Siamo passati in ditta da ieri sera a brennercom e ci siamo accorti che il router ethernet netgear che usavamo attaccato al gateway che da sul esterno ogni 4 minuti cade e lo si risveglia solo disabilitando e riabilitando la scheda di rete.
Avendo necessita' impellenti di avere una connessione stabile abbiamo messo al suo posto il router ethernet 851 cisco. Ma abbiamo un problema: NON funziona. Mi spiego meglio il gateway messo da brennercom ha questi parametri indirizzo ip esterno 93.89.59.113, come rete pubblica abbiamo 93.89.59.112/255.255.255.252, come dns primario 217.199.1.1 e secondario 217.199.0.250 (preferirei usare gli opendns). Il router cisco 851 sulla eth esterna dovrebbe avere 93.89.59.113 ed internamente dovrebbe non avere un dhcp (ma anche se lo ha non fa differenza, tanto usiamo ind ip statici).
Detto questo io ho preparato questa configurazione che a livello di rete prevede internamente ind ip router: 192.168.168.254 e rete 192.168.168.0/255.255.255.0, ma ovviamente non funziona (se no perchè scriverei
?):no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname Info333
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 debugging
logging console critical
!
aaa new-model
!
!
aaa authentication login local_authen local
aaa authorization exec local_author local
!
aaa session-id common
!
resource policy
!
clock timezone PCTime 1
clock summer-time PCTime date Mar 30 2003 2:00 Oct 26 2003 3:00
ip subnet-zero
no ip source-route
!
!
ip cef
ip inspect name SDM_LOW cuseeme
ip inspect name SDM_LOW dns
ip inspect name SDM_LOW ftp
ip inspect name SDM_LOW h323
ip inspect name SDM_LOW https
ip inspect name SDM_LOW icmp
ip inspect name SDM_LOW imap
ip inspect name SDM_LOW pop3
ip inspect name SDM_LOW rcmd
ip inspect name SDM_LOW realaudio
ip inspect name SDM_LOW rtsp
ip inspect name SDM_LOW esmtp
ip inspect name SDM_LOW sqlnet
ip inspect name SDM_LOW streamworks
ip inspect name SDM_LOW tftp
ip inspect name SDM_LOW tcp
ip inspect name SDM_LOW udp
ip inspect name SDM_LOW vdolive
ip tcp synwait-time 10
no ip bootp server
ip domain name yourdomain.com
ip name-server 213.140.2.43
ip name-server 62.149.128.2
ip name-server 195.210.91.100
ip name-server 213.140.2.12
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
crypto pki trustpoint TP-self-signed-3595854059
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3595854059
revocation-check none
rsakeypair TP-self-signed-3595854059
!
!
crypto pki certificate chain TP-self-signed-3595854059
certificate self-signed 01
**
quit
username ** privilege 15 password 0 **
username ** privilege 15 secret 5 **
!
!
!
!
!
interface Null0
no ip unreachables
!
interface FastEthernet0
no shutdown
!
interface FastEthernet1
no shutdown
!
interface FastEthernet2
no shutdown
!
interface FastEthernet3
no shutdown
!
interface FastEthernet4
description $FW_OUTSIDE$$ETH-WAN$
ip address 93.89.59.114 255.255.255.252
ip access-group 101 in
ip verify unicast reverse-path
ip mask-reply
ip directed-broadcast
ip inspect SDM_LOW out
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$FW_INSIDE$
ip address 192.168.168.254 255.255.255.0
ip access-group 100 in
ip mask-reply
ip directed-broadcast
ip nat inside
ip virtual-reassembly
ip route-cache flow
ip tcp adjust-mss 1452
!
ip classless
ip route 0.0.0.0 0.0.0.0 FastEthernet4
!
ip http server
ip http access-class 2
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 1 interface FastEthernet4 overload
!
logging trap debugging
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 192.168.168.0 0.0.0.255
access-list 2 remark HTTP Access-class list
access-list 2 remark SDM_ACL Category=1
access-list 2 permit 192.168.168.0 0.0.0.255
access-list 2 deny any
access-list 100 remark auto generated by SDM firewall configuration
access-list 100 remark SDM_ACL Category=1
access-list 100 deny ip 10.10.10.0 0.0.0.255 any
access-list 100 deny ip host 255.255.255.255 any
access-list 100 deny ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
access-list 101 remark auto generated by SDM firewall configuration
access-list 101 remark SDM_ACL Category=1
access-list 101 permit udp host 213.140.2.12 eq domain any
access-list 101 permit udp host 195.210.91.100 eq domain any
access-list 101 permit udp host 62.149.128.2 eq domain any
access-list 101 permit udp host 213.140.2.43 eq domain any
access-list 101 remark Auto generated by SDM for NTP (123) 193.204.114.232
access-list 101 permit udp host 193.204.114.232 eq ntp host 10.10.10.10 eq ntp
access-list 101 deny ip 192.168.0.0 0.0.0.255 any
access-list 101 permit icmp any host 10.10.10.10 echo-reply
access-list 101 permit icmp any host 10.10.10.10 time-exceeded
access-list 101 permit icmp any host 10.10.10.10 unreachable
access-list 101 deny ip 10.0.0.0 0.255.255.255 any
access-list 101 deny ip 172.16.0.0 0.15.255.255 any
access-list 101 deny ip 192.168.0.0 0.0.255.255 any
access-list 101 deny ip 127.0.0.0 0.255.255.255 any
access-list 101 deny ip host 255.255.255.255 any
access-list 101 deny ip host 0.0.0.0 any
access-list 101 deny ip any any log
access-list 102 remark VTY Access-class list
access-list 102 remark SDM_ACL Category=1
access-list 102 permit ip 192.168.168.0 0.0.0.255 any
access-list 102 deny ip any any
no cdp run
!
control-plane
!
banner login ^C
-----------------------------------------------------------------------
-----------------------------------------------------------------------
^C
!
banner login ^CCAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
login local
no modem enable
line aux 0
line vty 0 4
privilege level 15
login local
transport input telnet ssh
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
ntp clock-period 17177861
ntp server 193.204.114.232 prefer
sntp server 207.46.197.32
sntp server 192.43.244.18
end
Cosa c'è di sbagliato? Cioè a livello di rete interna ok, vedo e pingo quando devo uscire pero' non mi fa uscire... Idee?
Massimiliano
