Conf ADSL 20 Mb e Cisco 877

[giocomail]

Paziente Wizard, come da tuo suggerimento apro questo topic e posto la mia attuale conf.
Non è quella fatta da te perchè l'ho rimossa per i problemi esposti nell'altra discussione.
Ovviamente quela tua mi avrebbe fatto molto piacere utilizzarla perchè la vedevo molto professionale
Questa è quella attuale:

Codice: Seleziona tutto

version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname RTR-DRG
!
boot-start-marker
boot-end-marker
!
enable secret 5 ********************
!
no aaa new-model
!
resource policy
!
ip subnet-zero
no ip source-route
ip cef
!
!
ip domain name interbusiness.it
ip name-server 151.99.0.100
ip name-server 151.99.125.1
!
!
crypto pki trustpoint TP-self-signed-1987534786
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-1987534786
 revocation-check none
 rsakeypair TP-self-signed-1987534786
!
!
crypto pki certificate chain TP-self-signed-1987534786
 certificate self-signed 01
  30820250 308201B9 A0030201 02020101 300D0609 2A864886 F70D0101 04050030 
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274 
  69666963 6174652D 31393837 35333437 3836301E 170D3038 30363037 30313436 
  30375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649 
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 39383735 
  33343738 3630819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 
  8100AB28 F21A00C3 EC28F8B6 6A3D9DD1 6CD0BA96 A82E18DD 13504E9C D65A5206 
  2C309FAC 273BB449 5A700F0B 4262BB07 FBF3EB84 114576E8 46FFE186 0607493D 
  4C9AEE48 D0DAA1BD 27254005 290F401A 7CDEC6D2 73BA03D6 B7D167A4 B807F30E 
  743BD49B 0E2BF6D3 B3B7C4F5 2EE0287C 84F78EA8 03500F5B 6024B4B5 80205651 
  E47F0203 010001A3 78307630 0F060355 1D130101 FF040530 030101FF 30230603 
  551D1104 1C301A82 18525452 2D445247 2E696E74 65726275 73696E65 73732E69 
  74301F06 03551D23 04183016 8014CE81 8FCACF3D B06CD60A 2A59E540 EE57BD98 
  0B29301D 0603551D 0E041604 14CE818F CACF3DB0 6CD60A2A 59E540EE 57BD980B 
  29300D06 092A8648 86F70D01 01040500 03818100 440F5817 D881A368 20901B13 
  1FC36574 6A52533F B3ABAA88 65F8E4AB 802F63DF A866BA5B 21182FA2 EA523977 
  88E7B8A8 5CDEA63B 53935DF8 5DDDBCEC FFE1725E F967CE03 1D603D20 C81CE7C3 
  B774C273 4C64F06C D31A2061 39647DF3 F4BD382A 80149A1C F38259CC 36C47B3B 
  363696BC 5B8207FB 3EF85703 03D6D4B7 B2F2C181
  quit
username ****** privilege 15 secret 5 *****************
!
! 
!
!
!
interface ATM0
 no ip address
 no atm ilmi-keepalive
 dsl operating-mode auto 
!
interface ATM0.1 point-to-point
 bandwidth 4096
 ip address 88.57.*.* 255.255.255.252
 ip nat outside
 ip virtual-reassembly
 no snmp trap link-status
 pvc 8/35 
  oam-pvc manage
  oam retry 5 5 1
  encapsulation aal5snap
 !
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
 ip address 192.168.1.1 255.255.255.0 secondary
 ip address 88.63.*.* 255.255.255.248
 ip nat inside
 ip virtual-reassembly
 hold-queue 100 out
!
ip classless
ip route 0.0.0.0 0.0.0.0 ATM0.1
!
ip http server
ip http secure-server
ip nat pool INTERNET 88.63.*.* 88.63.*.* netmask 255.255.255.248
ip nat inside source list 1 pool INTERNET overload
ip nat inside source static tcp 192.168.1.2 80 88.63.244.249 80 extendable
!
access-list 1 permit 192.168.0.0 0.0.0.255
access-list 1 permit 88.63.*.* 0.0.0.7
!
control-plane
!
!
line con 0
 no modem enable
line aux 0
line vty 0 4
 login
!
scheduler max-task-time 5000
end

che però ha questi problemi:
- la LAN non naviga
- non entro in telnet nel router
- non pingo dal router nessun IP pubblico.

Che dici.....me la dai una mano?......

