Help

[stevenclark612]

Building configuration...

Current configuration : 15772 bytes
!
! Last configuration change at 11:45:04 EDT Sat Aug 26 2023 by sclark
! NVRAM config last updated at 11:36:33 EDT Sat Aug 26 2023 by sclark
!
version 15.5
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ROUTER-001
!
boot-start-marker
boot-end-marker
!
!
no logging console
enable secret 5
enable password
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login local_access local
aaa authorization auth-proxy default local
!
!
!
!
!
aaa session-id common
bsd-client server url https://cloudsso.cisco.com/as/token.oauth2
memory-size iomem 25
clock timezone EST -5 0
clock summer-time EDT recurring
!
!
!
!
!
!
!
!
!
!
!
ip dhcp excluded-address 10.0.100.1
ip dhcp excluded-address 10.0.154.1
ip dhcp excluded-address 10.0.254.1
ip dhcp excluded-address 172.16.32.1
ip dhcp excluded-address 192.168.50.1
ip dhcp excluded-address 192.168.51.1
ip dhcp excluded-address 10.0.100.1 10.0.100.50
ip dhcp excluded-address 10.0.100.250 10.0.100.254
ip dhcp excluded-address 10.0.154.1 10.0.154.50
ip dhcp excluded-address 10.0.154.250 10.0.154.254
ip dhcp excluded-address 10.0.254.1 10.0.254.50
ip dhcp excluded-address 10.0.254.250 10.0.254.254
ip dhcp excluded-address 172.16.32.1 172.16.32.50
ip dhcp excluded-address 172.16.32.250 172.16.32.254
ip dhcp excluded-address 192.168.50.1 192.168.50.50
ip dhcp excluded-address 192.168.50.250 192.168.50.254
ip dhcp excluded-address 192.168.51.1 192.168.51.50
ip dhcp excluded-address 192.168.51.250 192.168.51.254
!
ip dhcp pool dot1Q-Native_VLAN-1
import all
network 10.0.100.0 255.255.255.0
default-router 10.0.100.1
dns-server 208.67.222.222 208.67.220.220
domain-name cgnc.us
!
ip dhcp pool VLAN-154
import all
network 10.0.154.0 255.255.255.0
default-router 10.0.154.1
dns-server 208.67.222.222 208.67.220.220
domain-name cgnc.us
!
ip dhcp pool VLAN-254
import all
network 10.0.254.0 255.255.255.0
default-router 10.0.254.1
dns-server 208.67.222.222 208.67.220.220
domain-name cgnc.us
!
ip dhcp pool VLAN-1
import all
network 172.16.32.0 255.255.255.0
default-router 172.16.32.1
dns-server 208.67.222.222 208.67.220.220
domain-name cgnc.us
!
!
!
no ip domain lookup
ip domain name CGNC.LOCAL
ip name-server 208.67.222.222
ip name-server 208.67.220.220
ip cef
no ipv6 cef
!
!
multilink bundle-name authenticated
!
!
cts logging verbose
license udi pid CISCO2951/K9 sn FJC1924A0WP
!
!
username password 0
!
redundancy
!
!
!
!
!
track 1 ip sla 20 reachability
!
ip ssh time-out 60
ip ssh authentication-retries 4
ip ssh port 2001 rotary 1
ip ssh version 1
ip ssh pubkey-chain
username sclark
!
class-map type inspect match-any CATEGORY_INTER-PROCESS-RPC
match protocol sunrpc
class-map type inspect match-any CATEGORY_VOICE-AND-VIDEO
match protocol h323
match protocol isakmp
match protocol mgcp
match protocol pptp
match protocol rtsp
match protocol sip
match protocol sip-tls
match protocol skinny
class-map type inspect match-any CATEGORY_EMAIL
match protocol imap
match protocol msexch-routing
match protocol pop3
match protocol qmtp
match protocol smtp
class-map type inspect match-any CATEGORY_CONSUMER-STREAMING
match protocol appleqtc
match protocol netshow
match protocol realmedia
match protocol vdolive
class-map type inspect match-any CATEGORY_FILE-SHARING
match protocol cifs
match protocol ftp
match protocol nfs
match protocol tftp
class-map type inspect match-any CATEGORY_DATABASE
match protocol dbase
match protocol ms-sql-m
match protocol mysql
match protocol net8-cman
match protocol oraclenames
match protocol rdb-dbs-disp
match protocol sql-net
match protocol sqlserv
match protocol sqlsrv
class-map type inspect match-any CATEGORY_BACKUP-AND-STORAGE
match protocol iscsi
class-map type inspect match-any CATEGORY_BROWSING
match protocol http
class-map type inspect match-any WAN-TO-LAN-CLASS
description Allowed_Protocol_From_WAN-TO-LAN
match protocol snmp
match protocol icmp
match protocol ntp
match protocol echo
match protocol dns
match protocol sip
