ho un cisco 877 e un firewall collegato sulla fe0 (192.168.0.2)
che comandi devo utilizzare per fare in modo che il cisco sia "trasparente"? ovvero che tutte le porte siano aperte verso il mio firewall?
grazie
------------------------------------
configurazione attuale
Codice: Seleziona tutto
no aaa new-model
ip subnet-zero
no ip domain lookup
ip name-server 208.67.222.222
ip name-server 208.67.220.220
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.0.3 192.168.0.254
!
ip dhcp pool Pool1
import all
network 192.168.0.0 255.255.255.0
default-router 192.168.0.1
dns-server 208.67.222.222 208.67.220.220
lease infinite
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
!
interface Vlan1
ip address 192.168.0.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1360
!
interface ATM0
no ip address
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0.1 point-to-point
description ADSL Aruba 7MB
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
!
interface Dialer0
description Interfaccia Dialer0/0 - Aruba ADSL 7MB
ip address negotiated
ip mtu 1492
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
ppp authentication chap pap callin
ppp pap sent-username XXX password XXX
!
ip nat translation timeout 420
ip nat translation tcp-timeout 120
ip nat translation pptp-timeout 420
ip nat translation icmp-timeout 1
ip nat translation max-entries 1000
ip nat inside source list 1 interface Dialer0 overload
ip nat inside source static udp 192.168.0.2 4672 interface Dialer0 4672
ip nat inside source static tcp 192.168.0.2 4661 interface Dialer0 4661
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer0
no ip http server
no ip http secure-server
!
!
access-list 11 remark ************************************
access-list 11 remark ACL 11 PER CONTROLLO APLET JAVA
access-list 11 permit any
access-list 100 remark ********* ACL per NAT **************************
access-list 100 permit ip 192.168.0.0 0.0.0.255 any
access-list 111 remark ************************************************
access-list 111 remark ANTI-SPOOFING
access-list 111 deny icmp any any redirect log
access-list 111 deny ip 10.0.0.0 0.255.255.255 any log
access-list 111 deny ip 172.16.0.0 0.15.255.255 any log
access-list 111 deny ip 192.168.0.0 0.0.255.255 any log
access-list 111 deny ip 127.0.0.0 0.255.255.255 any log
access-list 111 deny ip 224.0.0.0 31.255.255.255 any log
access-list 111 deny ip host 0.0.0.0 any log
access-list 111 deny ip any any log
!
!
line con 0
line aux 0
access-class 23 in
exec-timeout 5 0
modem DTR-active
transport input telnet
line vty 0 4
access-class 23 in
exec-timeout 5 0
transport preferred none
transport input telnet
!
scheduler max-task-time 5000
end