Grazie

[Wizard]

Fai un "sh ip int brief" e postalo

[giocomail]

Buongiorno,
allora eccoci qua a riprendere questa .........battaglia con il router...........
Posto il risultato di quanto Wizard mi ha suggerito di fare:

Codice: Seleziona tutto

RTR-DRG#sh ip int brief
Interface                  IP-Address      OK? Method Status      Protocol

FastEthernet0              unassigned      YES unset  up          up

FastEthernet1              unassigned      YES unset  up          down

FastEthernet2              unassigned      YES unset  up          down

FastEthernet3              unassigned      YES unset  up          down

ATM0                       unassigned      YES NVRAM  up          up

ATM0.1                     88.57.135.*     YES NVRAM  up          up

Vlan1                      88.63.244.*     YES NVRAM  up          up

NVI0                       unassigned      YES unset  up          up

RTR-DRG#

Resto in paziente attesa

[Wizard]

La ATM0 almeno è su...
Prova a fare un ping verso 151.1.1.1 da un pc dietro al router e dopo, dal router, fai un "sh access-list"

Dovresti vedre la acl 1 con dei match...

[MircoT]

Mi sembra che l'acl 1 sia errata...
"access-list 1 permit 192.168.0.0 0.0.0.255"
Se la lan ha indirizzamento 192.168.1.x (il router ha indirizzo 192.168.1.1 se non sbaglio), l'acl 1 dovrebbe essere:
access-list 1 permit 192.168.1.0 0.0.0.255


Sono un principiante su IOS... se ho sbagliato non sparatemi...


Ciauzzz!

[Wizard]

Hai assolutamente ragione Mirco!
Se fai il mio test con la acl attuale vedrai che nn matcha niente...

[giocomail]

Ciao Wizard,

stamattina, preso dallo scoramento, ho azzerato tutta la conf del router ed ho caricato la tua conf che pubblichi nel topic.
Sorpresa......tutto perfettamente funzionante........

Ma troppo bello per essere vero..........
Ho tre problemini da risolvere:

1 - Come faccio a pubblicare sempre lo stesso IP che è registrato nel DNS a cui sono associati alcuni siti web?
2 - Come faccio a fare NAT sul web server?
3 - Perchè il servizio firewall del router non si avvia e mi dice rules unsupported

Posto la conf attuale a maggior chiarimento:

Codice: Seleziona tutto

service nagle 
no service pad 
service timestamps debug datetime msec localtime show-timezone 
service timestamps log datetime msec localtime show-timezone 
service password-encryption 
service sequence-numbers 

hostname RTR-DRG 

boot-start-marker 
boot-end-marker 

logging exception 100000 
logging count 
logging userinfo 
logging queue-limit 10000 
logging buffered 150000 notifications 
logging console critical 
enable secret 5 ****** 

no aaa new-model 
clock timezone MET 1 
clock summer-time MEDT recurring last Sun Mar 2:00 last Sun Oct 3:00 

no ip source-route 
no ip gratuitous-arps 
ip icmp rate-limit unreachable 1000 

ip cef 
ip inspect log drop-pkt 
ip inspect max-incomplete low 300 
ip inspect max-incomplete high 400 
ip inspect one-minute low 300 
ip inspect hashtable-size 2048 
ip inspect tcp synwait-time 20 
ip inspect tcp max-incomplete host 300 block-time 60 
ip inspect name IDS tcp 
ip inspect name IDS udp 
ip inspect name IDS ftp 
no ip bootp server 
ip domain name cisco.com 
ip name-server 151.99.125.1 
ip name-server 208.67.222.222 
login block-for 1 attempts 3 within 30 
login on-failure 
login on-success 

username ****** privilege 15 secret 5 ****** 
archive 
 log config 
  hidekeys 

ip tcp selective-ack 
ip tcp window-size 2144 
ip tcp synwait-time 10 

interface Loopback0 
 description INTERFACCIA VIRTUALE END-POINT VPN 
 ip address 88.63.244.*** 255.255.255.248 

interface Null0 
 no ip unreachables 

interface ATM0 
 description ALICE BUSINESS 20 Mbps - TGU:  
 mtu 1500 
 no ip address
 no shutdown  
 no atm ilmi-keepalive 
 dsl operating-mode auto 

interface ATM0.1 point-to-point 
 description INTERFACCIA PER ACCESSO AD INTERNET 
 mtu 1500 
 ip address 88.57.135.*** 255.255.255.252 
 ip access-group 131 in 
 ip verify unicast reverse-path 
 no ip redirects 
 no ip unreachables 
 no ip proxy-arp 
 ip accounting access-violations 
 ip inspect IDS out 
 ip nat outside 
 ip virtual-reassembly 
 no ip mroute-cache 
 no snmp trap link-status 
 pvc 8/35 
  encapsulation aal5snap 

interface FastEthernet0 

interface FastEthernet1 

interface FastEthernet2 

interface FastEthernet3 

interface Vlan1 
 description CONNESSIONE LAN DRG 
 ip address 192.168.1.1 255.255.255.0 
 ip accounting output-packets 
 ip nat inside 
 ip virtual-reassembly 
 ip route-cache flow 
 no ip mroute-cache 
 hold-queue 100 out 

