oggi ho dovuto configurare un cisco 837 con un'adsl Alice Business con 8 Ip pubblici.
non mi intendo molto di Cisco, però grazie al forum ho messo insieme una configurazione funzionante, almeno al 90%!
il problema è che non riesco a far andare il nat in ingresso! mentre i pc nella lan riescono a navigare tranquillamente uscendo nattati con il primo IP pubblico.
mi serve per abilitare un server vpn, ma per prova ho pubblicato la porta 80 giusto per vedere se andava in nat...e niente!
premetto che parte della configurazione è uscita con dei tentativi con la consoleweb di cisco, ma alla seconda volta che mi ha piantato explorer l'ho accantonata...per cui ci saranno sicuramente dei pezzi "in eccesso" che se mi indicate toglierò volentieri!
questa è la mia conf:
Codice: Seleziona tutto
!
version 12.3
service config
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname 11111111
!
boot-start-marker
boot-end-marker
!
no logging buffered
enable secret 5 11111
enable password 1111111111111
!
username root secret 5 111111
no aaa new-model
ip subnet-zero
no ip source-route
!
!
ip inspect name myfw cuseeme timeout 3600
ip inspect name myfw ftp timeout 3600
ip inspect name myfw rcmd timeout 3600
ip inspect name myfw realaudio timeout 3600
ip inspect name myfw smtp timeout 3600
ip inspect name myfw tftp timeout 30
ip inspect name myfw udp timeout 15
ip inspect name myfw tcp timeout 3600
ip inspect name myfw h323 timeout 3600
ip audit notify log
ip audit po max-events 100
no ftp-server write-enable
!
!
!
no crypto isakmp enable
!
!
!
!
interface Ethernet0
ip address 10.0.0.100 255.255.255.0
ip access-group 122 out
ip nat inside
no cdp enable
hold-queue 100 out
!
interface ATM0
no ip address
no ip route-cache
no ip mroute-cache
load-interval 30
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0.1 point-to-point
ip address 94.xxx.xxx.241 255.255.255.252
ip access-group 111 in
ip nat outside
ip inspect myfw out
no ip route-cache
no ip mroute-cache
pvc 8/35
oam-pvc manage
encapsulation aal5snap
!
!
ip nat inside source list 100 interface ATM0.1 overload
ip nat inside source static tcp 10.0.0.2 80 interface ATM0.1 80
ip nat inside source static tcp 10.0.0.2 1723 interface ATM0.1 1723
ip nat inside source static udp 10.0.0.2 500 interface ATM0.1 500
ip nat inside source static udp 10.0.0.2 1701 interface ATM0.1 1701
ip nat inside source static udp 10.0.0.2 5500 interface ATM0.1 5500
ip classless
ip route 0.0.0.0 0.0.0.0 ATM0.1
no ip http server
no ip http secure-server
!
!
access-list 100 permit ip 10.0.0.0 0.0.0.255 any
access-list 111 permit udp any any eq 5500
access-list 111 permit udp any any eq 1701
access-list 111 permit udp any any eq isakmp
access-list 111 permit tcp any any eq 1723
access-list 111 permit tcp any any eq 80
access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any traceroute
access-list 111 permit icmp any any unreachable
access-list 111 permit udp any eq bootps any eq bootpc
access-list 111 permit udp any eq bootps any eq bootps
access-list 111 permit esp any any
access-list 111 permit gre any any
access-list 111 deny ip any any
access-list 122 deny tcp any any eq telnet
access-list 122 permit ip any any
dialer-list 1 protocol ip permit
no cdp run
!
control-plane
!
!
line con 0
exec-timeout 0 0
no modem enable
transport preferred all
transport output all
line aux 0
transport preferred all
transport output all
line vty 0 4
exec-timeout 120 0
password brunerouter
login local
length 0
transport preferred all
transport input all
transport output all
!
scheduler max-task-time 5000
!
end
Grazie in anticipo
Speck