match protocol sip-tls
class-map type inspect match-any CATEGORY_OTHER_1
match protocol 802-11-iapp
match protocol ace-svr
match protocol aol
match protocol biff
match protocol bootpc
match protocol bootps
match protocol cddbp
match protocol cisco-net-mgmt
match protocol cisco-svcs
match protocol citriximaclient
match protocol clp
match protocol creativepartnr
match protocol creativeserver
match protocol dbcontrol_agent
match protocol ddns-v3
match protocol discard
match protocol entrust-svc-hdlr
match protocol entrust-svcs
match protocol fcip-port
match protocol ftps
match protocol gdoi
match protocol giop
match protocol gopher
match protocol gtpv0
match protocol gtpv1
match protocol h225ras
match protocol h323-annexe
match protocol h323-nxg
match protocol hsrp
match protocol https
match protocol ica
match protocol icabrowser
match protocol ident
match protocol igmpv3lite
match protocol imap3
match protocol imaps
match protocol ipass
match protocol orasrv
match protocol pcanywheredata
match protocol pcanywherestat
match protocol pop3s
match protocol r-winsock
match protocol realsecure
match protocol router
match protocol rsvd
match protocol rsvp-encap
match protocol rtc-pm-port
match protocol send
match protocol sms
match protocol snmptrap
match protocol oem-agent
match protocol oracle
match protocol oracle-em-vp
match protocol ipsec-msft
match protocol ipx
match protocol ircs
match protocol ircu
match protocol iscsi-target
match protocol kermit
match protocol ldap-admin
match protocol ldaps
match protocol lotusmtap
match protocol lotusnote
match protocol microsoft-ds
match protocol ms-cluster-net
match protocol ms-dotnetster
match protocol ms-sna
match protocol ms-sql
match protocol msnmsgr
match protocol msrpc
match protocol msrpc-smb-netbios
match protocol n2h2server
match protocol netstat
match protocol nntp
class-map type inspect match-any CATEGORY_OTHER_2
match protocol ssp
match protocol streamworks
match protocol stun
match protocol sxp
match protocol syslog-conn
match protocol tacacs-ds
match protocol tarantella
match protocol tcp
match protocol telnets
match protocol tr-rsrb
match protocol ttc
match protocol udp
match protocol vqp
match protocol webster
match protocol who
match protocol winmsgr
match protocol wins
match protocol x11
match protocol ymsgr
class-map type inspect match-any CATEGORY_NET-ADMIN
match protocol bgp
match protocol cisco-fna
match protocol cisco-sys
match protocol cisco-tdp
match protocol cisco-tna
match protocol daytime
match protocol dhcp-failover
match protocol dns
match protocol dnsix
match protocol echo
match protocol exec
match protocol finger
match protocol hp-alarm-mgr
match protocol hp-collector
match protocol hp-managed-node
match protocol icmp
match protocol kerberos
match protocol l2tp
match protocol ldap
match protocol login
match protocol ncp
match protocol netbios-dgm
match protocol netbios-ns
match protocol netbios-ssn
match protocol ntp
match protocol pwdgen
match protocol radius
match protocol rsvp_tunnel
match protocol rtelnet
match protocol shell
match protocol snmp
match protocol socks
match protocol ssh
match protocol sshell
match protocol syslog
match protocol tacacs
match protocol telnet
match protocol time
match protocol timed
match protocol uucp
match protocol xdmcp
class-map type inspect match-any CATEGORY_BUSINESS-AND-PRODUCTIVITY-TOOLS
match protocol citrix
class-map type inspect match-any CATEGORY_INSTANT-MESSAGING
match protocol icq
match protocol irc
match protocol irc-serv
class-map type inspect match-any Inside->>Outside-Application_App
match class-map CATEGORY_VOICE-AND-VIDEO
match class-map CATEGORY_EMAIL
match class-map CATEGORY_CONSUMER-STREAMING
match class-map CATEGORY_FILE-SHARING
match class-map CATEGORY_INSTANT-MESSAGING
match class-map CATEGORY_BROWSING
match class-map CATEGORY_DATABASE
match class-map CATEGORY_BACKUP-AND-STORAGE
match class-map CATEGORY_BUSINESS-AND-PRODUCTIVITY-TOOLS
match class-map CATEGORY_INTER-PROCESS-RPC
match class-map CATEGORY_NET-ADMIN