ip route 0.0.0.0 0.0.0.0 ATM0.1 

ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000 

ip nat pool INTERNET 88.63.244.*** 88.63.244.*** netmask 255.255.255.248 
ip nat pool LAN 192.168.1.0 192.168.1.255 netmask 255.255.255.0       
ip nat inside source list 100 pool INTERNET overload 

access-list 100 remark ************************************************************* 
access-list 100 remark *** ACL PER PAT E NAT0 *** 
access-list 100 permit ip 192.168.1.0 0.0.0.255 any 

access-list 131 remark ************************************************************* 
access-list 131 remark *** ACL ANTI-SPOOFING *** 
access-list 131 deny   ip host 0.0.0.0 any log 
access-list 131 deny   ip 127.0.0.0 0.255.255.255 any log 
access-list 131 deny   ip 192.0.2.0 0.0.0.255 any log 
access-list 131 deny   ip 224.0.0.0 31.255.255.255 any log 
access-list 131 deny   ip 10.0.0.0 0.255.255.255 any log 
access-list 131 deny   ip 172.16.0.0 0.15.255.255 any log 
access-list 131 deny   ip 192.168.0.0 0.0.255.255 any log 
access-list 131 remark ************************************************************* 
access-list 131 remark *** ACL PER CONTROLLARE TRAFFICO ICMP *** 
access-list 131 permit icmp any any echo 
access-list 131 permit icmp any any echo-reply 
access-list 131 permit icmp any any time-exceeded 
access-list 131 permit icmp any any unreachable 
access-list 131 permit icmp any any administratively-prohibited 
access-list 131 permit icmp any any packet-too-big 
access-list 131 permit icmp any any traceroute 
access-list 131 deny   icmp any any 
access-list 131 remark ************************************************************* 
access-list 131 remark *** ACL PER BLOCCARE L'ACCESSO A VIRUS E ATTACCHI *** 
access-list 131 deny   tcp any any eq 135 
access-list 131 deny   udp any any eq 135 
access-list 131 deny   udp any any eq netbios-ns 
access-list 131 deny   udp any any eq netbios-dgm 
access-list 131 deny   tcp any any eq 139 
access-list 131 deny   udp any any eq netbios-ss 
access-list 131 deny   tcp any any eq 445 
access-list 131 deny   tcp any any eq 593 
access-list 131 deny   tcp any any eq 2049 
access-list 131 deny   udp any any eq 2049 
access-list 131 deny   tcp any any eq 2000 
access-list 131 deny   tcp any any range 6000 6010 
access-list 131 deny   udp any any eq 1433 
access-list 131 deny   udp any any eq 1434 
access-list 131 deny   udp any any eq 5554 
access-list 131 deny   udp any any eq 9996 
access-list 131 deny   udp any any eq 113 
access-list 131 deny   udp any any eq 3067 
access-list 131 remark ************************************************************* 
access-list 131 remark *** ACL PER BLOCCARE ACCESSI NON AUTORIZZATI *** 
access-list 131 deny   ip any any log 

control-plane 

banner motd ^C 
**************************************************************** 
---------------------------------------------------------------- 
* ***   ROUTER PERIMETRALE ----      ***   * 
---------------------------------------------------------------- 
* WARNING: System is RESTRICTED to authorized personnel ONLY! * 
* Unauthorized use of this system will be logged and * 
* prosecuted to the fullest extent of the law. * 
* * 
* If you are NOT authorized to use this system, LOG OFF NOW! * 
* * 
**************************************************************** 
^C 

line con 0 
 exec-timeout 120 0 
 login local 
 no modem enable 
 transport output ssh 
 stopbits 1 
line aux 0 
 login local 
 transport output ssh 
 stopbits 1 
line vty 0 4 
 exec-timeout 0 0 
 login local 
 transport input telnet ssh 
 transport output telnet ssh 

scheduler max-task-time 5000 
scheduler interval 500 
sntp server 193.204.114.232 
sntp server 193.204.114.233 
sntp server 193.204.114.105 
end

Un'altra cosa a cosa serve il codice sntp server

Per il ping su IP pubblici, dal router, manco a parlarne!!!

Ovviamente un grazie a MircoT che mi ha dato la dritta per correggere l'errore che continuavo a commettere

Grazie wizard, prometto che dopo me ne starò buono buono

Ciao

[Helix]

Simple Network Time Protocol. E' una versione semplificata del NTP per la gestione dell'orario sui vari apparati/server.

L'SNTP non ha memoria dei dati tra due check time consecutivi.

