non sono pratico di IOS e quindi di apparati cisco, faccio solo piccole cose...
la socetà per cui lavoro ha urgenza di installare delle video camere lan e chi segue la nostra rete non è reperibile perchè fuori italia per le ferie quindi
col vostro aiuto volevo provarci io.
Abbiamo una struttura un pò complessa perchè la gestione di diverse Vlan è affidata solo agli apparati cisco ( due router, due firewall e diversi switch)
il router cisco 1760 ( di cui posto la configurazione ) è dedicato all'accesso ad internet ed è collegato all'altro router per la gestione interna via firewall.
dalla configurazione vedete come la FastEthernet0/4 non è utilizzata
per evitare di modificare le impostazione dei firewall e router a valle pensavo di creare una VLAN solo per la gestione delle videocamere
devo assegnare alle 3 telecamere e due PC un IP che siano raggiungibili dall'esterno quindi nattare gli indirizzi assegnati alle apparecchiature
Ho un collegamento telecom netspeed plus con 512kb di bmg e 16 Ip pubblici di cui tre già utilizzati
come procedo????
creo una VLAN "telecamere " con IP 10.5.111.0 255.255.255.0
quindi dovrei nattare un indirizzo pubblico libero tra i 16 assegnati da telelcom (xxx..xxx.xxx.52 ) o per ogni telecamera assegnare un'altro IP pubblico??
quindi configurare il router :
Router-1(config)#inte fast0/4
Router-1(config)#ip address 10.5.111.1 255.255.255.0
Router-1(config)#ip nat inside
Router-1(config)#ip nat inside source static 10.5.111.1:1024 xxx..xxx.xxx..52
Router-1(config)#ip nat inside source static 10.5.111.2:1025 xxx..xxx.xxx..52
Router-1(config)#ip nat inside source static 10.5.111.3:1026 xxx..xxx.xxx..52
Router-1(config)#ip nat inside source static 10.5.111.4:1027 xxx..xxx.xxx..52
Router-1(config)#ip nat inside source static 10.5.111.5:1028 xxx..xxx.xxx..52
Router-1(config)#ip nat inside source static 10.5.111.6:80:80 xxx..xxx.xxx..52
CONFIGURAZIONE ROUTER-1
class-map match-any ARP
match protocol arp
class-map match-any Slammer-Worm
match access-group name ACL-Slammer-Worm
match packet length min 404 max 404
class-map match-any Http-Hacks-Worm
match protocol http url "*.ida*"
match protocol http url "*cmd.exe*"
match protocol http url "*root.exe*"
match protocol http url "*readme.eml*"
match protocol http url "*.rtf.exe*"
match protocol http url "*.doc.exe*"
match protocol http url "*.jpg.exe*"
match protocol http url "*.mp3.exe*"
match protocol http url "*.mp3.pif*"
match protocol http url "*.txt.exe*"
match protocol http url "*.mpg.exe*"
match protocol http url "*3D Studio Max 6 3dsmax.exe*"
match protocol http url "*ACDSee 10.exe*"
match protocol http url "*Adobe Photoshop 10 crack.exe*"
match protocol http url "*Adobe Photoshop 10 full.exe*"
match protocol http url "*Adobe Premiere 10.exe*"
match protocol http url "*Ahead Nero 8.exe*"
match protocol http url "*Best Matrix Screensaver new.scr*"
match protocol http url "*Clone DVD 6.exe*"
match protocol http url "*Cloning.doc.exe*"
match protocol http url "*Cracks & Warez Archiv.exe*"
match protocol http url "*Dark Angels new.pif*"
match protocol http url "*DivX 8.0 final.exe*"
match protocol http url "*Doom 3 release 2.exe*"
class-map match-any Dos-Attack
match access-group name ACL-RateLimitSyn
!
!
policy-map Drop-HacksWormDoS-Attack
class Http-Hacks-Worm
set ip dscp 1
class Slammer-Worm
police 1000000 31250 31250 conform-action transmit exceed-action drop violate-action drop
class Dos-Attack
police 4000000 16000 16000 conform-action transmit exceed-action drop
policy-map RateLimitARP
class ARP
police 8000 1500 1500 conform-action transmit exceed-action drop violate-action drop
!
