VPN problem with DNS Server at central site

Julio_Coutinho13 · ‎07-10-2012

Hi,

I have this new trouble, Inside the central site I access at the DNS Server and It resolve the names, but when I connect with VPN, I almost see the DNS Server but it cant resolve names, what am I doing wrong ?

Jennifer Halim · ‎07-11-2012

Have you got your internal DNS server configured under the vpn policy? Are you trying to resolve hostname or FQDN?

Julio_Coutinho13 · ‎07-11-2012

Hi Jennifer, thanks for giving me Response, My DNS Server can resolve names of applications, so as an example if I ping from de Inside to some of my applications, the ping is done, but If Im in the outside using a VPN, I ping to those applications and the Ping Fails, I almost have to say that if I ping the DNS Server as Its IP address, the ping almost is DONE from the inside and form the Outside, Thanks

Jennifer Halim · ‎07-11-2012

Ping fails, but does it resolve the name? or ping fails but it resolves the name OK?

Julio_Coutinho13 · ‎07-11-2012

ping to the application fails and it does not resolve the name from outside, from inside everything is ok

Julio_Coutinho13 · ‎07-11-2012

ping to the DNS Server its ok but dont resolve names

Jennifer Halim · ‎07-11-2012

do you have your dns server configured under the vpn policy? and also do you have default domain configured so it appends the hostname to FQDN.

Do you mind sharing your config.

Julio_Coutinho13 · ‎07-11-2012

HI, my dns server is 10.10.11.254, and you you have the config:

version 15.0

service timestamps debug datetime msec

service timestamps log datetime msec

service password-encryption

!

hostname XXXXXX

!

boot-start-marker

boot-end-marker

!

logging buffered 51200 warnings

enable secret 5 $1$k19c$8slcyILLUgQ5Pk9tFDaVE.

!

aaa new-model

!

aaa authentication login default local

aaa authentication login ciscocp_vpn_xauth_ml_1 local

aaa authentication login ciscocp_vpn_xauth_ml_2 local

aaa authorization exec default local

aaa authorization network ciscocp_vpn_group_ml_1 local

aaa authorization network ciscocp_vpn_group_ml_2 local

!

aaa session-id common

!

clock timezone mexico -6

!

no ipv6 cef

ip source-route

ip cef

!

ip dhcp excluded-address 10.10.11.1 10.10.11.99

ip dhcp excluded-address 10.10.11.199 10.10.11.254

ip dhcp excluded-address 192.168.1.1 192.168.1.99

ip dhcp excluded-address 192.168.1.199 192.168.1.254

ip dhcp excluded-address 10.10.21.1 10.10.21.99

ip dhcp excluded-address 10.10.21.199 10.10.21.254

ip dhcp excluded-address 10.10.11.190 10.10.11.199

!

ip dhcp pool LAN

network 10.10.11.0 255.255.255.0

default-router 10.10.11.1

dns-server 10.10.11.254

lease 8

!

ip dhcp pool Guest

network 10.10.21.0 255.255.255.0

default-router 10.10.21.1

dns-server 200.23.242.193 148.233.151.8

!

ip dhcp pool IT

host 10.10.11.80 255.255.255.0

client-identifier 015c.ac4c.b64b.0d

client-name IT

!

ip dhcp pool ex3

host 10.10.11.83 255.255.255.0

client-identifier 0134.51c9.6306.f6

!

ip dhcp pool ex4

host 10.10.11.84 255.255.255.0

client-identifier 01c8.bcc8.25d9.13

!

ip dhcp pool ex5

host 10.10.11.85 255.255.255.0

client-identifier 01d8.a25e.6844.a1

!

ip dhcp pool ex6

host 10.10.11.86 255.255.255.0

client-identifier 01e8.3eb6.ff47.19

!

ip dhcp pool Test

host 10.10.11.20 255.255.255.0

client-identifier 0100.0c29.6c05.85

!

ip dhcp pool JL

host 10.10.11.82 255.255.255.0

client-identifier 0100.270e.2ed9.34

client-name JL

!

ip dhcp pool ex10

host 10.10.11.87 255.255.255.0

client-identifier 01e0.2a82.aa58.a9

!