[Wizard]

Domande:

1 - Come faccio a pubblicare sempre lo stesso IP che è registrato nel DNS a cui sono associati alcuni siti web?
2 - Come faccio a fare NAT sul web server?
3 - Perchè il servizio firewall del router non si avvia e mi dice rules unsupported

Risposte:

1 e 2 - ip nat inside sorce static tcp (o udp) IP_INTERNO 80 (porta) IP_PUBBLICO (o interfaccia) 80 (porta

3 - non guardare + il pdm

[giocomail]

In pratica devo fare qualcosa di simile?

Codice: Seleziona tutto

ip nat inside source static tcp 192.168.1.2 80 88.63.244.*** 80

In verità ho provato, prima ancora di leggere la tua risposta, a inserire questo codice:

Codice: Seleziona tutto

ip nat inside source static tcp 192.168.1.2 80 Loopback0 80

ma non si vede nessun sito.

Infatti ho scoperto che esco con una numeraiozne IP superiore di due numeri a quello assegnato da Telecom: in pratica anzichè uscire, ad esempio, con *.*.*.88 esco con *.*.*.90.

A cosa serve mettere intefarce Null0 no ip unreachables ?

Vi prego, non mi chiamate seccante..........

Ovviamente grazie a tutti.........

[Wizard]

Ma la acl in entrata per la porta 80 la hai messa?

[giocomail]

In verità non lo so.
Il problema è che mi sto incartando e quindi non riesco più a capirci niente
.....Puoi dirmi come devo scrivere l'ACL in entrata?......

[Wizard]

Codice: Seleziona tutto

no access-list 131
access-list 131 remark *************************************************************
access-list 131 remark *** ACL ANTI-SPOOFING ***
access-list 131 deny   ip host 0.0.0.0 any log
access-list 131 deny   ip 127.0.0.0 0.255.255.255 any log
access-list 131 deny   ip 192.0.2.0 0.0.0.255 any log
access-list 131 deny   ip 224.0.0.0 31.255.255.255 any log
access-list 131 deny   ip 10.0.0.0 0.255.255.255 any log
access-list 131 deny   ip 172.16.0.0 0.15.255.255 any log
access-list 131 deny   ip 192.168.0.0 0.0.255.255 any log
access-list 131 remark *************************************************************
access-list 131 remark *** ACL PER CONTROLLARE TRAFFICO ICMP ***
access-list 131 permit icmp any any echo
access-list 131 permit icmp any any echo-reply
access-list 131 permit icmp any any time-exceeded
access-list 131 permit icmp any any unreachable
access-list 131 permit icmp any any administratively-prohibited
access-list 131 permit icmp any any packet-too-big
access-list 131 permit icmp any any traceroute
access-list 131 deny   icmp any any
access-list 131 remark *************************************************************
access-list 131 remark *** ACL VERSO SERVER WEB
access-list 131 permit tcp any any 80
access-list 131 remark****************************************************************
access-list 131 remark *** ACL PER BLOCCARE L'ACCESSO A VIRUS E ATTACCHI ***
access-list 131 deny   tcp any any eq 135
access-list 131 deny   udp any any eq 135
access-list 131 deny   udp any any eq netbios-ns
access-list 131 deny   udp any any eq netbios-dgm
access-list 131 deny   tcp any any eq 139
access-list 131 deny   udp any any eq netbios-ss
access-list 131 deny   tcp any any eq 445
access-list 131 deny   tcp any any eq 593
access-list 131 deny   tcp any any eq 2049
access-list 131 deny   udp any any eq 2049
access-list 131 deny   tcp any any eq 2000
access-list 131 deny   tcp any any range 6000 6010
access-list 131 deny   udp any any eq 1433
access-list 131 deny   udp any any eq 1434
access-list 131 deny   udp any any eq 5554
access-list 131 deny   udp any any eq 9996
access-list 131 deny   udp any any eq 113
access-list 131 deny   udp any any eq 3067
access-list 131 remark *************************************************************
access-list 131 remark *** ACL PER BLOCCARE ACCESSI NON AUTORIZZATI ***
access-list 131 deny   ip any any log 

[giocomail]

E vai!!!!!!!.........Funziona tutto, sia in che out
Wizard sei un grandissimo, un monumento ti ci vorrebbe
Giuro. una ultimissima cosa: come faccio ad impedire ad un PC della rete l'accesso ad internet e/o ad una particolare porta TCP?

Graaaaaaaazieeeeeee........

[Wizard]

una ultimissima cosa: come faccio ad impedire ad un PC della rete l'accesso ad internet e/o ad una particolare porta TCP?

access-l 121 remark ***ACL IN USCITA***
access-l 121 deny ip host IP_CHE_VUOI_BLOCCARE any
access-l 121 permit ip any any

int vlan 1
ip access-group 121 in