!
!
interface FastEthernet0/0
no ip address
shutdown
speed 100
!
interface FastEthernet0/1
description verso SW-Mgt-CW-1;trasporta la VL-Mgt-RTSW-1 (VID=004)
switchport access vlan 4
no ip address
duplex full
speed 100
!
interface FastEthernet0/2
description verso FW-AC-CW-1;trasporta la VL-CW-FWAC-1 (VID=002)
switchport access vlan 2
no ip address
!
interface FastEthernet0/3
description description trunk 802.1q; VLAN Nativa VL-CW-FWAC-1 (VID=002)
switchport trunk native vlan 2
switchport mode trunk
no ip address
shutdown
duplex full
speed 100
!
interface FastEthernet0/4
no ip address
shutdown
!
interface ATM1/0
ip address xxx.xxx.xxx.xxx 255.255.255.252
ip access-group ACL-In in
ip access-group ACL-Out out
ip verify unicast reverse-path
rate-limit input access-group 101 512000 96000 192000 conform-action set-prec-transmit 5 exceed-action set-prec-transmi
t 0
rate-limit input access-group 102 128000 24000 48000 conform-action set-prec-transmit 5 exceed-action set-prec-transmit
0
rate-limit input access-group 103 128000 24000 48000 conform-action set-prec-transmit 5 exceed-action set-prec-transmit
0
rate-limit input access-group 104 320000 60000 120000 conform-action set-prec-transmit 5 exceed-action set-prec-transmi
t 0
rate-limit input access-group 105 128000 24000 48000 conform-action set-prec-transmit 5 exceed-action set-prec-transmit
0
rate-limit input access-group 106 256000 48000 96000 conform-action set-prec-transmit 5 exceed-action set-prec-transmit
0
rate-limit input access-group 107 512000 96000 192000 conform-action set-prec-transmit 5 exceed-action set-prec-transmi
t 0
no ip mroute-cache
no atm ilmi-keepalive
dsl operating-mode auto
service-policy output RateLimitARP
pvc 8/35
encapsulation aal5snap
!
!
interface Vlan1
no ip address
!
interface Vlan2
description VL-CW-FWAC-1 - Transito tra RT-AC e FW-AC
ip address xxx.xxx.xxx.xxx 255.255.255.248
ip access-group ACL-Land-Attack in
ip access-group ACL-HacksWorm out
service-policy output Drop-HacksWormDoS-Attack
!
interface Vlan4
description VL-Mgt-RTSW-1 - Gestione Router e Switches
ip address 10.2.4.4 255.255.255.240
ip access-group ACL-MGT-In in
ip access-group ACL-MGT-Out out
!
ip classless
ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx
ip route 10.1.3.0 255.255.255.240 xxx.xxx.xxx.xxx permanent
ip route 10.2.5.0 255.255.255.240 10.2.4.1 permanent
ip route 10.2.6.0 255.255.255.240 10.2.4.1 permanent
ip route 10.2.7.0 255.255.255.224 10.2.4.1 permanent
ip route 10.2.10.0 255.255.255.224 10.2.4.1 permanent
ip route 10.5.101.0 255.255.255.0 xxx.xxx.xxx.xxx permanent
ip route 10.5.102.0 255.255.255.0 xxx.xxx.xxx.xxx permanent
ip route 10.5.103.0 255.255.255.0 xxx.xxx.xxx.xxx permanent
ip route 10.5.104.0 255.255.255.0 xxx.xxx.xxx.xxx permanent
ip route 10.5.105.0 255.255.255.0 xxx.xxx.xxx.xxx permanent
ip route 10.5.106.0 255.255.255.0 xxx.xxx.xxx.xxx permanent
ip route 10.5.107.0 255.255.255.0 xxx.xxx.xxx.xxx permanent
ip route 10.5.108.0 255.255.255.0 xxx.xxx.xxx.xxx permanent
!
ip http server
ip http access-class 20
ip http timeout-policy idle 5 life 86400 requests 10000
!
