- Cisco Community
- Technology and Support
- Networking
- Switching
- Problem opening port 443
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Problem opening port 443
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-03-2014 02:28 AM - edited 03-07-2019 08:57 PM
I'm new to using Cisco router. On the network I have to configure they are using an Cisco 851 router. I'm installing a new server which requires port 443 to be open. Port 80 is already open because of an old server which we will no longer need. I tried adding the port 443 but to no avail.
Below the configuration file.
Could anyone point out to me what is wrong and what I am doing wrong in opening port 443: ( I deleted/changed from below the crypto pki certificate, admin privilege 15 secret 5 and some ip adress pointing out to our location, because I had an feeling that I do not want those on the internet)
Building configuration...
Current configuration : 14177 bytes
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname ec
!
boot-start-marker
boot-end-marker
!
logging buffered 51200
logging console critical
enable secret 5 $
!
no aaa new-model
clock timezone Berlin 1
clock summer-time Berlin date Mar 30 2003 2:00 Oct 26 2003 3:00
!
crypto pki trustpoint TP-self-signed-471741731
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-471741731
revocation-check none
rsakeypair TP-self-signed-471741731
!
!
crypto pki certificate chain TP-self-signed-471741731
certificate self-signed 01
quit
dot11 syslog
no ip source-route
ip dhcp excluded-address 10.10.10.1
!
!
ip cef
ip inspect log drop-pkt
ip inspect name fw appfw fw
ip inspect name fw tcp
ip inspect name fw imap
ip inspect name fw imap3
ip inspect name fw appleqtc
ip inspect name fw cuseeme
ip inspect name fw realaudio
ip inspect name fw rtsp
ip inspect name fw streamworks
ip inspect name fw vdolive
ip inspect name fw https
ip inspect name fw dns
ip inspect name fw ftp
ip inspect name fw pptp
ip inspect name fw smtp
ip inspect name sdm_ins_in_100 appfw sdm_ins_in_100
ip inspect name sdm_ins_in_100 dns
ip inspect name sdm_ins_in_100 h323
ip inspect name sdm_ins_in_100 https
ip inspect name sdm_ins_in_100 icmp
ip inspect name sdm_ins_in_100 pop3 reset
ip inspect name sdm_ins_in_100 rcmd
ip inspect name sdm_ins_in_100 sqlnet
ip inspect name sdm_ins_in_100 tcp
ip inspect name sdm_ins_in_100 udp
ip inspect name sdm_ins_in_100 cuseeme
ip inspect name sdm_ins_in_100 realaudio
ip inspect name sdm_ins_in_100 rtsp
ip inspect name sdm_ins_in_100 streamworks
ip inspect name sdm_ins_in_100 vdolive
ip inspect name sdm_ins_in_100 appleqtc
ip inspect name sdm_ins_in_100 pptp
ip inspect name sdm_ins_in_100 imap3
ip inspect name sdm_ins_in_100 smtp
ip inspect name SDM_HIGH appfw SDM_HIGH
ip inspect name SDM_HIGH icmp
ip inspect name SDM_HIGH dns
ip inspect name SDM_HIGH esmtp
ip inspect name SDM_HIGH https
ip inspect name SDM_HIGH imap reset
ip inspect name SDM_HIGH pop3 reset
ip inspect name SDM_HIGH tcp
ip inspect name SDM_HIGH udp
ip inspect name SDM_HIGH rtsp
ip inspect name SDM_HIGH realaudio
ip inspect name SDM_HIGH streamworks
ip inspect name SDM_HIGH vdolive
ip inspect name SDM_HIGH cuseeme
ip inspect name SDM_HIGH appleqtc
no ip bootp server
ip domain name internal.xxxxxx.com
ip name-server 111.111.14.196
ip name-server 111.111.14.212
!