ip dhcp pool Mkt

host 10.10.11.81 255.255.255.0

client-identifier 01c4.4619.53fb.25

!

ip dhcp pool Prueba

host 10.10.11.50 255.255.255.0

client-identifier 0100.2682.b2de.f9

!

ip dhcp pool MBAL

host 10.10.11.88 255.255.255.0

client-identifier 0100.1d4f.fa2c.fd

!

ip dhcp pool IML

host 10.10.11.89 255.255.255.0

client-identifier 01b8.8d12.0064.b6

!

ip dhcp pool Hernan

host 10.10.11.78 255.255.255.0

client-identifier 01f0.4da2.7f83.fe

!

ip dhcp pool Edgar

host 10.10.11.75 255.255.255.0

client-identifier 011c.c1de.fbb6.51

!

ip dhcp pool Graciela

host 10.10.11.72 255.255.255.0

client-identifier 0100.2312.027b.ee

!

ip dhcp pool Griselda

host 10.10.11.79 255.255.255.0

client-identifier 01f0.b479.1500.b3

!

ip dhcp pool Tanis

host 10.10.11.69 255.255.255.0

client-identifier 0178.ca39.b30f.72

!

ip domain name XXXXXXXX

ip host trps.trendmicro.com 150.70.74.51 216.104.8.100

ip name-server 10.10.11.254

ip name-server 200.23.242.193

ip name-server 148.233.151.8

ip port-map smtp port tcp 25 list 1 description exch

ip inspect tcp reassembly queue length 32

ip inspect tcp reassembly timeout 30

ip inspect tcp reassembly memory limit 2048

ip urlfilter max-resp-pak 2000

!

multilink bundle-name authenticated

!

parameter-map type urlfpolicy local local-parameters

allow-mode on

block-page message "Pagina bloqueada por contenido inadecuado"

parameter-map type urlfpolicy trend dynamic-parameters

allow-mode on

block-page message "The website you have accessed is blocked as per corporate policy"

