a seguito del mio precedente thread,
ho messo in piedi una configurazione funzionante (e' in produzione da 2 mesi senza problemi) per il sistema in oggetto
Penso di far cosa gradita a molti di questo forum condividendo il risultato di varie notti di sforzo (ho confrontato 10 altre config simili e ricavato da ognuna i parametri migliori, controllando poi sui manuali Cisco se erano corretti)
La macchina e' un Cisco 877 SENZA Wi-Fi, collegato ad una ADSL 2+ Libero/Wind/Infostrada (l'azienda e' sempre la stessa) con 20 Mbit/s in down e 1 Mbit/s in up
I servizi configurati sono NAT e DHCP per la rete locale, oltre ad un semplice NTP per avere l'orario sempre a posto sul router
Volutamente non ho configurato il firewall, in quanto in azienda ne usiamo uno a valle
Ho rimosso dalla configurazione le varie password/riferimenti/ecc. inserendo al loro posto delle X, vi sara' sufficiente sostituire i giusti valori
Per quanto riguarda i tweaks, ho cercato di inserire tutti quelli "sicuri" ed escludere quelli dubbi/inutili
Di seguito la configurazione,
sono ben accetti suggerimenti/domande/miglioramenti
Codice: Seleziona tutto
version 12.4
service nagle
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname cisco877-sec-k9
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
logging buffered 51200
logging console critical
enable secret 5 XXXXXXXXXXXXXXXX
enable password 7 XXXXXXXXXXXXXXXX
!
no aaa new-model
!
crypto pki trustpoint TP-self-signed-1872815991
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1872815991
revocation-check none
rsakeypair TP-self-signed-1872815991
!
!
crypto pki certificate chain TP-self-signed-1872815991
certificate self-signed 01 nvram:IOS-Self-Sig#1.cer
dot11 syslog
no ip source-route
no ip gratuitous-arps
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.28.1
ip dhcp excluded-address 192.168.28.251 192.168.28.254
!
ip dhcp pool sdm-pool1
import all
network 192.168.28.0 255.255.255.0
domain-name XXXXXXXXXXXXXXXX
dns-server 193.70.152.15 193.70.152.25
default-router 192.168.28.1
lease 0 2
!
!
ip cef
no ip bootp server
no ip domain lookup
ip domain name XXXXXXXXXXXXXXXX
ip name-server 193.70.152.15
ip name-server 193.70.152.25
login block-for 1 attempts 3 within 30
login on-failure
login on-success
no ipv6 cef
!
multilink bundle-name authenticated
!
vpdn enable
!
vpdn-group 1
request-dialin
protocol pppoe
!
!
!
username admin privilege 15 secret 5 XXXXXXXXXXXXXXXX
!
!
!
archive
log config
hidekeys
!
!
ip tcp selective-ack
ip tcp synwait-time 10
!
bridge irb
!
!
interface ATM0
mtu 1492
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
no atm ilmi-keepalive
bundle-enable
dsl operating-mode adsl2+
!
interface ATM0.1 point-to-point
description $ES_WAN$
no ip redirects
no ip unreachables
no ip proxy-arp
pvc 8/35
pppoe-client dial-pool-number 1
!
!
interface FastEthernet0
!
interface FastEthernet1
shutdown
!
interface FastEthernet2
shutdown
!
interface FastEthernet3
shutdown
!
interface Vlan1
ip address 192.168.28.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1492
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
!
interface Dialer0
ip address negotiated
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1492
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip tcp adjust-mss 1452
no ip mroute-cache
dialer pool 1
dialer-group 1
ppp authentication chap pap callin
ppp chap hostname XXXXXXXXXXXXXXXX
ppp chap password 7 XXXXXXXXXXXXXXXX
ppp pap sent-username XXXXXXXXXXXXXXXX password 7 XXXXXXXXXXXXXXXX
!
no ip classless
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer0
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 600 life 86400 requests 10000
!
!
ip nat inside source list 100 interface Dialer0 overload
!
!
logging trap debugging
access-list 100 remark SDM_ACL Category=2
access-list 100 permit ip 192.168.28.0 0.0.0.255 any
dialer-list 1 protocol ip permit
no cdp run
!
!
!
!
!
control-plane
!
!
line con 0
login local
no modem enable
line aux 0
line vty 0 4
privilege level 15
password 7 XXXXXXXXXXXXXXXX
login local
transport input ssh
transport output ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
sntp server 192.43.244.18
end