appfw policy-name sdm_ins_in_100
application im aol
service default action allow alarm
service text-chat action allow alarm
server permit name login.oscar.aol.com
server permit name toc.oscar.aol.com
server permit name oam-d09a.blue.aol.com
application im msn
service default action allow alarm
service text-chat action allow alarm
server permit name messenger.hotmail.com
server permit name gateway.messenger.hotmail.com
server permit name webmessenger.msn.com
application http
strict-http action allow alarm
port-misuse p2p action reset alarm
port-misuse im action reset alarm
port-misuse tunneling action allow alarm
application im yahoo
service default action allow alarm
service text-chat action allow alarm
server permit name scs.msg.yahoo.com
server permit name scsa.msg.yahoo.com
server permit name scsb.msg.yahoo.com
server permit name scsc.msg.yahoo.com
server permit name scsd.msg.yahoo.com
server permit name cs16.msg.dcn.yahoo.com
server permit name cs19.msg.dcn.yahoo.com
server permit name cs42.msg.dcn.yahoo.com
server permit name cs53.msg.dcn.yahoo.com
server permit name cs54.msg.dcn.yahoo.com
server permit name ads1.vip.scd.yahoo.com
server permit name radio1.launch.vip.dal.yahoo.com
server permit name in1.msg.vip.re2.yahoo.com
server permit name data1.my.vip.sc5.yahoo.com
server permit name address1.pim.vip.mud.yahoo.com
server permit name edit.messenger.yahoo.com
server permit name messenger.yahoo.com
server permit name http.pager.yahoo.com
server permit name privacy.yahoo.com
server permit name csa.yahoo.com
server permit name csb.yahoo.com
server permit name csc.yahoo.com
!
appfw policy-name SDM_HIGH
application im aol
service default action reset alarm
service text-chat action reset alarm
server deny name login.oscar.aol.com
server deny name toc.oscar.aol.com
server deny name oam-d09a.blue.aol.com
application http
strict-http action reset alarm
port-misuse im action reset alarm
port-misuse p2p action reset alarm
port-misuse tunneling action reset alarm
application im yahoo
service default action reset alarm
service text-chat action reset alarm
server deny name scs.msg.yahoo.com
server deny name scsa.msg.yahoo.com
server deny name scsb.msg.yahoo.com
server deny name scsc.msg.yahoo.com
server deny name scsd.msg.yahoo.com
server deny name cs16.msg.dcn.yahoo.com
server deny name cs19.msg.dcn.yahoo.com
server deny name cs42.msg.dcn.yahoo.com
server deny name cs53.msg.dcn.yahoo.com
server deny name cs54.msg.dcn.yahoo.com
server deny name ads1.vip.scd.yahoo.com
server deny name radio1.launch.vip.dal.yahoo.com
server deny name in1.msg.vip.re2.yahoo.com
server deny name data1.my.vip.sc5.yahoo.com
server deny name address1.pim.vip.mud.yahoo.com
server deny name edit.messenger.yahoo.com
server deny name messenger.yahoo.com
server deny name http.pager.yahoo.com
server deny name privacy.yahoo.com
server deny name csa.yahoo.com
server deny name csb.yahoo.com
server deny name csc.yahoo.com
!
appfw policy-name fw
application http
!
parameter-map type protocol-info msn-servers
server name messenger.hotmail.com
server name gateway.messenger.hotmail.com
server name webmessenger.msn.com
parameter-map type protocol-info aol-servers
server name login.oscar.aol.com
server name toc.oscar.aol.com
server name oam-d09a.blue.aol.com
parameter-map type protocol-info yahoo-servers
server name scs.msg.yahoo.com
server name scsa.msg.yahoo.com
server name scsb.msg.yahoo.com
server name scsc.msg.yahoo.com
server name scsd.msg.yahoo.com
server name cs16.msg.dcn.yahoo.com
server name cs19.msg.dcn.yahoo.com
server name cs42.msg.dcn.yahoo.com
server name cs53.msg.dcn.yahoo.com
server name cs54.msg.dcn.yahoo.com
server name ads1.vip.scd.yahoo.com
server name radio1.launch.vip.dal.yahoo.com
server name in1.msg.vip.re2.yahoo.com
server name data1.my.vip.sc5.yahoo.com
server name address1.pim.vip.mud.yahoo.com
server name edit.messenger.yahoo.com
server name messenger.yahoo.com
server name http.pager.yahoo.com
server name privacy.yahoo.com
server name csa.yahoo.com
server name csb.yahoo.com
server name csc.yahoo.com
!
!
username admin privilege 15 secret 5 !
!
archive
log config
hidekeys
!
!