match class-map CATEGORY_OTHER_1
match class-map CATEGORY_OTHER_2
class-map type inspect match-any Outside->>Inside-Application_App
match class-map CATEGORY_VOICE-AND-VIDEO
match class-map CATEGORY_CONSUMER-STREAMING
match class-map WAN-TO-LAN-CLASS
class-map type inspect match-all Inside->>Outside-Application
description application
match access-group name Inside->>Outside-Application_ACL
match class-map Inside->>Outside-Application_App
class-map type inspect match-all Outside->>Inside-Application
description application
match access-group name Outside->>Inside-Application_ACL
match class-map Outside->>Inside-Application_App
!
policy-map type inspect LAN-TO-WAN-POLICY
class type inspect CATEGORY_VOICE-AND-VIDEO
inspect
class type inspect CATEGORY_EMAIL
inspect
class type inspect CATEGORY_CONSUMER-STREAMING
inspect
class type inspect CATEGORY_FILE-SHARING
inspect
class type inspect CATEGORY_INSTANT-MESSAGING
inspect
class type inspect CATEGORY_BROWSING
inspect
class type inspect CATEGORY_DATABASE
inspect
class type inspect CATEGORY_BACKUP-AND-STORAGE
inspect
class type inspect CATEGORY_BUSINESS-AND-PRODUCTIVITY-TOOLS
inspect
class type inspect CATEGORY_INTER-PROCESS-RPC
inspect
class type inspect CATEGORY_NET-ADMIN
inspect
class type inspect CATEGORY_OTHER_1
inspect
class type inspect CATEGORY_OTHER_2
inspect
class class-default
drop log
policy-map type inspect WAN-TO-LAN-POLICY
class type inspect WAN-TO-LAN-CLASS
inspect
class class-default
drop log
!
zone security WAN
zone security LAN
zone security VPN
zone security DMZ
zone-pair security WAN-TO-LAN source WAN destination LAN
service-policy type inspect WAN-TO-LAN-POLICY
zone-pair security LAN-TO-WAN source LAN destination WAN
service-policy type inspect LAN-TO-WAN-POLICY
!
!
!
!
!
!
!
!
!
!
interface Port-channel1
description TRUNK-VLANS
no ip address
ip nat inside
ip virtual-reassembly in
zone-member security LAN
no mop enabled
!
interface Port-channel1.1
description VLAN-1-Native
encapsulation dot1Q 1 native
ip address 10.0.100.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
zone-member security LAN
!
interface Port-channel1.154
description VLAN-154
encapsulation dot1Q 154
ip address 10.0.154.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
zone-member security LAN
!
interface Port-channel1.254
description VLAN-254
encapsulation dot1Q 254
ip address 10.0.254.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
zone-member security LAN
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
description LACP/LAG-GROUP
no ip address
ip nat inside
ip virtual-reassembly in
zone-member security LAN
duplex full
speed 1000
channel-group 1
no mop enabled
!
interface GigabitEthernet0/1
description LACP/LAG-GROUP
no ip address
ip nat inside
ip virtual-reassembly in
zone-member security LAN
duplex full
speed 1000
channel-group 1
no mop enabled
!
interface GigabitEthernet0/2
description LACP/LAG-GROUP
no ip address
ip nat inside
ip virtual-reassembly in
zone-member security LAN
duplex full
speed 1000
channel-group 1
no mop enabled
!
interface GigabitEthernet0/0/0
description ISP-001
ip address dhcp hostname ROUTER-001
ip nat outside
ip virtual-reassembly in
zone-member security WAN
duplex full
speed 1000
!
interface GigabitEthernet0/1/0
description ISP-002
ip address dhcp hostname ROUTER-001
ip nat outside
ip virtual-reassembly in
zone-member security WAN
duplex full
speed 1000
!
interface GigabitEthernet0/3/0
description Onboard-LAN
switchport trunk allowed vlan 1,2,1002-1005
switchport mode trunk
no ip address
duplex full
speed 1000
!
interface GigabitEthernet0/3/1
description Onboard-LAN
switchport trunk allowed vlan 1,2,1002-1005
switchport mode trunk
no ip address
duplex full
speed 1000
!
interface GigabitEthernet0/3/2
description Onboard-LAN
switchport trunk allowed vlan 1,2,1002-1005
switchport mode trunk
no ip address
duplex full
speed 1000
!
interface GigabitEthernet0/3/3
description Onboard-LAN
switchport trunk allowed vlan 1,2,1002-1005
switchport mode trunk
no ip address
