Help configurazione 1841 adsl infostrada

[mstrz]

Ciao a tutti,

Come da oggetto, sto cercando di configurare il mio 1841 per la connessione adsl, che a sua volta sarà collegato un semplice AP per il wi-fi.
Chi mi aiuta, vi posto uno show ver del mio router

THOR#show ver
Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(24)T, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Wed 25-Feb-09 15:36 by prod_rel_team

ROM: System Bootstrap, Version 12.4(13r)T, RELEASE SOFTWARE (fc1)

THOR uptime is 2 hours, 5 minutes
System returned to ROM by power-on
System restarted at 08:45:39 UTC Mon Feb 13 2012
System image file is "flash:c1841-adventerprisek9-mz.124-24.T.bin"


This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
[email protected].

Cisco 1841 (revision 7.0) with 195584K/66560K bytes of memory.
Processor board ID FCZ112912A5
2 FastEthernet interfaces
1 ATM interface
1 Virtual Private Network (VPN) Module
DRAM configuration is 64 bits wide with parity disabled.
191K bytes of NVRAM.
62592K bytes of ATA CompactFlash (Read/Write)

Configuration register is 0x2102

Grazie in anticipo

[ghira]

Cisco IOS Software, 1841 Software (C1841-ADVENTERPRISEK9-M), Version 12.4(24)T, RELEASE SOFTWARE (fc1)

Sarebbe opportuno passare alla 12.4(24)T6 in quanto e' la versione attuale
della 12.4T.

(o alla 15.0(1)M7 o la 15.1(4)M3 se preferisci e hai la memoria ecc.)

[mstrz]

Ok allora porto le dovute modifiche!

Grazie

[mstrz]

Ok aggiornamento effettuato, e router configurato con successo...Ora volevo rendere la mia rete sicura da attacchi virus etc etc qualche consiglio su acl da applicare??

Grazie

[ghira]

Ok aggiornamento effettuato, e router configurato con successo...Ora volevo rendere la mia rete sicura da attacchi virus etc etc qualche consiglio su acl da applicare??

Grazie

potresti cominciare con l'ip inspect (aka cbac) o se vuoi essere molto
moderno, con lo zbfw. ma mi pare di capire che lo zbfw sia piu'
indicato con le ultimissime versioni tipo la 15.1

[mstrz]

Ah ok allora provo un po' prima a capire il funzionamento e provo!!
Per il momento ho bloccato con delle acl un po' di cose!!
Vi faccio sapere!!
Ciaoo

[ghira]

Ah ok allora provo un po' prima a capire il funzionamento e provo!!
Per il momento ho bloccato con delle acl un po' di cose!!
Vi faccio sapere!!
Ciaoo

essenzialmente, con ip inspect o zbfw, blocchi _tutto_ in entrata,
tranne le risposte alle cose in uscita, e magari alcune cose speciali
tipo ssh.

[mstrz]

Ok grazie davvero per le info, cosa mi consigli di usare come syslog in locale sul mio pc windows??

[mstrz]

Secondo voi queste acl per il momento possono andare bene


10 deny tcp any any eq 22 log (1 match)
20 deny tcp any any eq 135 log
30 deny tcp any any eq telnet log (1 match)
40 deny udp any any eq netbios-ns log
50 deny udp any any eq netbios-dgm log
60 deny tcp any any eq 445 log
70 deny icmp any any echo
80 permit ip any any (113150 matches)

[ghira]

Secondo voi queste acl per il momento possono andare bene


10 deny tcp any any eq 22 log (1 match)
20 deny tcp any any eq 135 log
30 deny tcp any any eq telnet log (1 match)
40 deny udp any any eq netbios-ns log
50 deny udp any any eq netbios-dgm log
60 deny tcp any any eq 445 log
70 deny icmp any any echo
80 permit ip any any (113150 matches)

non direi. come minimo accetterei solo tcp "established".

per zbfw non ti posso aiutare, ma per ip inspect potresti provare qualcosa come:

ip inspect name MYFW icmp router-traffic
ip inspect name MYFW ftp
ip inspect name MYFW tftp
ip inspect name MYFW imap
ip inspect name MYFW dns
ip inspect name MYFW ntp
ip inspect name MYFW ssh
ip inspect name MYFW telnet
ip inspect name MYFW smtp
ip inspect name MYFW snmp
ip inspect name MYFW snmptrap
(e altre righe simili a piacere)
ip inspect name MYFW tcp router-traffic
ip inspect name MYFW udp router-traffic

ip access-list extended IOS_FW
deny ip 224.0.0.0 31.255.255.255 any
permit icmp any any echo-reply
permit icmp any any unreachable
permit icmp any any administratively-prohibited
permit icmp any any packet-too-big
permit icmp any any echo
permit icmp any any time-exceeded
deny icmp any any
deny ip any any

access-list 30 deny 224.0.1.35
access-list 30 deny 224.0.1.60
access-list 30 deny 224.0.1.3
access-list 30 deny 224.0.1.2
access-list 30 deny 224.0.1.22
access-list 30 deny 224.0.1.24
access-list 30 remark Multicast filtering ACL
access-list 30 deny 224.0.0.0 0.0.0.255
access-list 30 deny 239.0.0.0 0.255.255.255
access-list 30 permit 224.0.0.0 15.255.255.255

ip route 0.0.0.0 0.0.0.0 Dialer0
ip route 0.0.0.0 255.0.0.0 Null0
ip route 0.0.0.0 255.255.255.255 Vlan1
ip route 10.0.0.0 255.0.0.0 Null0
ip route 127.0.0.0 255.0.0.0 Null0
ip route 169.254.0.0 255.255.0.0 Null0
ip route 172.16.0.0 255.240.0.0 Null0
ip route 192.0.0.0 255.255.255.0 Null0
ip route 192.0.2.0 255.255.255.0 Null0
ip route 198.18.0.0 255.254.0.0 Null0
ip route 198.51.100.0 255.255.255.0 Null0
ip route 203.0.113.0 255.255.255.0 Null0

(magari questo elenco andrebbe aggiornato)

interface Dialer0
ip verify unicast source reachable-via rx allow-default
ip multicast boundary 30
no ip redirects
no ip unreachables
ip access-group IOS_FW in
ip inspect MYFW out

[ghira]

comunque, zbfw e' il futuro, a quanto pare, e se usi la 15.0(1)M7 o la 15.1
magari dovresti provarlo. mi dicono che sulla 12.4T non e' il caso.

[ghira]

http://packetlife.net/blog/2012/jan/30/ ... -firewall/

per zbfw

[mstrz]

Ok Grazie Mille!!