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description $FW_OUTSIDE$$ETH-WAN$$ES_WAN$
ip address 111.111.146.167 255.255.255.0
ip access-group 105 in
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip inspect sdm_ins_in_100 in
ip inspect fw out
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
ip address 192.168.0.3 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 111.111.146.161
!
ip http server
ip http port 8080
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source static tcp 192.168.0.2 80 interface FastEthernet4 80
ip nat inside source list 1 interface FastEthernet4 overload
ip nat inside source static tcp 192.168.0.2 1723 interface FastEthernet4 1723
ip nat inside source static tcp 192.168.0.2 143 interface FastEthernet4 143
ip nat inside source static tcp 192.168.0.2 47 interface FastEthernet4 47
ip nat inside source static tcp 192.168.0.244 5003 interface FastEthernet4 5003
ip nat inside source static tcp 192.168.0.2 25 interface FastEthernet4 25
ip nat inside source static tcp 192.168.0.2 443 interface FastEthernet4 443
!
ip access-list extended sdm_fastethernet4_in
remark SDM_ACL Category=1
remark PPTP
permit tcp any eq 1723 host 192.168.0.2 eq 1723
!
logging trap debugging
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 100 remark SDM_ACL Category=128
access-list 100 permit ip host 255.255.255.255 any
access-list 100 permit ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip 111.111.146.0 0.0.0.255 any
access-list 101 remark SDM_ACL Category=0
access-list 101 permit ip any host 192.168.0.2
access-list 102 remark SDM_ACL Category=128
access-list 102 permit ip host 255.255.255.255 any
access-list 102 permit ip 127.0.0.0 0.255.255.255 any
access-list 102 permit ip 111.111.146.0 0.0.0.255 any
access-list 103 remark SDM_ACL Category=0
access-list 103 permit ip any host 192.168.0.2
access-list 104 remark auto generated by SDM firewall configuration
access-list 104 remark SDM_ACL Category=1
access-list 104 deny ip 111.111.146.0 0.0.0.255 any
access-list 104 deny ip host 255.255.255.255 any
access-list 104 deny ip 127.0.0.0 0.255.255.255 any
access-list 104 permit ip any any
access-list 104 permit tcp any host 192.168.0.2 eq www
access-list 105 remark auto generated by SDM firewall configuration
access-list 105 remark SDM_ACL Category=1
access-list 105 permit tcp any host 111.111.146.167 eq www
access-list 105 remark filemaker
access-list 105 permit tcp any host 111.111.146.167 eq 5003
access-list 105 permit tcp any host 111.111.146.167 eq 143 log
access-list 105 remark test smtp
access-list 105 permit tcp any host 111.111.146.167 eq smtp log
access-list 105 remark imapudp
access-list 105 permit udp any host 111.111.146.167 eq 143
access-list 105 remark GRE
access-list 105 permit gre any host 111.111.146.167
access-list 105 remark pptp
access-list 105 permit tcp any host 111.111.146.167 eq 1723
access-list 105 remark FMUDP
access-list 105 permit udp any host 111.111.146.167 eq 5003
access-list 105 permit udp host 111.111.4.5 eq domain host 111.111.146.167
access-list 105 deny ip 192.168.0.0 0.0.0.255 any
access-list 105 permit icmp any host 111.111.146.167 echo-reply
access-list 105 permit icmp any host 111.111.146.167 time-exceeded
access-list 105 permit icmp any host 111.111.146.167 unreachable
access-list 105 deny ip 10.0.0.0 0.255.255.255 any
access-list 105 deny ip 172.16.0.0 0.15.255.255 any
access-list 105 deny ip 192.168.0.0 0.0.255.255 any
access-list 105 deny ip 127.0.0.0 0.255.255.255 any
access-list 105 deny ip host 255.255.255.255 any
access-list 105 deny ip host 0.0.0.0 any
access-list 105 deny ip any any log
access-list 105 permit tcp any any eq 443
access-list 105 permit udp any host 111.111.146.167 eq 443
access-list 105 permit tcp any host 111.111.146.167 eq 443 log
no cdp run
!
control-plane
!
banner exec ^C
% Password expiration warning.
- Labels:
-
Other Switching
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-03-2014 01:44 PM
You need to put permit entries before deny any any entry
access-list 105 deny ip any any log
access-list 105 permit tcp any any eq 443
access-list 105 permit udp any host 111.111.146.167 eq 443
access-list 105 permit tcp any host 111.111.146.167 eq 443 log
It should be like this:
access-list 105 permit tcp any host 111.111.146.167 eq 443 log
access-list 105 deny ip any any log
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
10-07-2014 05:38 AM
Hi Vishalvyas1986.
We changed the order. This first didn't change anything even after turning off the router and turning it on. (the running configuration was showing the correct order afterwards). The router however crashed after a couple of hours after which the port forwarding worked. With crashing I mean that the router was not accessible anymore and no internet trafic was passing rough the router.