parameter-map type urlf-glob url-blacklist

pattern *.meebo.com

pattern *.mediafire.com

pattern *.filesonic.com

pattern *.rapidshare.com

pattern *.depositfiles.com

pattern *.wupload.com

pattern *.wupload.mx

pattern *.babosas.com

pattern *.megavideo.com

pattern megavideo.com

pattern megaupload.com

pattern *.megaupload.com

pattern filesonic.com

pattern filesonic.mx

pattern rapidshare.com

pattern depositfiles.com

parameter-map type urlf-glob keyword-blacklist

pattern hack

pattern porn

pattern xxx

pattern facebook.com

parameter-map type urlf-glob url-whitelist

pattern www.cisco.com

pattern www.travelocity.com

pattern www.travelocity.com.mx

pattern www.despegar.com.mx

pattern www.google.com

pattern www.speedtest.net

pattern www.idconline.com.mx

pattern www.banorte.com

pattern www.banorte.com.mx

pattern www.banxico.org.mx

pattern www.bancoazteca.com.mx

pattern www.bancoinbursa.com

pattern www.hsbc.com.mx

pattern www.santander.com.mx

pattern www.banamex.com

pattern www.live.com

pattern www.hotmail.com

pattern www.gmail.com

pattern www.prodigy.msn.com

pattern www.login.live.com

pattern www.go.travelpn.com

pattern www.repuve.gob.mx

pattern www.guitarcenter.com

pattern www.store.guitarcenter.com

pattern www.officedepot.com.mx

pattern store.officedepot.com.mx

pattern www.occ.com.mx

pattern www.aeromexico.com

pattern recluta10.occ.com.mx

pattern www.ticketmaster.com.mx

pattern ticketmaster.com.mx

pattern media.ticketmaster.com

pattern www.grupoemporium.mx

pattern portal.infonavit.org.mx

parameter-map type protocol-info yahoo-servers

server name scs.msg.yahoo.com

server name scsa.msg.yahoo.com

server name scsb.msg.yahoo.com

server name scsc.msg.yahoo.com

server name scsd.msg.yahoo.com

server name cs16.msg.dcn.yahoo.com

server name cs19.msg.dcn.yahoo.com

server name cs42.msg.dcn.yahoo.com

server name cs53.msg.dcn.yahoo.com

server name cs54.msg.dcn.yahoo.com

server name ads1.vip.scd.yahoo.com

server name radio1.launch.vip.dal.yahoo.com

server name in1.msg.vip.re2.yahoo.com

server name data1.my.vip.sc5.yahoo.com

server name address1.pim.vip.mud.yahoo.com

server name edit.messenger.yahoo.com

server name messenger.yahoo.com

server name http.pager.yahoo.com

server name privacy.yahoo.com

server name csa.yahoo.com

server name csb.yahoo.com

server name csc.yahoo.com

parameter-map type protocol-info aol-servers

server name login.oscar.aol.com

server name toc.oscar.aol.com

server name oam-d09a.blue.aol.com

parameter-map type protocol-info msn-servers

server name messenger.hotmail.com

server name gateway.messenger.hotmail.com

server name webmessenger.msn.com

parameter-map type ooo global

parameter-map type trend-global global-param-map

server trps.trendmicro.com retrans 5 timeout 120

cache-size maximum-memory 7000

!

crypto pki trustpoint Equifax_Secure_CA

revocation-check none

!

crypto pki trustpoint NetworkSolutions_CA

revocation-check none

!

crypto pki trustpoint trps1_server

revocation-check none

!

crypto pki trustpoint TP-self-signed-1692929506

enrollment selfsigned

subject-name cn=IOS-Self-Signed-Certificate-1692929506

revocation-check none

rsakeypair TP-self-signed-1692929506

!

