192.168.0.1 192.168.0.100
!
ip dhcp pool LAN
network 192.168.0.0 255.255.255.0
default-router 192.168.0.1
dns-server 8.8.8.8 8.8.4.4
lease 30
!
!
!
no ip dhcp auto-broadcast
login on-success log
!
!
!
!
!
!
!
subscriber templating
vtp mode transparent
multilink bundle-name authenticated
!
!
!
diagnostic bootup level minimal
!
spanning-tree extend system-id
!
username XXXXXXXX privilege 15 secret 9 XXXXXXXX
!
redundancy
mode none
!
!
vlan internal allocation policy ascending
!
vlan 101,777
!
!
!
!
!
!
interface GigabitEthernet0/0/0
description *** NOT USED ***
ip address dhcp
ip nat outside
shutdown
media-type rj45
negotiation auto
!
interface GigabitEthernet0/0/1
description *** ISP ***
no ip address
media-type rj45
negotiation auto
!
interface GigabitEthernet0/0/1.101
description *** VLAN101 ***
encapsulation dot1Q 101
ip address dhcp
ip nat outside
!
interface GigabitEthernet0/1/0
description *** LAN ***
switchport access vlan 777
switchport mode access
!
interface GigabitEthernet0/1/1
description *** LAN ***
switchport access vlan 777
switchport mode access
!
interface GigabitEthernet0/1/2
description *** LAN ***
switchport access vlan 777
switchport mode access
!
interface GigabitEthernet0/1/3
description *** LAN ***
switchport access vlan 777
switchport mode access
!
interface GigabitEthernet0/1/4
description *** LAN ***
switchport access vlan 777
switchport mode access
!
interface GigabitEthernet0/1/5
description *** LAN ***
switchport access vlan 777
switchport mode access
!
interface GigabitEthernet0/1/6
description *** LAN ***
switchport access vlan 777
switchport mode access
!
interface GigabitEthernet0/1/7
description *** LAN ***
switchport access vlan 777
switchport mode access
!
interface Vlan1
description *** NATIVE ***
no ip address
!
interface Vlan101
description *** ISP ***
no ip address
!
interface Vlan777
description *** LAN ***
ip address pool LAN
ip nat inside
!
ip forward-protocol nd
no ip http server
ip http authentication local
no ip http secure-server
ip nat inside source list SEC-INTERNET interface GigabitEthernet0/0/1.101 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/1.101 dhcp
ip ssh maxstartups 2
ip ssh rsa keypair-name SSH
!
!
ip access-list extended SEC-INTERNET
10 permit ip 192.168.0.0 0.0.0.255 any
20 deny ip any any
ip access-list extended SEC-OPEN
10 permit ip any any
ip access-list extended SEC-SERVER
10 permit ip host 192.168.0.55 any
20 permit ip any host 192.168.0.55
30 deny ip any any
ip access-list extended SEC-VTY
10 permit tcp 192.168.0.0 0.0.0.255 host 192.168.0.1 eq 22
20 deny ip any any
!
!
!
!
!
control-plane
!
!
line con 0
privilege level 15
logging synchronous
length 0
transport input none
stopbits 1
line vty 0 4
access-class SEC-VTY in
logging synchronous
login local
length 0
transport preferred ssh
!
ntp server time.google.com
!
!
!
!
!
end
R1-1100#