After that first "crash" the router keeps crashing. Every 5-20 minutes we lose internet connection and cannot reach the router anymore. If we wait for a couple of minutes the router resets itself and is working again.
We are getting the errors in the log files as shown below. We searched the internet and found that we should upgrade our IOS. but we are running the latest version 12.4(15)T7 already.
Any further help would be appreciated.
We looked trough the log files and saw the following:
000304: *May 12 11:31:59.027 PCTime: %SYS-2-NOTQ: unqueue didn't find 83903D8C in queue 81E22960 -Process= "DNS Resolver", ipl= 0, pid= 64, -Traceback= 0x8060F644 0x8011DC44 0x8062DB98 0x809B453C 0x809B4778 0x809B4CB8 0x8010476C 0x801078B0
000305: *May 12 11:32:08.015 PCTime: %FW-4-TCP_OoO_SEG: Dropping TCP Segment: seq:2697537752 1420 bytes is out-of-order; expected seq:2697501872. Reason: TCP reassembly queue overflow - session 192.168.0.56:50762 to 162.13.76.172:80
000306: *May 12 11:32:08.015 PCTime: %FW-6-DROP_PKT: Dropping http session 162.13.76.172:80 192.168.0.56:50762 due to Out-Of-Order Segment with ip ident 57058 tcpflags 0x5010 seq.no 2697537752 ack 3265220652
000307: *May 12 11:32:16.535 PCTime: %ALIGN-3-SPURIOUS: Spurious memory access made at 0x8062EB08 reading 0x0
000308: *May 12 11:32:16.535 PCTime: %ALIGN-3-TRACE: -Traceback= 0x8062EB08 0x8062F0A0 0x81495C24 0x80630C80 0x80F063F0 0x80378E7C 0x8010476C 0x801078B0
000309: *May 12 11:32:16.535 PCTime: %ALIGN-3-TRACE: -Traceback= 0x8062EB10 0x8062F0A0 0x81495C24 0x80630C80 0x80F063F0 0x80378E7C 0x8010476C 0x801078B0
000310: *May 12 11:32:16.535 PCTime: %ALIGN-3-TRACE: -Traceback= 0x80ED6234 0x8062EB20 0x8062F0A0 0x81495C24 0x80630C80 0x80F063F0 0x80378E7C 0x8010476C
000311: *May 12 11:32:16.535 PCTime: %ALIGN-3-TRACE: -Traceback= 0x80ED6238 0x8062EB20 0x8062F0A0 0x81495C24 0x80630C80 0x80F063F0 0x80378E7C 0x8010476C
000312: *May 12 11:32:16.535 PCTime: %ALIGN-3-TRACE: -Traceback= 0x80ED623C 0x8062EB20 0x8062F0A0 0x81495C24 0x80630C80 0x80F063F0 0x80378E7C 0x8010476C
000313: *May 12 11:32:16.535 PCTime: %ALIGN-3-TRACE: -Traceback= 0x80ED5770 0x8062EB88 0x8062F0A0 0x81495C24 0x80630C80 0x80F063F0 0x80378E7C 0x8010476C
000314: *May 12 11:32:16.535 PCTime: %ALIGN-3-TRACE: -Traceback= 0x80ED5774 0x8062EB88 0x8062F0A0 0x81495C24 0x80630C80 0x80F063F0 0x80378E7C 0x8010476C
000315: *May 12 11:32:25.271 PCTime: %SYS-3-CPUHOG: Task is running for (5000)msecs, more than (5000)msecs (38/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BF13C 0x809B04DC 0x8062EE20 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000316: *May 12 11:32:30.335 PCTime: %SYS-3-CPUHOG: Task is running for (10000)msecs, more than (5000)msecs (54/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BE55C 0x8062EE48 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000317: *May 12 11:32:35.407 PCTime: %SYS-3-CPUHOG: Task is running for (15000)msecs, more than (5000)msecs (72/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BE55C 0x8062EE48 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000318: *May 12 11:32:40.443 PCTime: %SYS-3-CPUHOG: Task is running for (20000)msecs, more than (5000)msecs (81/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BE55C 0x8062EE48 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000319: *May 12 11:32:45.479 PCTime: %SYS-3-CPUHOG: Task is running for (25000)msecs, more than (5000)msecs (90/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BE55C 0x8062EE48 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000320: *May 12 11:32:50.519 PCTime: %SYS-3-CPUHOG: Task is running for (30000)msecs, more than (5000)msecs (100/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BE55C 0x8062EE48 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000321: *May 12 11:32:55.563 PCTime: %SYS-3-CPUHOG: Task is running for (35000)msecs, more than (5000)msecs (111/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BF13C 0x809B04DC 0x8062EE20 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000322: *May 12 11:33:00.647 PCTime: %SYS-3-CPUHOG: Task is running for (40000)msecs, more than (5000)msecs (132/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BF13C 0x809B04DC 0x8062EE20 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000323: *May 12 11:33:05.707 PCTime: %SYS-3-CPUHOG: Task is running for (45000)msecs, more than (5000)msecs (147/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BF13C 0x8062ED70 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000324: *May 12 11:33:10.771 PCTime: %SYS-3-CPUHOG: Task is running for (50000)msecs, more than (5000)msecs (163/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BF13C 0x809B04DC 0x8062EE20 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000325: *May 12 11:33:15.835 PCTime: %SYS-3-CPUHOG: Task is running for (55000)msecs, more than (5000)msecs (179/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BF13C 0x809B04DC 0x8062EE20 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000326: *May 12 11:33:20.883 PCTime: %SYS-3-CPUHOG: Task is running for (60000)msecs, more than (5000)msecs (191/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BF13C 0x809B04DC 0x8062EE20 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000327: *May 12 11:33:25.935 PCTime: %SYS-3-CPUHOG: Task is running for (65000)msecs, more than (5000)msecs (204/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BF13C 0x809B04DC 0x8062EE20 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000328: *May 12 11:33:30.979 PCTime: %SYS-3-CPUHOG: Task is running for (70000)msecs, more than (5000)msecs (215/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BE55C 0x8062EE48 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000329: *May 12 11:33:36.059 PCTime: %SYS-3-CPUHOG: Task is running for (75000)msecs, more than (5000)msecs (235/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BE55C 0x8062EE48 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000330: *May 12 11:33:41.135 PCTime: %SYS-3-CPUHOG: Task is running for (80000)msecs, more than (5000)msecs (254/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BF13C 0x809B04DC 0x8062EE20 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000331: *May 12 11:33:46.183 PCTime: %SYS-3-CPUHOG: Task is running for (85000)msecs, more than (5000)msecs (266/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BF13C 0x809B04DC 0x8062EE20 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000332: *May 12 11:33:51.267 PCTime: %SYS-3-CPUHOG: Task is running for (90000)msecs, more than (5000)msecs (287/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BF13C 0x8062ED70 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000333: *May 12 11:33:56.327 PCTime: %SYS-3-CPUHOG: Task is running for (95000)msecs, more than (5000)msecs (302/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BE55C 0x8062EE48 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000334: *May 12 11:34:01.383 PCTime: %SYS-3-CPUHOG: Task is running for (100000)msecs, more than (5000)msecs (316/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BF13C 0x809B04DC 0x8062EE20 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000335: *May 12 11:34:06.447 PCTime: %SYS-3-CPUHOG: Task is running for (105000)msecs, more than (5000)msecs (332/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BE55C 0x8062EE48 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000336: *May 12 11:34:11.515 PCTime: %SYS-3-CPUHOG: Task is running for (110000)msecs, more than (5000)msecs (349/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BF13C 0x8062ED70 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000337: *May 12 11:34:16.551 PCTime: %SYS-3-CPUHOG: Task is running for (115000)msecs, more than (5000)msecs (358/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BE55C 0x8062EE48 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000338: *May 12 11:34:21.607 PCTime: %SYS-3-CPUHOG: Task is running for (120000)msecs, more than (5000)msecs (372/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BE55C 0x8062EE48 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000339: *May 12 11:34:26.659 PCTime: %SYS-3-CPUHOG: Task is running for (125000)msecs, more than (5000)msecs (385/28),process = Appfw IM DNS Resolver.
-Traceback= 0x814BF13C 0x809B04DC 0x8062EE20 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000340: *May 12 11:34:29.719 PCTime: %SYS-2-WATCHDOG: Process aborted on watchdog timeout, process = Appfw IM DNS Resolver.