duplex full
speed 1000
!
interface Vlan1
description VLAN-1
ip address pool VLAN-1
ip nat inside
ip virtual-reassembly in
zone-member security LAN
!
router rip
version 2
network 10.0.0.0
network 172.0.0.0
no auto-summary
!
no ip forward-protocol nd
!
ip http server
ip http port 8080
no ip http secure-server
!
ip nat inside source list Hosts-Ports interface GigabitEthernet0/0/0 overload
ip nat inside source route-map RM-NAT-ISP01 interface GigabitEthernet0/0/0 overl oad
ip nat inside source route-map RM-NAT-ISP02 interface GigabitEthernet0/1/0 overl oad
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0 47.7.240.1 track 1
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1/0 192.168.1.1 253
ip route 8.8.8.8 255.255.255.255 GigabitEthernet0/0/0 47.7.240.1
!
ip access-list standard ACL-DNAT
permit 10.0.100.0 0.0.0.255
permit 10.0.154.0 0.0.0.255
permit 10.0.254.0 0.0.0.255
permit 172.16.32.0 0.0.0.255
!
ip access-list extended Hosts-Ports
permit udp any any eq 7351
permit tcp any any eq 7734
permit tcp any any eq 7752
permit tcp any any range 60000 61000
permit udp any any eq snmp
permit udp any any eq snmptrap
permit udp any eq snmptrap any
permit tcp any any range 9998 9999
permit tcp any any eq 6970
permit udp any any range 7076 7077
permit udp any any range 9078 9079
permit tcp any any eq 15063
permit tcp any any eq 15064
permit udp any any eq 15064
permit udp any any eq 15063
permit tcp any any eq 5060
permit tcp any any eq 5061
permit tcp any any eq 5062
permit udp any any eq 5060
permit udp any any eq 5061
permit udp any any eq 5062
permit tcp any any eq 8883
permit udp any any eq ntp
permit tcp any any eq 554
permit udp any any eq 554
permit tcp any any range 2195 2196
permit tcp any any range 5228 5230
permit udp any any eq 5223
permit tcp any any eq 8557
permit tcp any any eq 9002
permit tcp any any eq 19302
permit udp any any eq 9350
permit udp any eq snmp any
permit udp any any range 16500 65000
permit icmp any any
permit gre any any
!
ip sla 20
icmp-echo 8.8.8.8 source-interface GigabitEthernet0/0/0
timeout 6000
frequency 10
ip sla schedule 20 life forever start-time now
logging trap notifications
logging host 10.0.100.25
!
route-map RM-NAT-ISP02 permit 10
match ip address ACL-DNAT
match interface GigabitEthernet0/1/0
!
route-map RM-NAT-ISP01 permit 10
match ip address ACL-DNAT
match interface GigabitEthernet0/0/0
!
!
snmp-server community public RO
snmp-server community private RW
snmp-server location Taylorsville
snmp-server contact stevenclark612@icloud.com
no snmp-server enable traps entity-sensor threshold
snmp-server host 10.0.100.25 version 2c private
snmp-server host 10.0.100.25 version 2c public
!
!
!
control-plane
!
!
!
line con 0
exec-timeout 0 0
login authentication local_access
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
access-class 23 in
privilege level 15
password 7
login authentication local_access
transport input telnet ssh
!
scheduler allocate 20000 1000
ntp master
ntp update-calendar
ntp server 129.6.15.32
ntp server 129.6.15.26
ntp server 129.6.15.27
!
end

[balaji.bandi]

what is the ask and issue here ?

[stevenclark612]

1st how can I apply Host-Ports to both primary ans back up isp interface? Also, the inside out ZBFW, Is the class maps etc to get all the protocols open on inside okay. Should I keep it or reduce the protocols. Not sure yet if it effects speed of the router. 

[balaji.bandi]

st how can I apply Host-Ports to both primary ans back up isp interface?

what host ports - do you have port numbers ?

check the ZBF config guide and explanation : (since we are not sure what is the issue and we need more clarification what is not working ? and working ?)

https://community.cisco.com/t5/security-knowledge-base/ios-zone-based-firewall-step-by-step-basic-configuration/ta-p/3142774/jump-to/first-unread-message

Should I keep it or reduce the protocols. Not sure yet if it effects speed of the router. 

i would advise make it minimal, rather router get CPU hit high due to processing long list.