Current configuration : 12353 bytes
!
version 12.4
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname WDF-2811-1
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 10 log
security passwords min-length 6
logging buffered 4096 debugging
logging console warnings
!
aaa new-model
!
!
aaa authentication login local_auth local
aaa authorization exec default local 
!
aaa session-id common
!
resource policy
!
clock timezone EDT -5
clock summer-time EDT recurring
ip subnet-zero
no ip source-route
no ip gratuitous-arps
ip telnet hidden addresses
!
!
ip cef
ip inspect udp idle-time 1800
ip inspect dns-timeout 7
ip inspect tcp idle-time 14400
ip inspect name INTERNET ftp timeout 3600
ip inspect name INTERNET esmtp timeout 3600
ip inspect name INTERNET icmp timeout 3600
ip inspect name INTERNET isakmp timeout 3600
ip inspect name INTERNET ftps timeout 3600
ip inspect name INTERNET l2tp timeout 3600
ip inspect name INTERNET pop3 timeout 3600
ip inspect name INTERNET pop3s timeout 3600
ip inspect name INTERNET dns timeout 3600
ip inspect name INTERNET imap timeout 3600
ip inspect name INTERNET imaps timeout 3600
ip inspect name INTERNET tcp timeout 3600
ip inspect name INTERNET udp timeout 3600
ip inspect name INTERNET h323callsigalt timeout 3600
ip inspect name INTERNET h323gatestat timeout 3600
ip inspect name INTERNET h323 timeout 3600
!
!
ip flow-cache timeout active 1
no ip bootp server
no ip domain lookup
ip ssh time-out 60
ip ssh authentication-retries 5
ip ssh logging events
ip address-pool local
!
!
!
crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key f2ada039a51ef1c024cf address 74.xxx.xxx.210 no-xauth
crypto isakmp key f2ada039a51ef1c024cf address 66.xxx.xxx.228 no-xauth
crypto isakmp keepalive 30 periodic
!
!
crypto ipsec transform-set P2P-VPN esp-3des esp-md5-hmac 
!
crypto map VPN_MAP 10 ipsec-isakmp 
 set peer 74.xxx.xxx.210
 set peer 66.xxx.xxx.228
 set transform-set P2P-VPN 
 set pfs group2
 match address NC-VPN-ACL
!
!
!
interface FastEthernet0/0
no ip address
 no ip redirects
 no ip unreachables
 ip route-cache flow
 duplex full
 speed 100
 no cdp enable
!
interface FastEthernet0/0.147
 description ### Internet Connection ###
 encapsulation dot1Q 147 native
 ip address 216.xxx.xxx.142 255.255.255.252
 ip access-group INTERNET_IN_ACL in
 ip verify unicast source reachable-via rx allow-default 100
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nbar protocol-discovery
 ip nat outside
 ip virtual-reassembly
 no snmp trap link-status
 crypto map VPN_MAP
!
interface FastEthernet0/0.389
 description ### TLS to Cambridge ###
 encapsulation dot1Q 389
 ip address 10.66.64.1 255.255.255.0
 no ip redirects
 ip nbar protocol-discovery
 ip inspect INTERNET in
 ip nat inside
 ip virtual-reassembly
 ip tcp adjust-mss 1400
 no snmp trap link-status
!
interface FastEthernet0/1
 no ip address
 ip nat inside
 ip virtual-reassembly
 shutdown
 duplex full
 speed 100
!
interface FastEthernet0/1/0
 description *** WDF-LAN ***
 switchport access vlan 192
 spanning-tree portfast
!
interface FastEthernet0/1/1
 description *** WDF-LAN ***
 switchport access vlan 192
 spanning-tree portfast
!
interface FastEthernet0/1/2
 description *** WDF-LAN ***
 switchport access vlan 192
 spanning-tree portfast
!
interface FastEthernet0/1/3
 description *** WDF-LAN ***
 switchport access vlan 192
 spanning-tree portfast
!
interface FastEthernet0/1/4
 description *** WDF-LAN ***
 switchport access vlan 192
 spanning-tree portfast
!
interface FastEthernet0/1/5
 description *** WDF-LAN ***
 switchport access vlan 192
 spanning-tree portfast
!
interface FastEthernet0/1/6
 description *** WDF-LAN ***
 switchport access vlan 192
 spanning-tree portfast
!
interface FastEthernet0/1/7
 description *** WDF-LAN ***
 switchport access vlan 192
 spanning-tree portfast
!
interface FastEthernet0/1/8
 description *** WDF-LAN ***
 switchport access vlan 192
 spanning-tree portfast
!
interface Vlan1
 no ip address
!
interface Vlan147
 no ip address
 ip mtu 1400
!
interface Vlan192
 description *** WDF-LAN ***
 ip address 10.66.192.1 255.255.255.0
 no ip unreachables
 no ip proxy-arp
 ip inspect INTERNET in
 ip nat inside
 ip virtual-reassembly
 ip tcp adjust-mss 1400
 no snmp trap link-status
!