-Traceback= 0x814BF13C 0x8062ED70 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000341: *May 12 11:34:29.811 PCTime: %ALIGN-3-SPURIOUS: Spurious memory access made at 0x814BE564 reading 0x0
000342: *May 12 11:34:29.811 PCTime: %ALIGN-3-TRACE: -Traceback= 0x814BE564 0x8062EE48 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0 0x0
000343: *May 12 11:34:29.811 PCTime: %ALIGN-3-TRACE: -Traceback= 0x814BF138 0x8062ED70 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0 0x0
000344: *May 12 11:34:29.811 PCTime: %ALIGN-3-TRACE: -Traceback= 0x814BF138 0x809B04DC 0x8062EE20 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0
000345: *May 12 11:34:29.811 PCTime: %ALIGN-3-TRACE: -Traceback= 0x814BE558 0x8062EE48 0x809B2E70 0x81358E00 0x813594D4 0x8010476C 0x801078B0 0x0
Our current running config:
Building configuration...
Current configuration : 14161 bytes
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname ec
!
boot-start-marker
boot-end-marker
!
logging buffered 51200
logging console critical
enable secret 5 $1$HWxK$nQxiluxLNri1scNlJ/yra1
!
no aaa new-model
clock timezone PCTime 1
clock summer-time PCTime date Mar 30 2003 2:00 Oct 26 2003 3:00
!
crypto pki trustpoint TP-self-signed-471741731
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-471741731
revocation-check none
rsakeypair TP-self-signed-471741731
!
!
crypto pki certificate chain TP-self-signed-471741731
certificate self-signed 01
quit
dot11 syslog
no ip source-route
ip dhcp excluded-address 10.10.10.1
!
!
ip cef
ip inspect log drop-pkt
ip inspect name fw appfw fw
ip inspect name fw tcp
ip inspect name fw imap
ip inspect name fw imap3
ip inspect name fw appleqtc
ip inspect name fw cuseeme
ip inspect name fw realaudio
ip inspect name fw rtsp
ip inspect name fw streamworks
ip inspect name fw vdolive
ip inspect name fw https
ip inspect name fw dns
ip inspect name fw ftp
ip inspect name fw pptp
ip inspect name fw smtp
ip inspect name sdm_ins_in_100 appfw sdm_ins_in_100
ip inspect name sdm_ins_in_100 dns
ip inspect name sdm_ins_in_100 h323
ip inspect name sdm_ins_in_100 https
ip inspect name sdm_ins_in_100 icmp
ip inspect name sdm_ins_in_100 pop3 reset
ip inspect name sdm_ins_in_100 rcmd
ip inspect name sdm_ins_in_100 sqlnet
ip inspect name sdm_ins_in_100 tcp
ip inspect name sdm_ins_in_100 udp
ip inspect name sdm_ins_in_100 cuseeme
ip inspect name sdm_ins_in_100 realaudio
ip inspect name sdm_ins_in_100 rtsp
ip inspect name sdm_ins_in_100 streamworks
ip inspect name sdm_ins_in_100 vdolive
ip inspect name sdm_ins_in_100 appleqtc
ip inspect name sdm_ins_in_100 pptp
ip inspect name sdm_ins_in_100 imap3
ip inspect name sdm_ins_in_100 smtp
ip inspect name SDM_HIGH appfw SDM_HIGH
ip inspect name SDM_HIGH icmp
ip inspect name SDM_HIGH dns
ip inspect name SDM_HIGH esmtp
ip inspect name SDM_HIGH https
ip inspect name SDM_HIGH imap reset
ip inspect name SDM_HIGH pop3 reset
ip inspect name SDM_HIGH tcp
ip inspect name SDM_HIGH udp
ip inspect name SDM_HIGH rtsp
ip inspect name SDM_HIGH realaudio
ip inspect name SDM_HIGH streamworks
ip inspect name SDM_HIGH vdolive
ip inspect name SDM_HIGH cuseeme
ip inspect name SDM_HIGH appleqtc
no ip bootp server
ip domain name internal.xxxxxxx.com
ip name-server 111.111.14.196
ip name-server 111.111.14.212
!