ip access-list extended ACL-HacksWorm
remark
remark +----------------------------------------------------------+
remark | ACL IP Policy per Worm Code-Red, Nimda e W32/Netsk |
remark +----------------------------------------------------------+
remark
deny ip any any dscp 1
permit ip any any
ip access-list extended ACL-Land-Attack
remark
remark +----------------------------------------------------------+
remark | ACL per attacchi tipo "Land" |
remark +----------------------------------------------------------+
remark
deny ip host xxx.xxx.xxx.xxx host xxx.xxx.xxx.xxx log
permit ip any any
ip access-list extended ACL-MGT-In
remark
remark +----------------------------------------------------------+
remark | ACL sul traffico in ingresso dalla rete di management |
remark +----------------------------------------------------------+
remark
remark +----------------------------------------------------------+
remark | Controlla traffico per impedire attacchi tipo "land" |
remark +----------------------------------------------------------+
remark
deny ip host 10.2.4.4 host 10.2.4.4 log
remark
remark +----------------------------------------------------------+
remark | Controlla il traffico da rete Mgt --> router |
remark +----------------------------------------------------------+
remark
permit icmp host 10.2.4.1 host 10.2.4.4
permit icmp 10.2.7.0 0.0.0.31 host 10.2.4.4
permit icmp 10.2.6.0 0.0.0.15 host 10.2.4.4
permit icmp 10.2.5.0 0.0.0.15 host 10.2.4.4
permit ip 10.2.7.0 0.0.0.31 host 10.2.4.4
permit ip host 10.2.4.1 host 10.2.4.4
remark
remark +----------------------------------------------------------+
remark | Controlla il traffico --> router |
remark +----------------------------------------------------------+
remark
permit icmp 10.2.10.0 0.0.0.31 host 10.2.4.4
permit tcp 10.2.10.0 0.0.0.31 host 10.2.4.4
permit udp 10.2.10.0 0.0.0.31 host 10.2.4.4
remark
deny ip any any log
ip access-list extended ACL-MGT-Out
remark
remark +----------------------------------------------------------+
remark | ACL sul traffico in uscita verso la rete di management |
remark +----------------------------------------------------------+
remark
permit ip host 10.2.4.4 any
deny ip any any
ip access-list extended ACL-In
remark
remark +----------------------------------------------------------------+
remark | ACL per filtro in Ingresso |
remark +----------------------------------------------------------------+
remark
remark
remark +----------------------------------------------------------------+
remark | Filtro Anti-Spoofing |
remark | impedisce il traffico con indirizzamento privato in ingresso |
remark +----------------------------------------------------------------+
remark
deny ip 127.0.0.0 0.255.255.255 any
deny ip 127.0.0.0 0.255.255.255 any
deny ip 10.0.0.0 0.255.255.255 any
deny ip 172.0.0.0 0.240.255.255 any
deny ip 192.168.0.0 0.0.255.255 any
deny ip 224.0.0.0 31.255.255.255 any
deny ip host 0.0.0.0 any
deny icmp any any redirect
remark
remark +----------------------------------------------------------------+
remark | Filtro Traffico in Ingresso alla Rete |
remark +----------------------------------------------------------------+
remark
remark -------------------->>>> filtro completo <<<<--------------------
remark
deny tcp any any eq echo
deny tcp any any eq 11
deny tcp any any eq daytime
deny tcp any any eq 17
deny tcp any any eq chargen
deny tcp any any eq 37
deny tcp any any eq tacacs
deny tcp any any eq sunrpc
deny udp any any eq echo
deny udp any any eq 11
deny udp any any eq 13
deny udp any any eq 17
deny udp any any eq 19
deny udp any any eq time
deny udp any any eq tacacs
deny udp any any eq sunrpc
remark
remark --------------->>>> filtro completo W32 Sasser <<<<---------------
remark
deny tcp any any eq 1068
deny tcp any any eq 5564
deny tcp any any range 9992 9997
deny udp any any eq 1068
deny udp any any eq 5564
deny udp any any range 9992 9997
remark
remark ---------------->>>> filtro porte del NetBios <<<<----------------