crypto pki certificate chain Equifax_Secure_CA

certificate ca 35DEF4CF

30820320 30820289 A0030201 02020435 DEF4CF30 0D06092A 864886F7 0D010105

0500304E 310B3009 06035504 06130255 53311030 0E060355 040A1307 45717569

66617831 2D302B06 0355040B 13244571 75696661 78205365 63757265 20436572

74696669 63617465 20417574 686F7269 7479301E 170D3938 30383232 31363431

35315A17 0D313830 38323231 36343135 315A304E 310B3009 06035504 06130255

53311030 0E060355 040A1307 45717569 66617831 2D302B06 0355040B 13244571

75696661 78205365 63757265 20436572 74696669 63617465 20417574 686F7269

74793081 9F300D06 092A8648 86F70D01 01010500 03818D00 30818902 818100C1

5DB15867 0862EEA0 9A2D1F08 6D911468 980A1EFE DA046F13 846221C3 D17CCE9F

05E0B801 F04E34EC E28A9504 64ACF16B 535F05B3 CB6780BF 42028EFE DD0109EC

E100144F FCFBF00C DD43BA5B 2BE11F80 70991557 9316F10F 976AB7C2 68231CCC

4D5930AC 511E3BAF 2BD6EE63 457BC5D9 5F50D2E3 500F3A88 E7BF14FD E0C7B902

03010001 A3820109 30820105 30700603 551D1F04 69306730 65A063A0 61A45F30

5D310B30 09060355 04061302 55533110 300E0603 55040A13 07457175 69666178

312D302B 06035504 0B132445 71756966 61782053 65637572 65204365 72746966

69636174 65204175 74686F72 69747931 0D300B06 03550403 13044352 4C31301A

0603551D 10041330 11810F32 30313830 38323231 36343135 315A300B 0603551D

0F040403 02010630 1F060355 1D230418 30168014 48E668F9 2BD2B295 D747D823

20104F33 98909FD4 301D0603 551D0E04 16041448 E668F92B D2B295D7 47D82320

104F3398 909FD430 0C060355 1D130405 30030101 FF301A06 092A8648 86F67D07

4100040D 300B1B05 56332E30 63030206 C0300D06 092A8648 86F70D01 01050500

03818100 58CE29EA FCF7DEB5 CE02B917 B585D1B9 E3E095CC 25310D00 A6926E7F

B692639E 5095D19A 6FE411DE 63856E98 EEA8FF5A C8D355B2 667157DE C021EB3D

2AA72349 01048642 7BFCEE7F A21652B5 6767D340 DB3B2658 B228773D AE147761

D6FA2A66 27A00DFA A7735CEA 70F19421 65445FFA FCEF2968 A9A28779 EF79EF4F AC077738

quit

crypto pki certificate chain NetworkSolutions_CA

certificate ca 10E776E8A65A6E377E050306D43C25EA

308204A6 3082038E A0030201 02021010 E776E8A6 5A6E377E 050306D4 3C25EA30

0D06092A 864886F7 0D010105 05003081 97310B30 09060355 04061302 5553310B

30090603 55040813 02555431 17301506 03550407 130E5361 6C74204C 616B6520

43697479 311E301C 06035504 0A131554 68652055 53455254 52555354 204E6574

776F726B 3121301F 06035504 0B131868 7474703A 2F2F7777 772E7573 65727472

7573742E 636F6D31 1F301D06 03550403 13165554 4E2D5553 45524669 7273742D

48617264 77617265 301E170D 30363034 31303030 30303030 5A170D32 30303533

30313034 3833385A 3062310B 30090603 55040613 02555331 21301F06 0355040A

13184E65 74776F72 6B20536F 6C757469 6F6E7320 4C2E4C2E 432E3130 302E0603