appfw policy-name sdm_ins_in_100
application im aol
service default action allow alarm
service text-chat action allow alarm
server permit name login.oscar.aol.com
server permit name toc.oscar.aol.com
server permit name oam-d09a.blue.aol.com
application im msn
service default action allow alarm
service text-chat action allow alarm
server permit name messenger.hotmail.com
server permit name gateway.messenger.hotmail.com
server permit name webmessenger.msn.com
application http
strict-http action allow alarm
port-misuse p2p action reset alarm
port-misuse im action reset alarm
port-misuse tunneling action allow alarm
application im yahoo
service default action allow alarm
service text-chat action allow alarm
server permit name scs.msg.yahoo.com
server permit name scsa.msg.yahoo.com
server permit name scsb.msg.yahoo.com
server permit name scsc.msg.yahoo.com
server permit name scsd.msg.yahoo.com
server permit name cs16.msg.dcn.yahoo.com
server permit name cs19.msg.dcn.yahoo.com
server permit name cs42.msg.dcn.yahoo.com
server permit name cs53.msg.dcn.yahoo.com
server permit name cs54.msg.dcn.yahoo.com
server permit name ads1.vip.scd.yahoo.com
server permit name radio1.launch.vip.dal.yahoo.com
server permit name in1.msg.vip.re2.yahoo.com
server permit name data1.my.vip.sc5.yahoo.com
server permit name address1.pim.vip.mud.yahoo.com
server permit name edit.messenger.yahoo.com
server permit name messenger.yahoo.com
server permit name http.pager.yahoo.com
server permit name privacy.yahoo.com
server permit name csa.yahoo.com
server permit name csb.yahoo.com
server permit name csc.yahoo.com
!
appfw policy-name SDM_HIGH
application im aol
service default action reset alarm
service text-chat action reset alarm
server deny name login.oscar.aol.com
server deny name toc.oscar.aol.com
server deny name oam-d09a.blue.aol.com
application http
strict-http action reset alarm
port-misuse im action reset alarm
port-misuse p2p action reset alarm
port-misuse tunneling action reset alarm
application im yahoo
service default action reset alarm
service text-chat action reset alarm
server deny name scs.msg.yahoo.com
server deny name scsa.msg.yahoo.com
server deny name scsb.msg.yahoo.com
server deny name scsc.msg.yahoo.com
server deny name scsd.msg.yahoo.com
server deny name cs16.msg.dcn.yahoo.com
server deny name cs19.msg.dcn.yahoo.com
server deny name cs42.msg.dcn.yahoo.com
server deny name cs53.msg.dcn.yahoo.com
server deny name cs54.msg.dcn.yahoo.com
server deny name ads1.vip.scd.yahoo.com
server deny name radio1.launch.vip.dal.yahoo.com
server deny name in1.msg.vip.re2.yahoo.com
server deny name data1.my.vip.sc5.yahoo.com
server deny name address1.pim.vip.mud.yahoo.com
server deny name edit.messenger.yahoo.com
server deny name messenger.yahoo.com
server deny name http.pager.yahoo.com
server deny name privacy.yahoo.com
server deny name csa.yahoo.com
server deny name csb.yahoo.com
server deny name csc.yahoo.com
!
appfw policy-name fw
application http
!
parameter-map type protocol-info msn-servers
server name messenger.hotmail.com
server name gateway.messenger.hotmail.com
server name webmessenger.msn.com
parameter-map type protocol-info aol-servers
server name login.oscar.aol.com
server name toc.oscar.aol.com
server name oam-d09a.blue.aol.com
parameter-map type protocol-info yahoo-servers
server name scs.msg.yahoo.com
server name scsa.msg.yahoo.com
server name scsb.msg.yahoo.com
server name scsc.msg.yahoo.com
server name scsd.msg.yahoo.com
server name cs16.msg.dcn.yahoo.com
server name cs19.msg.dcn.yahoo.com
server name cs42.msg.dcn.yahoo.com
server name cs53.msg.dcn.yahoo.com
server name cs54.msg.dcn.yahoo.com
server name ads1.vip.scd.yahoo.com
server name radio1.launch.vip.dal.yahoo.com
server name in1.msg.vip.re2.yahoo.com
server name data1.my.vip.sc5.yahoo.com
server name address1.pim.vip.mud.yahoo.com
server name edit.messenger.yahoo.com
server name messenger.yahoo.com
server name http.pager.yahoo.com
server name privacy.yahoo.com
server name csa.yahoo.com
server name csb.yahoo.com
server name csc.yahoo.com
!
!
username admin privilege 15 secret 5
!
!
archive
log config
hidekeys
!
!