remark
deny tcp any any eq 139
deny tcp any any eq 445
deny tcp any any range exec cmd
deny tcp any any eq 635
deny tcp any any eq 2049
deny udp any any range netbios-ns netbios-dgm
deny udp any any eq 445
deny udp any any eq 635
deny udp any any eq 2049
remark
remark ----------------->>>> filtro per Worm Zotob <<<<-----------------
remark
deny tcp any any eq 7778
deny tcp any any eq 8563
deny tcp any any eq 8594
deny tcp any any eq 8888
remark
remark -------------------->>>> filtro solo TCP <<<<--------------------
remark
deny tcp any any eq 15
deny tcp any any eq smtp
deny tcp any any eq domain
deny tcp any any eq gopher
deny tcp any any eq finger
deny tcp any any eq 87
deny tcp any any eq 95
deny tcp any any eq nntp
deny tcp any any eq 144
deny tcp any any eq lpd
deny tcp any any range uucp 541
deny tcp any any eq 2000
remark
remark ------------------>>>> filtro connessioni X <<<<-----------------
remark
deny tcp any any range 6000 6063
remark
remark -------------------->>>> filtro solo UDP <<<<--------------------
remark
deny udp any any range bootps bootpc
deny udp any any eq tftp
deny udp any any range snmp snmptrap
deny udp any any eq xdmcp
deny udp any any eq rip
remark
remark ----------------->>>> Passa tutto il resto <<<<-----------------
remark
permit ip any any
ip access-list extended ACL-Out
permit tcp xxx.xxx.xxx.xxx 0.0.0.7 any eq 33333 established
deny tcp any any eq 33333
deny tcp any any eq 6667
deny tcp any any eq 8080
permit tcp xxx.xxx.xxx.xxx 0.0.0.7 any eq 11173 established
deny tcp any any eq 11173
deny udp any any eq tftp
deny tcp any any eq 445
deny tcp any any eq 7778
deny tcp any any eq 8563
deny tcp any any eq 8594
deny tcp any any eq 8888
permit ip xxx.xxx.xxx.xxx 0.0.0.7 any
deny ip any any
ip access-list extended ACL-RateLimitSyn
remark
remark +----------------------------------------------------------+
remark | ACL IP Policy per Attacchi DDoS |
remark +----------------------------------------------------------+
remark
permit tcp any any syn
ip access-list extended ACL-Slammer-Worm
remark
remark +----------------------------------------------------------+
remark | ACL IP Policy per Worm SQL Slammer |
remark +----------------------------------------------------------+
remark
deny udp any any eq 1434
permit ip any any
!
access-list 10 remark gestisce l'accesso del server SNMP
access-list 10 permit 10.2.7.0 0.0.0.31
access-list 10 deny any
access-list 20 remark gestisce l'accesso al Web Server e dei TFTP server
access-list 20 permit 10.2.7.0 0.0.0.31
access-list 20 permit 10.2.10.0 0.0.0.31
access-list 20 deny any
access-list 101 permit tcp any any eq ftp
access-list 102 permit tcp any any eq www
access-list 103 permit tcp any any eq 22
access-list 104 permit tcp any any eq pop3
access-list 105 permit tcp any any eq 443
access-list 106 permit tcp any any eq telnet
access-list 107 deny tcp any any eq ftp
access-list 107 deny tcp any any eq www
access-list 107 deny tcp any any eq 22
access-list 107 deny tcp any any eq pop3
access-list 107 deny tcp any any eq 443
access-list 107 deny tcp any any eq telnet
access-list 107 permit ip any any
snmp-server community helperadmin RO 10
snmp-server trap-source Vlan4
snmp-server system-shutdown
snmp-server enable traps snmp linkdown linkup coldstart warmstart
snmp-server enable traps ds1
snmp-server enable traps tty
snmp-server enable traps flash insertion removal
snmp-server enable traps atm pvc
snmp-server enable traps atm subif
snmp-server enable traps cnpd
snmp-server enable traps config-copy
snmp-server enable traps config
snmp-server enable traps entity
snmp-server enable traps ipmulticast
snmp-server enable traps cpu threshold
snmp-server enable traps syslog
snmp-server host 10.2.7.29 1
snmp-server host 10.2.7.30 1
snmp-server tftp-server-list 20
no cdp run
!
control-plane
!
banner login ^C
!
line con 0
login local
line aux 0
line vty 0 4
GRAZIE A COLORO CHE MI AIUTERANNO
MI PIACEREBBE CRESCERE SOTTO QUESTO PROFILO