55040313 274E6574 776F726B 20536F6C 7574696F 6E732043 65727469 66696361

74652041 7574686F 72697479 30820122 300D0609 2A864886 F70D0101 01050003

82010F00 3082010A 02820101 00C3DD36 CC83C318 55B096D9 1325D326 864838BB

167FF19F 29F6FD03 F1ED4D26 9A56F0B5 1A1ACDE6 CC855540 A4B5D00D CA22EF3D

23C67E6C CCBCA1E9 7C5046E0 BD14AD65 12C20B11 69520A07 921F736F C1BAD762

F0CE002E 34A5C8E6 2F0FEC0D EA446175 68E5E4DC 80364FDA 785D5325 9494F54F

2E3A606F 0CA6D9B3 F62A2E03 12D52642 0751B264 5771DC21 1C89C769 A3E6FBC2

7B6EEF0C 87FB5064 E84E4BEF E7719B83 6361C932 8D8CEC14 A7E489AD 3F2B2664

E48542F2 8950E13A BE15E345 25E25ACB 8C3FE033 1E35095A 84EA7E5D A1F59180

0A2806B7 CB314125 618B01E9 56A2F63E 5F2FF3C4 43F61994 75834CA1 82423AC6

BAC40930 A6E17502 51B95E64 8B020301 0001A382 01203082 011C301F 0603551D

23041830 168014A1 725F261B 28984395 5D0737D5 85969D4B D2C34530 1D060355

1D0E0416 04143C41 E28F0808 A94C2589 8D6DC538 D0FC858C 6217300E 0603551D

0F0101FF 04040302 01063012 0603551D 130101FF 04083006 0101FF02 01003019

0603551D 20041230 10300E06 0C2B0601 0401860E 01020103 01304406 03551D1F

043D303B 3039A037 A0358633 68747470 3A2F2F63 726C2E75 73657274 72757374

2E636F6D 2F55544E 2D555345 52466972 73742D48 61726477 6172652E 63726C30

5506082B 06010505 07010104 49304730 4506082B 06010505 07300286 39687474

703A2F2F 7777772E 75736572 74727573 742E636F 6D2F6361 63657274 732F5554

4E416464 54727573 74536572 7665725F 43412E63 7274300D 06092A86 4886F70D

01010505 00038201 010068AB FCEF806B 18B2B0B3 A34589CB 53C5A2E6 AF08A9FD

FF0F49AC FFE49FD7 417CA3C5 A2E8AAE0 57212DC3 AA7C0C4C 280B79F4 EE4C32AD

790E7EA2 5E34184F DF54F1BD 687CE3D3 D7465E6D 64C2F76D 8882730C EF9985EA

A9EF324A F0839F73 910CA43E 2B3151A6 628F1584 F9A63A12 303FDA6E F8CCC719

920F5CF4 FE17F195 0847522C 508FE89B A5EEAE70 33899182 FE30AA76 7659D76C

18D32B12 5B1D281D 7871F6CD 36A2E907 48443BE7 576E820A ADC58ADD E853B471

AF13D206 9D376D53 3F8A3508 FAFEA216 E6B96F5C 5639D6C6 AAEF1967 CE13C5B8

9505FB0A 44C99FA9 40254B32 11AF07FE 08D54271 E9E1538B 151FDD2A 07957024

6F645ED3 B7902E8B 21D8

quit

crypto pki certificate chain trps1_server

certificate ca 00

3082029F 30820208 02010030 0D06092A 864886F7 0D010104 05003081 97310B30

09060355 04061302 55533111 300F0603 55040813 08436F6C 6F726164 6F311030

0E060355 04071307 426F756C 64657231 16301406 0355040A 130D4369 73636F20

53797374 656D7331 0C300A06 0355040B 13035354 47311D30 1B060355 04031314

74727073 312D626C 64722E63 6973636F 2E636F6D 311E301C 06092A86 4886F70D

01090116 0F777473 75694063 6973636F 2E636F6D 301E170D 30363130 32333230

32363231 5A170D30 39303731 39323032 3632315A 30819731 0B300906 03550406

13025553 3111300F 06035504 08130843 6F6C6F72 61646F31 10300E06 03550407

