SDM vil ikke lade mig konfigurere Firewall - Har brug for hjælp til IOS

Kunne du paste din konfig? (Skjul selvfg offentlige IP adresser, hvis haves mm.)


/Rubeck

Hej Rubeck,

Der kommer her :-) (Jeg har lavet offentlig IP om til XXX.XXX.XXX.XXX)

-----------------------------------------------------------------

!This is the running config of the router: 10.2.6.1
!----------------------------------------------------------------------------
!version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname MY-CISCO
!
boot-start-marker
boot system flash:/c180x-advipservicesk9-mz.124-24.T.bin
boot-end-marker
!
logging buffered 51200
logging console critical
enable secret 5 $1$H3qI$45m/.Sw4yVtBfRVG.1Ypx1
!
no aaa new-model
clock timezone PCTime 1
clock summer-time PCTime date Mar 30 2003 2:00 Oct 26 2003 3:00
no ip source-route
!
!
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 10.2.6.1 10.2.6.49
ip dhcp excluded-address 10.2.6.71 10.2.6.254
!
ip dhcp pool sdm-pool1
  import all
  network 10.2.6.0 255.255.255.0
  dns-server 10.2.6.10 193.88.44.22
  default-router 10.2.6.1
!
!
ip tcp synwait-time 10
no ip bootp server
ip domain name MY.main
ip name-server 10.2.6.10
ip name-server 193.88.44.22
!
multilink bundle-name authenticated
!
crypto pki trustpoint TP-self-signed-708668916
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-708668916
revocation-check none
rsakeypair TP-self-signed-708668916
!
!
crypto pki certificate chain TP-self-signed-708668916
certificate self-signed 01
  30820250 308201B9 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
  30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 37303836 36383931 36301E17 0D303930 31323130 39323430
  385A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F
  532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3730 38363638
  39313630 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100
  A6932AF3 D2D227CB ECD51BD6 E91B9D8A 82D9CFB1 04A56F34 74FC6DF1 F37B2A77
  E5491BC7 C6AFE54D 59AC3357 D5D78C65 1B40F213 5D8654AC 86C6119C B237B680
  65F12891 BC4F99BE 456BF7A7 D654A0E7 FE9D86C3 E724C4A9 48EF9139 DC5FF395
  2C1AAF72 A5E0E0DA 88EE67E3 FA95F17C C143A041 2793B3CF 3302C15F A6CC0D79
  02030100 01A37A30 78300F06 03551D13 0101FF04 05300301 01FF3025 0603551D
  11041E30 1C821A4B 4F4C4241 454B2D43 4953434F 2E6B6F6C 6261656B 2E6D6169
  6E301F06 03551D23 04183016 80141082 115EAD3C 422ECF95 4BB9F65C F94DE606
  A9A0301D 0603551D 0E041604 14108211 5EAD3C42 2ECF954B B9F65CF9 4DE606A9
  A0300D06 092A8648 86F70D01 01040500 03818100 6E73B161 852CC36C E8EBC3D8
  31E6BB80 1B6CC2A2 22B9257A 387B0316 B2C167EC 8589E22C A135827C 069B42D7
  53C22DF4 FC2CF2DC B7C81886 B0DEE244 D4FB6DFF E51A2D9D 71A8B12F 3455395F
  C8AF539E 34DE7C36 FC8053B6 69F05101 E55FDB2A 0A99440D 677161E7 60F38F35
  B7EE37C7 2D52D4D4 26A9B5AF E1F16AFF F543F2D2
  quit
!
!
username admin privilege 15 secret 5 $1$2QVy$8SZokk1iQ5mGTi0XmnxRs0
archive
log config
  hidekeys
!
!
class-map type inspect match-all cm_ZBFWNAT
match access-group name acl_ZBFWNAT
match protocol tcp
class-map type inspect match-all sdm-nat-http-1
match access-group 101
match protocol http
class-map type inspect match-all sdm-nat-smtp-1
match access-group 102
match protocol smtp
class-map type inspect match-any sdm-cls-insp-traffic
match protocol cuseeme
match protocol dns
match protocol ftp
match protocol h323
match protocol https
match protocol icmp
match protocol imap
match protocol pop3
match protocol netshow
match protocol shell
match protocol realmedia
match protocol rtsp
match protocol smtp extended
match protocol sql-net
match protocol streamworks
match protocol tftp
match protocol vdolive
match protocol tcp
match protocol udp
class-map type inspect match-all sdm-insp-traffic
match class-map sdm-cls-insp-traffic
class-map type inspect match-any sdm-cls-icmp-access
match protocol icmp
match protocol tcp
match protocol udp
class-map type inspect match-any cm_toserver
match access-group 101
match protocol tcp
class-map type inspect match-all sdm-invalid-src
match access-group 100
class-map type inspect match-all sdm-icmp-access
match class-map sdm-cls-icmp-access
class-map type inspect match-all sdm-protocol-http
match protocol http
!
!
policy-map type inspect sdm-permit-icmpreply
class type inspect sdm-icmp-access
  inspect
class class-default
  pass
policy-map type inspect sdm-pol-NATOutsideToInside-1
class type inspect sdm-nat-http-1
  inspect
class type inspect sdm-nat-smtp-1
  inspect
class type inspect cm_toserver
  inspect
class class-default
  drop
policy-map type inspect sdm-inspect
class type inspect sdm-invalid-src
  drop log
class type inspect sdm-insp-traffic
  inspect
class type inspect sdm-protocol-http
  inspect
class class-default
  drop
policy-map type inspect sdm-permit
class type inspect cm_ZBFWNAT
  inspect
class class-default
  drop
!
zone security out-zone
zone security in-zone
zone-pair security sdm-zp-self-out source self destination out-zone
service-policy type inspect sdm-permit-icmpreply
zone-pair security sdm-zp-NATOutsideToInside-1 source out-zone destination in-zone
service-policy type inspect sdm-pol-NATOutsideToInside-1
zone-pair security sdm-zp-out-self source out-zone destination self
service-policy type inspect sdm-permit
zone-pair security sdm-zp-in-out source in-zone destination out-zone
service-policy type inspect sdm-inspect
!
!
bridge irb
!
!
!
interface FastEthernet0
description $ES_WAN$$FW_OUTSIDE$
ip address dhcp client-id FastEthernet0
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat outside
ip virtual-reassembly
zone-member security out-zone
duplex auto
speed auto
!
interface BRI0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
encapsulation hdlc
shutdown
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
!
interface FastEthernet5
!
interface FastEthernet6
!
interface FastEthernet7
!
interface FastEthernet8
!
interface Dot11Radio0
no ip address
!
ssid MY-CISCO
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
bridge-group 1
bridge-group 1 spanning-disabled
!
interface Dot11Radio1
no ip address
!
ssid MY-CISCO
!
speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0
station-role root
bridge-group 1
bridge-group 1 spanning-disabled
!
interface ATM0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
shutdown
no atm ilmi-keepalive
dsl operating-mode auto
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-FE 1$$FW_INSIDE$
no ip address
ip tcp adjust-mss 1452
bridge-group 1
!
interface BVI1
description $ES_LAN$$FW_INSIDE$
ip address 10.2.6.1 255.255.255.0
ip nat inside
ip virtual-reassembly
zone-member security in-zone
ip tcp adjust-mss 1412
!
!
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source static tcp 10.2.6.10 80 interface FastEthernet0 80
ip nat inside source static tcp 10.2.6.10 25 interface FastEthernet0 25
ip nat inside source list 1 interface FastEthernet0 overload
ip nat inside source static tcp 10.2.6.10 443 interface FastEthernet0 443
ip nat inside source static tcp 10.2.6.10 3389 interface FastEthernet0 3389
ip nat inside source static tcp 10.2.6.202 3392 interface FastEthernet0 3392
ip nat inside source static tcp 10.2.6.204 3394 interface FastEthernet0 3394
ip nat inside source static tcp 10.2.6.203 3393 interface FastEthernet0 3393
ip nat inside source static tcp 10.2.6.205 3395 interface FastEthernet0 3395
ip nat inside source static tcp 10.2.6.206 3396 interface FastEthernet0 3396
ip nat inside source static tcp 10.2.6.207 3397 interface FastEthernet0 3397
ip nat inside source static tcp 10.2.6.209 3399 interface FastEthernet0 3399
!
ip access-list extended acl_ZBFWNAT
permit tcp any host XXX.XXX.XXX.XXX eq www
permit tcp any host XXX.XXX.XXX.XXX eq 443
permit tcp any host XXX.XXX.XXX.XXX eq smtp
permit tcp any host XXX.XXX.XXX.XXX eq 3389
!
logging trap debugging
access-list 1 remark INSIDE_IF=BVI1
access-list 1 remark SDM_ACL Category=2
access-list 1 permit 10.2.6.0 0.0.0.255
access-list 100 remark SDM_ACL Category=128
access-list 100 permit ip host 255.255.255.255 any
access-list 100 permit ip 127.0.0.0 0.255.255.255 any
access-list 101 remark SDM_ACL Category=0
access-list 101 permit ip any host 10.2.6.10
access-list 102 remark SDM_ACL Category=0
access-list 102 permit ip any host 10.2.6.10
no cdp run
!
!
!
!
!
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
banner login ^CCAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
login local
line aux 0
line vty 0 4
privilege level 15
login local
transport input telnet ssh
line vty 5 15
privilege level 15
login local
transport input telnet ssh
!
scheduler interval 500
end