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description $FW_OUTSIDE$$ETH-WAN$$ES_WAN$
ip address 111.111.146.167 255.255.255.0
ip access-group 105 in
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip inspect sdm_ins_in_100 in
ip inspect fw out
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
ip address 192.168.0.3 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 111.111.146.161
!
ip http server
ip http port 8080
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source static tcp 192.168.0.2 80 interface FastEthernet4 80
ip nat inside source list 1 interface FastEthernet4 overload
ip nat inside source static tcp 192.168.0.2 1723 interface FastEthernet4 1723
ip nat inside source static tcp 192.168.0.2 143 interface FastEthernet4 143
ip nat inside source static tcp 192.168.0.2 47 interface FastEthernet4 47
ip nat inside source static tcp 192.168.0.244 5003 interface FastEthernet4 5003
ip nat inside source static tcp 192.168.0.2 25 interface FastEthernet4 25
ip nat inside source static tcp 192.168.0.1 443 interface FastEthernet4 443
!
ip access-list extended NUMBER
ip access-list extended sdm_fastethernet4_in
remark SDM_ACL Category=1
remark PPTP
permit tcp any eq 1723 host 192.168.0.2 eq 1723
!
logging trap debugging
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 100 remark SDM_ACL Category=128
access-list 100 permit ip host 255.255.255.255 any
access-list 100 permit ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip 111.111.146.0 0.0.0.255 any
access-list 101 remark SDM_ACL Category=0
access-list 101 permit ip any host 192.168.0.2
access-list 102 remark SDM_ACL Category=128
access-list 102 permit ip host 255.255.255.255 any
access-list 102 permit ip 127.0.0.0 0.255.255.255 any
access-list 102 permit ip 111.111.146.0 0.0.0.255 any
access-list 103 remark SDM_ACL Category=0
access-list 103 permit ip any host 192.168.0.2
access-list 104 remark auto generated by SDM firewall configuration
access-list 104 remark SDM_ACL Category=1
access-list 104 deny ip 111.111.146.0 0.0.0.255 any
access-list 104 deny ip host 255.255.255.255 any
access-list 104 deny ip 127.0.0.0 0.255.255.255 any
access-list 104 permit ip any any
access-list 104 permit tcp any host 192.168.0.2 eq www
access-list 104 permit tcp any host 192.168.0.1 eq 443
access-list 105 remark auto generated by SDM firewall configuration
access-list 105 remark SDM_ACL Category=1
access-list 105 permit tcp any host 111.111.146.167 eq www
access-list 105 remark filemaker
access-list 105 permit tcp any host 111.111.146.167 eq 5003
access-list 105 permit tcp any host 111.111.146.167 eq 143 log
access-list 105 remark test smtp
access-list 105 permit tcp any host 111.111.146.167 eq smtp log
access-list 105 remark imapudp
access-list 105 permit udp any host 111.111.146.167 eq 143
access-list 105 remark GRE
access-list 105 permit gre any host 111.111.146.167
access-list 105 remark pptp
access-list 105 permit tcp any host 111.111.146.167 eq 1723
access-list 105 remark FMUDP
access-list 105 permit udp any host 111.111.146.167 eq 5003
access-list 105 permit udp host 111.111.14.196 eq domain host 111.111.146.167
access-list 105 permit tcp any host 111.111.146.167 eq 443
access-list 105 deny ip 192.168.0.0 0.0.0.255 any
access-list 105 permit icmp any host 111.111.146.167 echo-reply
access-list 105 permit icmp any host 111.111.146.167 time-exceeded
access-list 105 permit icmp any host 111.111.146.167 unreachable
access-list 105 deny ip 10.0.0.0 0.255.255.255 any
access-list 105 deny ip 172.16.0.0 0.15.255.255 any
access-list 105 deny ip 192.168.0.0 0.0.255.255 any
access-list 105 deny ip 127.0.0.0 0.255.255.255 any
access-list 105 deny ip host 255.255.255.255 any
access-list 105 deny ip host 0.0.0.0 any
access-list 105 deny ip any any log
no cdp run
!
control-plane
!
banner exec ^C
% Password expiration warning.
-----------------------------------------------------------------------
Cisco Router and Security Device Manager (SDM) is installed on this device and
it provides the default username "cisco" for one-time use. If you have already
used the username "cisco" to login to the router and your IOS image supports the
"one-time" user option, then this username has already expired. You will not be
able to login to the router with this username after you exit this session.
It is strongly suggested that you create a new username with a privilege level
of 15 using the following command.
username <myuser> privilege 15 secret 0 <mypassword>
Replace <myuser> and <mypassword> with the username and password you want to
use.
-----------------------------------------------------------------------
^C
banner login ^CAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
login local
no modem enable
transport output telnet
line aux 0
login local
transport output telnet
line vty 0 4
privilege level 15
login local
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end
command completed.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide