version 12.4
no service pad
service timestamps debug datetime localtime
service timestamps log datetime localtime
no service password-encryption
!
hostname Router1841
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
logging buffered 4096
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login VPN_CLIENT_LOGIN local
aaa authorization network VPN_CLIENT_GROUP local
!
!
aaa session-id common
clock timezone WST 8
!
!
dot11 syslog
ip source-route
!
!
ip dhcp excluded-address 192.168.181.1 192.168.181.31
!
ip dhcp pool dhcp
network 192.168.181.0 255.255.255.0
default-router 192.168.181.1
!
ip dhcp pool STATIC-7970
host 192.168.181.11 255.255.255.0
!
!
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
username test privilege 15 password test
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
lifetime 3600
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp policy 30
encr 3des
authentication pre-share
group 2
crypto isakmp key 23y92137921371097313133fcfdsadfs address 111.111.111.111
crypto isakmp key testkey address 22.22.22.22
crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 15
!
crypto isakmp client configuration group VPN_CLIENTS
key ClientVpnKey
pool VPN_CLIENT_POOL
acl 150
max-users 10
!
!
crypto ipsec transform-set AC_STRONG esp-3des esp-sha-hmac
crypto ipsec transform-set AC_NONE esp-null esp-sha-hmac
crypto ipsec transform-set AC_WEAK esp-des esp-sha-hmac
crypto ipsec transform-set 3DES_SHA esp-3des esp-sha-hmac
crypto ipsec transform-set 3DES_MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set TRANS_3DES_SHA esp-3des esp-sha-hmac
!
crypto dynamic-map EXT_DYNAMIC_MAP 10
set transform-set TRANS_3DES_SHA
!
!
crypto map EXT_CRYPTO_MAP local-address Dialer0
crypto map EXT_CRYPTO_MAP client authentication list VPN_CLIENT_LOGIN
crypto map EXT_CRYPTO_MAP isakmp authorization list VPN_CLIENT_GROUP
crypto map EXT_CRYPTO_MAP 10 ipsec-isakmp
description Tunnel to site1 (111.111.111.111)
set peer 111.111.111.111
set transform-set AC_STRONG
match address 100
reverse-route
crypto map EXT_CRYPTO_MAP 30 ipsec-isakmp
description tunnel to site2 (22.22.22.22)
set peer 22.22.22.22
set transform-set 3DES_MD5
match address VPN-ACL
crypto map EXT_CRYPTO_MAP 50 ipsec-isakmp dynamic EXT_DYNAMIC_MAP
!
archive
log config
hidekeys
!
!
!
class-map match-any P2P
match protocol bittorrent
match protocol edonkey
match protocol gnutella
match protocol kazaa2
class-map match-all VOIP_DATA
match access-group 110
!
!
policy-map VOIP
class VOIP_DATA
priority percent 10
class P2P
drop
class class-default
police cir 9000000 pir 9000000
conform-action transmit
exceed-action drop
violate-action drop
fair-queue
queue-limit 5 packets
policy-map TORRENT
class P2P
drop
!
!
!
!
interface ATM0
no ip address
no atm ilmi-keepalive
pvc 8/35
pppoe-client dial-pool-number 2
!
hold-queue 224 in
!
interface BRI0
no ip address
encapsulation hdlc
shutdown
!
interface FastEthernet0
description Highway-1 Ethernet Service
no ip address
speed 100
full-duplex
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface FastEthernet1
description ILS-Router1841 FA 0/8 to Switch01 GI 1/0/48
switchport access vlan 80
spanning-tree portfast
!
interface Vlan1
no ip address
!
interface Vlan23
ip address 192.168.17.254 255.255.255.0
ip access-group 120 in
ip nbar protocol-discovery
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
service-policy output TORRENT
hold-queue 255 out
!
interface Vlan24
ip address 192.168.181.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
hold-queue 255 out
!
interface Vlan80
ip address 192.168.80.1 255.255.255.252
ip nat inside
ip virtual-reassembly
!
interface Dialer0
description Highway 1 PPPoE Connection
bandwidth 10240
ip ddns update hostname Router1841
ip ddns update ISP.com
ip address negotiated
ip mtu 1492
ip nat outside
ip virtual-reassembly max-reassemblies 64 timeout 5
encapsulation ppp
dialer pool 1
dialer idle-timeout 999999
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname isp.com
ppp chap password XXXXX
ppp pap sent-username XXXXX
crypto map EXT_CRYPTO_MAP
service-policy output VOIP
!
ip local pool VPN_CLIENT_POOL 192.168.99.20 192.168.99.30
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
ip route 192.168.18.0 255.255.255.0 192.168.80.2
no ip http server
no ip http secure-server
!
!
ip nat inside source static udp 127.0.0.1 46900 interface Dialer0 46900
ip nat inside source route-map No_NAT_Rule interface Dialer0 overload
!
ip access-list extended VPN-ACL
permit ip 192.168.18.0 0.0.0.255 192.168.19.0 0.0.0.255
!
no logging trap
access-list 1 permit 192.168.0.0 0.0.255.255
access-list 100 remark *** Router1841-site1 VPN ***
access-list 100 permit ip 192.168.17.0 0.0.0.255 192.168.15.0 0.0.0.255
access-list 100 remark *** Router1841-site1 VPN ***
access-list 105 remark Exclude traffic to VPN subnets
access-list 105 remark IPSec Rule - site1
access-list 105 deny ip 192.168.17.0 0.0.0.255 192.168.15.0 0.0.0.255
access-list 105 remark Everything else we NAT
access-list 105 permit ip 192.168.17.0 0.0.0.255 any
access-list 105 permit ip 192.168.181.0 0.0.0.255 any
access-list 105 permit ip 192.168.80.0 0.0.0.255 any
access-list 105 permit ip 192.168.18.0 0.0.0.255 any
access-list 120 deny udp 192.168.17.0 0.0.0.255 eq 46900 any
access-list 120 permit ip any any
access-list 150 permit ip 192.168.18.0 0.0.0.255 192.168.99.0 0.0.0.255
dialer-list 1 protocol ip permit
dialer-list 2 protocol ip permit
!
!
!
!
route-map No_NAT_Rule permit 1
match ip address 105
!
!
snmp-server community mixnuts RO 2
snmp-server ifindex persist
!
control-plane
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
line vty 0 4
access-class 2 in
exec-timeout 35791 0
privilege level 15
line vty 5 15
!
scheduler max-task-time 5000
ntp server 192.189.54.17
end
