I just added the pictures in the original post. ... View more

Below is the correct configuration. The sdspfarm tag was a typo here. Attached is the "debug sccp all" output. *************************************************************** sccp local GigabitEthernet0/0 sccp ccm 10.0.180.41 identifier 1 priority 1 version 7.0 sccp ! sccp ccm group 1 bind interface GigabitEthernet0/0 associate ccm 1 priority 1 associate profile 1 register G711u-SW-SCCP switchover method immediate switchback method immediate ! dspfarm profile 1 mtp codec g711ulaw maximum sessions software 50 associate application SCCP ! telephony-service sdspfarm units 10 sdspfarm tag 1 G711u-SW-SCCP no auto-reg-ephone max-ephones 20 max-dn 20 ip source-address 10.0.180.41 port 2000 ******************************************************     VG1(config)#do show sccp SCCP Admin State: UP Gateway Local Interface: GigabitEthernet0/0/0 IPv4 Address: 10.0.180.41 Port Number: 2000 IP Precedence: 5 User Masked Codec list: None Call Manager: 10.0.180.41, Port Number: 2000 Priority: 1, Version: 7.0, Identifier: 1 MTP Oper State: ACTIVE_IN_PROGRESS - Cause Code: NOT_REGIS_WITH_CCM Active Call Manager: NONE TCP Link Status: NOT_CONNECTED, Profile Identifier: 1 Reported Max Streams: 100, Reported Max OOS Streams: 0 Supported Codec: g711ulaw, Maximum Packetization Period: 30 Supported Codec: rfc2833 dtmf, Maximum Packetization Period: 30 Supported Codec: rfc2833 pass-thru, Maximum Packetization Period: 30 Supported Codec: inband-dtmf to rfc2833 conversion, Maximum Packetization Period: 30 ... View more

I will install it and I will inform you. ... View more

Thanks for your time. Yes I also have the lines in bold. I've also configured a site to site vpn, that is why you see a CMAP under Dialer1. I just wanted to concentrate to the DSL part and I put only the specific commands.   ... View more

Unfortunately we don't have a Firewall for the time being so this is the only thing we can do. If you can provide us your opinion by agreeing or not with Georg Pauwen please go ahead. Or if you have something else to add... Thank you! ... View more

Georg Pauwen thank you. This router is used only for Web browsing without restrictions and for remote access to internal devices through Site to Site VPN. If you think there are any additional ACLs that we can put in order to protect the inbound attacks please tell me. ... View more

Hi my friend. This is my configuration. ********************************************************************************************************* version 15.5 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname Router ! boot-start-marker boot-end-marker ! ip dhcp pool DATA network 10.0.145.0 255.255.255.0  default-router 10.0.145.1  dns-server 8.8.8.8 ! ip name-server 8.8.8.8 ! controller VDSL 0 no cdp run ! crypto isakmp policy 1  encr aes 256  hash sha256  authentication pre-share  group 14 ! crypto isakmp key xxxxxx address 70.70.70.70 ! crypto ipsec transform-set TSET esp-3des esp-sha-hmac  mode tunnel ! crypto map CMAP 10 ipsec-isakmp  set peer 70.70.70.70  set transform-set TSET  match address VPN-TRAFFIC ! ! interface Ethernet0.835  encapsulation dot1Q 835  pppoe enable group global  pppoe-client dial-pool-number 1 ! interface FastEthernet0  no ip address ! interface FastEthernet1  no ip address ! interface FastEthernet2  no ip address ! interface FastEthernet3  no ip address ! interface Vlan1  ip address 10.0.145.1 255.255.255.0  ip nat inside  ip virtual-reassembly in  ip tcp adjust-mss 1452 ! interface Dialer1  description ***VDSL Connection***  ip address negotiated  no ip proxy-arp  ip nat outside  ip virtual-reassembly in  encapsulation ppp  dialer pool 1  dialer-group 1  ppp authentication pap chap callin  ppp chap hostname xxxxxx  ppp chap password 0 xxxxxx  ppp pap sent-username xxxxxxx password 0 xxxxxx  no cdp enable  crypto map CMAP ! ! ! ip nat inside source list NAT-TRAFFIC interface Dialer1 overload ip route 0.0.0.0 0.0.0.0 Dialer1 ! ip access-list extended NAT-TRAFFIC  deny   ip 10.0.145.0 0.0.0.255 10.0.100.0.0 0.0.0.255  permit ip 10.0.145.0 0.0.0.255 any  deny   ip any any ip access-list extended VPN-TRAFFIC  permit ip 10.0.145.0 0.0.0.255 10.0.100.0 0.0.0.255  deny   ip any any ! ! ! line con 0  logging synchronous  login local  no modem enable line aux 0 line vty 0 4  logging synchronous  login local  transport input ssh *********************************************************************************************************   So you are saying that with the bellow access-list 101 you wrote I will be OK? access-list 101 deny ip 0.0.0.0 0.255.255.255 any log                     <=0.0.0.0/8 Is this right?? access-list 101 deny ip 127.0.0.0 0.255.255.255 any log                 <=127.0.0.0/8 access-list 101 deny ip 172.16.0.0 0.15.255.255 any log                 <=172.16.0.0/12 access-list 101 deny ip 192.168.0.0 0.0.255.255 any log                 <=192.168.0.0/8 access-list 101 deny ip 224.0.0.0 15.255.255.255 any log               <=224.0.0.0/4 access-list 101 deny ip host 255.255.255.255 any log access-list 101 permit ip any any     What about subnet 10.0.0.0/8 ?? If I want to deny also Pings to my public IP ?? Is there anything else that I should put in the ACL 101 ?? I don't have a firewall in front of my router so it must be a little bit strict and work as a kind of a firewall.   Thank you in advance!! ... View more