1307426F 756C6465 72311630 14060355 040A130D 43697363 6F205379 7374656D

73310C30 0A060355 040B1303 53544731 1D301B06 03550403 13147472 7073312D

626C6472 2E636973 636F2E63 6F6D311E 301C0609 2A864886 F70D0109 01160F77

74737569 40636973 636F2E63 6F6D3081 9F300D06 092A8648 86F70D01 01010500

03818D00 30818902 818100BF F80B7E13 19C5AA37 D7433EDC 4EC5CAD8 40BEE950

7C099395 997043C9 B9C4BCF6 DF97F091 0ECB7D06 F1B336C6 CD134A67 826B0182

09535A4B 11EB4BE8 B46187CB BBD9FECB CB03AE65 8F2C5E7E 40A66FF2 899E2FF1

CBC072B2 A9B537C0 84C9F873 8A141ED9 D8D15186 F7047400 BB8A2CA1 C59DEAD8

DA09FBB3 6E67D8BF F6811102 03010001 300D0609 2A864886 F70D0101 04050003

818100AC C6185869 1324F6BD 728A8D00 CEDF15E3 14671016 90ED8F7B 5FF72860

8F9469D2 B344641D 75E4A566 BCB06ACE 21DFC2B3 041A961C 8A23610A 284BC399

8E632BBA C734D76A 266E6A45 88DC366F C5E12E9E 087AC3AA 7FEE2089 C97821A7

882BFEC3 26425299 11700277 B9E4EBCD 15A0B388 F8D4A102 E472A398 63E0D7DA 5BFBE1

quit

crypto pki certificate chain TP-self-signed-1692929506

certificate self-signed 01

3082025A 308201C3 A0030201 02020101 300D0609 2A864886 F70D0101 04050030

31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274

69666963 6174652D 31363932 39323935 3036301E 170D3131 30383132 30343138

30355A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649

4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 36393239

32393530 3630819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281

8100C244 5E9C2EA4 5D82D1A2 DF21A622 CE00615D C870747C E62E523C 3B5BC51B

A1068F7A 89F41FEB 7AC69FE2 EF7B8B83 D4DC0CFF 1EB49258 0AFC0B3B EE42D006

4891CFC9 2AAD262C BD432982 D6CA2035 73837FF0 13F9B8D3 21D4E7E6 A47EB596

68AD71F2 2E56289D A2600DFD 89BA872D 2AA47F93 8A4FEEE3 D91BC85A D8E1A573

E3FF0203 010001A3 8181307F 300F0603 551D1301 01FF0405 30030101 FF302C06

03551D11 04253023 8221456D 706F7269 756D5F52 6F752E67 7275706F 656D706F

7269756D 2E636F6D 2E6D7830 1F060355 1D230418 30168014 7E6B5AEE 3149D3FA

356CF0C0 0CF8271E CD1128AE 301D0603 551D0E04 1604147E 6B5AEE31 49D3FA35

6CF0C00C F8271ECD 1128AE30 0D06092A 864886F7 0D010104 05000381 81004C81

8192823A CD8BC83C B8E018FF 2B576CA9 241C0933 B9D2A5D1 A1BA00BB FCA15359

F7EDDE01 8E44EAAB C6D93180 87EB8F1F FB55C417 9A6DDEB0 8A9B9BEB C3FCF0F2

5F1CC4CD 02D06253 E1E6B12F FADE769C 0A9B2D41 D2E637C8 77D2FA15 40585316

9347AA2D 7FBDFFE9 A4B1E2B9 9260D870 27172192 127663D3 2ACFCE5E 9D84

quit

license udi pid CISCO2921/K9 sn FTX1510AK0V

!

username sidiags privilege 15 secret 5 $1$11/.$I7Kq7MT1EP2OeWPAXlovP0

username hguerrero privilege 3 secret 5 $1$..Y3$9JgdY9XhsnK4dD7N5W3SA/

username alozano privilege 3 secret 5 $1$/MEf$LfZ6mjng3xY0fDNFBCvZV1

!

redundancy

crypto ctcp

!

ip ssh version 2

!

