!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service sequence-numbers
!
hostname c1841
!
boot-start-marker
boot system flash c1841-adventerprisek9-mz.124-22.T.bin
boot-end-marker
!
logging message-counter syslog
logging buffered 4096
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login IPSEC local
aaa authentication ppp default local
aaa authorization network default local
aaa authorization network IPSEC local
!
!
aaa session-id common
clock timezone MSK 3
clock summer-time MSK recurring last Sun Mar 2:00 last Sun Oct 3:00
dot11 syslog
ip source-route
!
!
!
!
ip cef
no ip bootp server
ip domain name
ip name-server 8.8.8.8
ip ips name IPS
ip inspect name FW tcp router-traffic
ip inspect name FW udp router-traffic
ip inspect name FW icmp router-traffic
ip inspect name FW ftp
ip inspect name FW dns
ip inspect name FW pop3
login block-for 600 attempts 3 within 30
login delay 10
login on-failure log
login on-success log
no ipv6 cef
l2tp-class name
!
!
multilink bundle-name authenticated
!
vpdn enable
!
vpdn-group 1
! Default PPTP VPDN group
 accept-dialin
  protocol pptp
  virtual-template 1
 local name remote
!
!

!
!

archive
 log config
  hidekeys
!
!
crypto isakmp policy 1
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp client configuration group remote
 key remote_secret
 domain wr
 pool IPSEC_POOL
!
!
crypto ipsec transform-set TR esp-des esp-md5-hmac
!
crypto dynamic-map DYNMAP 10
 description Dynamic crypto map for cisco-client
 set transform-set TR
 reverse-route
!
!
crypto map CLIENTMAP client authentication list IPSEC
crypto map CLIENTMAP isakmp authorization list IPSEC
crypto map CLIENTMAP client configuration address respond
crypto map CLIENTMAP 10 ipsec-isakmp dynamic DYNMAP
!
!
!
ip ssh version 2
!
track 1 ip sla 10 reachability
 delay down 120 up 120
!
!
!
interface FastEthernet0/0
 description TO_INTERNET
 bandwidth 7000
 no ip address
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip ips IPS in
 ip virtual-reassembly
 duplex auto
 speed auto
 no cdp enable
 crypto map CLIENTMAP
!
interface FastEthernet0/0.101
 description Provider 1 - ISP1
 encapsulation dot1Q 101
 ip address IP 1 прова 255.255.255.252
 ip access-group Incomming in
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip ips IPS in
 ip virtual-reassembly
 no cdp enable
 crypto map CLIENTMAP
!
interface FastEthernet0/0.102
 description Provider 2 - ISP2
 encapsulation dot1Q 102
 ip address IP 2 прова 255.255.255.128
 ip access-group Incomming in
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip ips IPS in
 ip virtual-reassembly
 no cdp enable
 crypto map CLIENTMAP
!
interface FastEthernet0/0.103
 description Provider 3 - ISP3
 encapsulation dot1Q 103
 ip address IP 3 прова 255.255.255.0
 ip access-group Incomming in
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip ips IPS in
 ip virtual-reassembly
 no cdp enable
 crypto map CLIENTMAP
!
interface FastEthernet0/1
 description TO_LAN
 no ip address
 ip flow ingress
 duplex auto
 speed auto
!
interface FastEthernet0/1.100
 description Control_VLAN_100
 encapsulation dot1Q 100
 ip address 10.90.90.1 255.255.255.0
 ip access-group 10 in
 ip access-group 10 out
 ip flow ingress
!
interface FastEthernet0/1.110
 description Link_to_Billing_Server
 encapsulation dot1Q 110
 ip address 10.90.110.1 255.255.255.252
 ip flow ingress
 ip nat inside
 ip ips IPS in
 ip inspect FW in
 ip virtual-reassembly
!
interface FastEthernet0/1.111
 description to_LAN
 encapsulation dot1Q 111
 ip flow ingress
 ip nat inside
 ip inspect FW in
 ip virtual-reassembly
!
interface Virtual-Template1
 ip unnumbered FastEthernet0/1.110
 peer default ip address pool PPTP_POOL
 ppp encrypt mppe auto passive
 ppp authentication ms-chap-v2
!
ip local policy route-map LocalPol
ip local pool PPTP_POOL 192.168.101.1 192.168.101.254
ip local pool IPSEC_POOL 192.168.102.1 192.168.103.254
ip default-gateway Шлюз 2 прова
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Шлюз 2 прова
ip route 192.168.0.0 255.255.255.0 10.90.110.2
ip http server
ip http port 8080
ip http access-class 25
ip http authentication aaa
ip http secure-server
ip http secure-port 2333
!
ip flow-export version 5
!
ip nat inside source route-map Provider1-NAT interface FastEthernet0/0.101 overload
ip nat inside source route-map Provider2-NAT interface FastEthernet0/0.102 overload
ip nat inside source route-map Provider3-NAT interface FastEthernet0/0.103 overload

