CiscoForums.it

Inviato: **dom 27 gen , 2008 2:26 pm**

Ciao a tutti,
non riessco a entrare nel mio server http,
e neanche in quella ftp nonostante, abbia nattato il ruter vi porga la mia conf

version 12.4
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname Bozzolo
!
boot-start-marker
boot-end-marker
!
no logging buffered
enable secret 5 xxxxxx
enable password 7xxxxxx
!
no aaa new-model
no ip cef
!
!
!
!
!
!
!
!
!
!
!
interface ATM0
no ip address
no ip mroute-cache
no atm ilmi-keepalive
bundle-enable
dsl operating-mode auto
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
!
interface FastEthernet0
ip address 10.0.0.1 255.255.255.0
ip nat inside
speed auto
!
interface Dialer0
ip address negotiated
ip nat outside
encapsulation ppp
dialer pool 1
ppp chap hostname xxxxxxx
ppp chap password 7 xxxxx
ppp pap sent-username xxxxxxx
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
ip dns server
ip dns spoofing
!
ip http server
no ip http secure-server
ip nat inside source list 120 interface Dialer0 overload
ip nat inside source static tcp 10.0.0.3 8080 interface Dialer0 8080
ip nat inside source static tcp 10.0.0.3 80 interface Dialer0 80
ip nat inside source static tcp 10.0.0.3 21 interface Dialer0 21
ip nat inside source static tcp 10.0.0.1 23 interface Dialer0 23
ip nat inside source static tcp 10.0.0.3 5900 interface Dialer0 5900
ip nat inside source static tcp 10.0.0.3 3600 interface Dialer0 3600
ip nat inside source static tcp 10.0.0.3 5800 interface Dialer0 5800
!
no logging trap
access-list 1 permit any
access-list 120 permit tcp any any
access-list 120 permit udp any any
!
control-plane
!
!
line con 0
exec-timeout 120 0
line aux 0
password 7 xxxxxxx
login
line vty 0 4
exec-timeout 0 0
password 7 xxxxxx
login
!
end

Inviato: **lun 28 gen , 2008 10:31 am**

Le regole di nat vanno bene.
Rifai la acl del pat così:

Codice: Seleziona tutto

no access-l 120
access-l 120 permit ip 10.0.0.0 0.0.0.255 any

Configura ip inspect

Codice: Seleziona tutto

ip inspect name FW-OUT tcp
ip inspect name FW-OUT udp

ip inspect name FW-IN http
ip inspect name FW-IN telnet
ip inspect name FW-IN ftp

int FastEthernet0
ip inspect FW-OUT in

int dialer0
ip inspect FW-IN in

Crea delle acl in ingresso

Codice: Seleziona tutto

access-l 131 permit tcp any any eq 8080
access-l 131 permit tcp any any eq 80
access-l 131 permit tcp any any eq 21
access-l 131 permit tcp any any eq 23
access-l 131 permit tcp any any eq 5900
access-l 131 permit tcp any any eq 3600
access-l 131 permit tcp any any eq 5800
access-l 131 deny ip any any log

int dialer0
ip access-gr 131 in

A sto punto prova le connessioni da fuori e controlla con "sh access-l 131" se matchano le acl

Inviato: **lun 28 gen , 2008 11:48 pm**

scusa, non ho scritto che ho il 1721

Inviato: **mar 29 gen , 2008 11:16 am**

Per fortuna la ios è ios e normalmente non cambia tra i router (a parità di release).

CiscoForums.it

non riesco a entrare nel mio server http

non riesco a entrare nel mio server http

1721