class-map type inspect match-all filtering-exempt-hosts

match protocol http

match access-group 124

class-map type inspect imap match-any ccp-app-imap

match invalid-command

class-map type inspect match-all sdm-nat-user-protocol--3-1

match access-group 101

class-map type inspect match-any ccp-cls-protocol-p2p

match protocol edonkey signature

match protocol gnutella signature

match protocol kazaa2 signature

match protocol fasttrack signature

match protocol bittorrent signature

class-map type inspect match-all SDM_GRE

match access-group name SDM_GRE

class-map type inspect match-any CCP_PPTP

match class-map SDM_GRE

class-map type inspect match-any SDM_AH

match access-group name SDM_AH

class-map type inspect match-any ccp-skinny-inspect

match protocol skinny

class-map type inspect match-any dmz

match protocol http

match protocol https

match protocol imap

match protocol smtp

match protocol pop3

class-map type inspect match-all ccp-cls--1

match class-map dmz

match access-group name Out-to-dmz

class-map type urlfilter trend match-any trend-block-categories

match url category Pornography

match url category Nudity

match url category Peer-to-Peer

match url category Software-downloads

match url category Abortion

match url category Spam

match url category Streaming-media-MP3

match url category Ringtones-Moblie-phone-Downloads

match url category Military

match url category Job-Search-Career

match url category Gay-Lesbian

match url category Games

match url category Chat-Instant-Messaging

match url category Adult-Mature-Content

match url category Cult-Occult

match url category Illegal-Questionable

match url category Illegal-Drugs

match url category Personals-Dating

match url category Social-Networking

match url category Entertainmemt

match url category Marijuana

match url category Pay-to-surf

match url category Weapons

match url category Violence-hate-racism

match url category Sports

match url category Internet-Radio-and-TV

match url category Intimate-apparel-swimsuit

match url category Alcohol-Tobacco

class-map type urlfilter trend match-any trend-block-reputation

match url reputation ADWARE

match url reputation PHISHING

match url reputation SPYWARE

match url reputation DIALER

match url reputation DISEASE-VECTOR

match url reputation HACKING

match url reputation VIRUS-ACCOMPLICE

class-map type inspect match-all SDM_IP

match access-group name SDM_IP

class-map type inspect match-any SDM_ESP

match access-group name SDM_ESP

class-map type inspect match-any SDM_EASY_VPN_SERVER_TRAFFIC

match protocol isakmp

match protocol ipsec-msft

match class-map SDM_AH

match class-map SDM_ESP

class-map type inspect match-all SDM_EASY_VPN_SERVER_PT

match class-map SDM_EASY_VPN_SERVER_TRAFFIC

class-map type inspect msnmsgr match-any ccp-app-msn-otherservices

match service any

class-map type inspect ymsgr match-any ccp-app-yahoo-otherservices

match service any

class-map type inspect match-any -sdminspectclassmap-6

match protocol http

class-map type inspect match-any -sdminspectclassmap-4

match protocol http

class-map type inspect match-any -sdminspectclassmap-5

match protocol http

class-map type inspect match-any -sdminspectclassmap-2

match protocol http

class-map type inspect match-any ccp-h323nxg-inspect

match protocol h323-nxg

class-map type inspect match-any -sdminspectclassmap-3

match protocol http

class-map type inspect match-any -sdminspectclassmap-1

match protocol http

class-map type inspect match-any sdm-service-ccp-inspect-1

match protocol imap

match protocol smtp

class-map type inspect match-any ccp-cls-icmp-access

match protocol tcp

match protocol udp

match protocol smtp

class-map type inspect match-any p2p

match protocol bittorrent

match protocol directconnect

match protocol fasttrack

match protocol edonkey

match protocol gnutella

match protocol kazaa2

match protocol winmx

class-map type inspect match-any ccp-cls-protocol-im

match protocol ymsgr yahoo-servers

match protocol msnmsgr msn-servers

match protocol aol aol-servers

class-map type inspect aol match-any ccp-app-aol-otherservices

match service any

class-map type urlfilter match-any permitted-sites

match server-domain urlf-glob url-whitelist

class-map type inspect match-all ccp-cls-ccp-inspect-2

match access-group name LAN_to_out

class-map type inspect match-all ccp-cls-ccp-inspect-3

match access-group name phone

class-map type inspect match-all ccp-protocol-pop3

match protocol pop3

class-map type inspect match-any ccp-h225ras-inspect

match protocol h225ras

class-map type inspect match-all ccp-cls-ccp-inspect-1

match class-map p2p

match access-group name p2pdeny

class-map type urlfilter match-any blocked-sites

match server-domain urlf-glob url-blacklist

match server-domain urlf-glob keyword-blacklist

class-map type inspect match-any ccp-h323annexe-inspect

match protocol h323-annexe

class-map type inspect pop3 match-any ccp-app-pop3

match invalid-command

class-map type inspect match-any ccp-h323-inspect

match protocol h323

class-map type inspect match-all filtered-hosts

match protocol http

match access-group 123

class-map type inspect msnmsgr match-any ccp-app-msn

match service text-chat

class-map type inspect ymsgr match-any ccp-app-yahoo

match service text-chat

class-map type inspect match-any pub

match protocol http

match protocol https

match protocol imap

match protocol icmp

match protocol pop3

match protocol pop3s

match protocol smtp

class-map type inspect match-any pub-1

match protocol http

match protocol https

match protocol imap

match protocol pop3

match protocol pop3s

match protocol smtp

class-map type inspect match-all ccp-cls-ccp-pol-outToIn-1

match class-map pub

match access-group name Published

match class-map pub-1

class-map type inspect match-all ccp-protocol-im

match class-map ccp-cls-protocol-im

class-map type inspect match-all ccp-icmp-access

match class-map ccp-cls-icmp-access

class-map type inspect match-all ccp-invalid-src

match access-group 100

class-map type inspect http match-any ccp-app-httpmethods

match request method bcopy

match request method bdelete

match request method bmove

match request method bpropfind

match request method bproppatch

match request method connect

match request method copy

match request method delete

match request method edit

match request method getattribute

match request method getattributenames

match request method getproperties

match request method index

match request method lock

match request method mkcol

match request method mkdir

match request method move

match request method notify

match request method options

match request method poll

match request method propfind

match request method proppatch

match request method put

match request method revadd

match request method revlabel

match request method revlog

match request method revnum

match request method save

match request method search

match request method setattribute

match request method startrev

match request method stoprev

match request method subscribe

match request method trace

match request method unedit

match request method unlock

match request method unsubscribe

class-map type inspect edonkey match-any ccp-app-edonkey

match file-transfer

match text-chat

match search-file-name

class-map type inspect match-any ccp-sip-inspect

match protocol sip

class-map type inspect http match-any ccp-http-blockparam

match request port-misuse im

match request port-misuse p2p

match req-resp protocol-violation

class-map type inspect match-all ccp-protocol-imap

match class-map sdm-service-ccp-inspect-1

class-map type inspect aol match-any ccp-app-aol

match service text-chat

class-map type inspect match-any pub-2

match protocol http

match protocol https

match protocol imap

match protocol pop3

match protocol pop3s

match protocol smtp

match protocol telnet

match protocol icmp

class-map type inspect http match-any ccp-http-allowparam

match request port-misuse tunneling

class-map type inspect match-all ccp-protocol-http

match protocol http

!

policy-map type inspect ccp-permit-icmpreply

class type inspect ccp-icmp-access

pass

class class-default

pass log

policy-map type inspect im ccp-action-app-im

class type inspect aol ccp-app-aol

log

allow

class type inspect msnmsgr ccp-app-msn

log

allow

class type inspect ymsgr ccp-app-yahoo

log

allow

class type inspect aol ccp-app-aol-otherservices

log

reset

class type inspect msnmsgr ccp-app-msn-otherservices

log

reset

class type inspect ymsgr ccp-app-yahoo-otherservices

log

reset

policy-map type inspect urlfilter urlfilter-actions

parameter type urlfpolicy trend dynamic-parameters

class type urlfilter permitted-sites

allow

class type urlfilter blocked-sites

reset

log

class type urlfilter trend trend-block-categories

reset

log

class type urlfilter trend trend-block-reputation

reset

log

policy-map type inspect ccp-inspect

class type inspect filtering-exempt-hosts

inspect

class type inspect filtered-hosts

inspect

service-policy urlfilter urlfilter-actions

class type inspect ccp-protocol-imap

pass

class type inspect ccp-protocol-pop3

pass

class type inspect ccp-skinny-inspect

pass

class type inspect ccp-protocol-im

pass

class type inspect ccp-sip-inspect

pass

class type inspect ccp-h323-inspect

pass

class type inspect ccp-h323annexe-inspect

pass

class type inspect ccp-h225ras-inspect

pass

class type inspect ccp-h323nxg-inspect

pass

class type inspect ccp-cls-ccp-inspect-1

drop log

class type inspect ccp-cls-ccp-inspect-3

pass

class type inspect ccp-cls-ccp-inspect-2

pass

class class-default

drop log

policy-map type inspect pop3 ccp-action-pop3

class type inspect pop3 ccp-app-pop3

log

policy-map type inspect http ccp-action-app-http

class type inspect http ccp-http-blockparam

log

reset

class type inspect http ccp-app-httpmethods

log

allow

class type inspect http ccp-http-allowparam

log

allow

policy-map type inspect ccp-permit

class type inspect SDM_EASY_VPN_SERVER_PT

pass

class type inspect -sdminspectclassmap-4

pass

class class-default

pass

policy-map type inspect ccp-policy-ccp-cls--1

class type inspect -sdminspectclassmap-3

pass

class type inspect ccp-cls--1

pass

class class-default

pass log

policy-map type inspect ccp-pol-outToIn

class type inspect -sdminspectclassmap-2

pass

class type inspect ccp-cls-ccp-pol-outToIn-1

pass

class type inspect CCP_PPTP

pass

class class-default

pass

policy-map type inspect sdm-permit-ip

class type inspect -sdminspectclassmap-1

pass log

class type inspect SDM_IP

pass

class class-default

drop log

policy-map type inspect imap ccp-action-imap

class type inspect imap ccp-app-imap

log

!

zone security in-zone

zone security out-zone

zone security ezvpn-zone

zone security dmz

zone-pair security ccp-zp-out-self source out-zone destination self

service-policy type inspect ccp-permit

zone-pair security ccp-zp-in-out source in-zone destination out-zone

service-policy type inspect ccp-inspect

zone-pair security ccp-zp-out-zone-To-in-zone source out-zone destination in-zone

service-policy type inspect ccp-pol-outToIn

zone-pair security ccp-zp-self-out source self destination out-zone

service-policy type inspect ccp-permit-icmpreply

zone-pair security sdm-zp-in-ezvpn1 source in-zone destination ezvpn-zone