!
ip access-list extended Incomming
 deny   ip 192.168.0.0 0.0.255.255 any log
 permit icmp any any echo
 permit icmp any any echo-reply
 permit icmp any any source-quench
 permit icmp any any packet-too-big
 permit icmp any any time-exceeded
 deny   icmp any any
 permit tcp any any eq 33895
 permit tcp any any eq 56505
 permit tcp any any eq 1723
 permit gre any any
 permit udp any any eq isakmp
 permit esp any any
 permit udp any any eq ntp
 permit udp any eq ntp any
 permit udp any eq domain any
 permit udp any any eq domain
 permit ip 192.168.102.0 0.0.0.255 192.168.0.0 0.0.0.255
 deny   ip any any log
ip access-list extended NAT
 deny   ip 192.168.0.0 0.0.0.255 192.168.101.0 0.0.0.255
 deny   ip 192.168.0.0 0.0.0.255 192.168.102.0 0.0.0.255
 permit ip 192.168.0.0 0.0.0.255 any
 permit ip 10.90.110.0 0.0.0.3 any
ip access-list extended Provider1-Net-Gw
 permit ip host IP 1 прова any
ip access-list extended Provider2-Net-Gw
 permit ip host IP 2 прова any
ip access-list extended Provider3-Net-Gw
 permit ip host IP 3 прова any
!
ip sla 10
 icmp-echo DNS 2 прова source-interface FastEthernet0/0.102
 timeout 2000
 frequency 30
ip sla schedule 10 life forever start-time now
logging 192.168.0.100
logging 192.168.0.200
access-list 10 permit 10.90.90.0 0.0.0.255
access-list 10 permit 192.168.0.0 0.0.0.255
access-list 10 permit 192.168.101.0 0.0.0.255
access-list 10 deny   any
snmp-server ifindex persist
no cdp run

!
!
!
!
route-map LocalPol permit 10
 match ip address Provider1-Net-Gw
 set ip next-hop Шлюз 1 прова
!
route-map LocalPol permit 20
 match ip address Provider2-Net-Gw
 set ip next-hop Шлюз 2 прова
!
route-map LocalPol permit 30
 match ip address Provider3-Net-Gw
 set ip next-hop Шлюз 3 прова   
!
route-map Provider3-NAT permit 10
 match ip address NAT
 match interface FastEthernet0/0.103
!
route-map Provider2-NAT permit 10
 match ip address NAT
 match interface FastEthernet0/0.102
!
route-map Provider1-NAT permit 10
 match ip address NAT
 match interface FastEthernet0/0.101
!
!
!
!
control-plane
!
!
banner login 
You have accessed a private system.

Unauthorized access is prohibited.

If you don't belong here, leave.


banner motd  DON't FORGET TO WRITE ALL CHANGES TO LOGFILE!!! 
!
line con 0
line aux 0
line vty 0 4
 exec-timeout 60 0
 transport input ssh
line vty 5 807
 transport input ssh
!
scheduler allocate 20000 1000

event manager applet SILVER_is_DOWN
 event track 1 state down
 action 1.0 cli command "enable"
 action 1.1 cli command "conf t"
 action 1.2 cli command "no ip route 0.0.0.0 0.0.0.0 Шлюз 2 прова"
 action 1.3 cli command "ip route 0.0.0.0 0.0.0.0 Шлюз 1 прова"
 action 1.4 cli command "exit"
 action 1.5 cli command "clear ip nat translation *"
 action 1.6 cli command "exit"
event manager applet SILVER_is_UP
 event track 1 state up
 action 1.0 cli command "enable"
 action 1.1 cli command "conf t"
 action 1.2 cli command "no ip route 0.0.0.0 0.0.0.0 Шлюз 1 прова"
 action 1.3 cli command "ip route 0.0.0.0 0.0.0.0 Шлюз 2 прова"
 action 1.4 cli command "exit"
 action 1.5 cli command "clear ip nat translation *"
 action 1.6 cli command "exit"
!
end