ip access-list extended Out2In

permit tcp any host <yderside IP> eq 3392

interface FastEthernet0
ip access-group Out2In in



Kunne være en mulighed....


/Rubeck

Hej Rubeck,

Jeg har nu kørt de kommandoer i IOS, og det ser ud til at den tager fint fat i dem, men jeg kan ikke få hul igennem, kan du se om jeg har lavet NAT reglen som den skal :

Trafik til port 3392 skal gå til 10.2.6.202

/stig :-)

UPDATE: Jeg har mistet fuldstændig adgang til alt som ligger bag routeren nu, der er intet som svarer, hvad kan det skyldes???

Ser nu ellers Ok ud..

Får du nogle hits på access-listen? (show ip access-list Out2In)


/Rubeck

Når jeg kører commandoen "show ip access-list Out2In" så viser den intet ?

Jeg blev nød til at genstarte routeren, da den tabte forbindelsen til omverdenen! Jeg havde ikke gemt konfigurationen så den var hurtigt oppe igen :-)

Hej Rubeck,

Tak for hjælpen tilbage i Oktober.. Jeg kontaktede Cisco til sidst og fandt ud af at det var pga. at der var en bug i 12.4 og måtte nedgradere.. Smider du ikke lige et svar så vi kan få lukket denne tråd, og du kan få dine point? Beklager at jeg ikke  er vendt tilbage før nu, men omstændigheder har ikke givet mig lejlighed til det!

/Stig :-)