ip classless
ip route 0.0.0.0 0.0.0.0 216.xxx.xxx.141 name INTERNET
ip route 10.66.16.0 255.255.240.0 10.66.64.2 name Cam-LAN
ip route 10.66.32.0 255.255.224.0 10.66.64.2 name Cam-VM-INF
ip route 10.66.192.0 255.255.192.0 10.66.192.2 permanent name DRP-VM
!
no ip http server
no ip http secure-server
ip nat inside source route-map USER_OVERLOAD interface FastEthernet0/0.147 overload
ip nat inside source static 10.66.30.8 216.xxx.xxx.32 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.9 22 216.xxx.xxx.33 22 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.9 25 216.xxx.xxx.33 25 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.2 80 216.xxx.xxx.33 80 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.2 110 216.xxx.xxx.33 110 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.2 143 216.xxx.xxx.33 143 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.55 22 216.xxx.xxx.33 222 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.2 443 216.xxx.xxx.33 443 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.2 993 216.xxx.xxx.33 993 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.2 995 216.xxx.xxx.33 995 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.192.5 22 216.xxx.xxx.33 2222 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.30.6 22 216.xxx.xxx.34 22 route-map USER_OVERLOAD extendable
ip nat inside source static tcp 10.66.30.6 3389 216.xxx.xxx.34 3389 route-map USER_OVERLOAD extendable
ip nat inside source static 10.66.50.100 216.xxx.xxx.35 route-map 1-1-NAT-RM extendable
ip nat inside source static 10.66.30.7 216.xxx.xxx.36 route-map 1-1-NAT-RM extendable
ip nat inside source static 10.66.30.9 216.xxx.xxx.37 route-map 1-1-NAT-RM extendable
ip nat inside source static 10.66.192.5 216.xxx.xxx.38 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.50.90 80 216.xxx.xxx.39 80 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.50.90 110 216.xxx.xxx.39 110 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.50.90 143 216.xxx.xxx.39 143 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.50.90 443 216.xxx.xxx.39 443 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.50.90 993 216.xxx.xxx.39 993 route-map 1-1-NAT-RM extendable
ip nat inside source static tcp 10.66.50.90 995 216.xxx.xxx.39 995 route-map 1-1-NAT-RM extendable
!
ip access-list standard MGMT_ACL
 remark ######### Management ACL ###################
 permit 216.xxx.xxx.189 log
 permit 216.xxx.xxx.141 log
 permit 10.66.0.0 0.0.255.255 log
 permit 192.168.7.0 0.0.0.255
 permit any
ip access-list standard SSH_ACL
 permit any log
!
ip access-list extended ACL-1-1-NAT
 remark ##### ACL for 1-1 STATIC NAT TRANSLATIONS #####
 remark ### No NAT for VPN connections
 deny   ip 10.66.0.0 0.0.255.255 192.168.7.0 0.0.0.255
 remark ### SERVERS THAT ARE 1-1 NAT
 permit ip host 10.66.30.2 any
 permit ip host 10.66.30.7 any
 permit ip host 10.66.30.8 any
 permit ip host 10.66.30.9 any
 permit ip host 10.66.30.55 any
 permit ip host 10.66.50.90 any
 permit ip host 10.66.50.100 any
 permit ip host 10.66.192.5 any
 permit ip host 172.16.1.1 any
 remark ### BLOCK ALL OTHERS
 deny   ip any any
ip access-list extended ACL_NAT_PAT
 remark ### NATTING FOR PORTS
ip access-list extended ACL_USER_OVERLOAD
 remark ##### NO NAT ACL #####
 remark ### No NAT for VPN connections
 deny   ip 10.66.0.0 0.0.255.255 192.168.7.0 0.0.0.255
 remark ### No NAT for Servers
 deny   ip host 10.66.30.2 any
 deny   ip host 10.66.30.7 any
 deny   ip host 10.66.30.8 any
 deny   ip host 10.66.50.90 any
 deny   ip host 10.66.50.100 any
 deny   ip host 10.66.192.5 any
 remark ### Nat two PAT'd servers & everything else
 permit ip 10.66.0.0 0.0.255.255 any
ip access-list extended INTERNET_IN_ACL
 remark ############### INBOUND ACL ########################
 remark *****   Standard Anti-spoof restrictions
 deny   ip 192.168.0.0 0.0.255.255 any log-input
 deny   ip 172.16.0.0 0.15.255.255 any log-input
 deny   ip 10.0.0.0 0.255.255.255 any log-input
 deny   ip 127.0.0.0 0.255.255.255 any log-input
 deny   ip 255.0.0.0 0.255.255.255 any log-input
 deny   ip 224.0.0.0 31.255.255.255 any log-input
 deny   ip host 0.0.0.0 any log-input
 remark *****   MGMT ACCESS
 permit tcp host 216.xxx.xxx.189 host 216.xxx.xxx.142 eq telnet
 permit tcp host 216.xxx.xxx.141 host 216.xxx.xxx.142 eq telnet
 permit tcp any host 216.xxx.xxx.142 eq 22
 remark *****   ICMP FROM INTERNET
 permit icmp host 216.xxx.xxx.141 any
 permit icmp host 66.xxx.xxx.228 any
 deny   icmp any any
 remark *****   ALLOW P2P VPN CONNECTIONS IN
 permit udp host 66.xxx.xxx.228 host 216.xxx.xxx.142 eq isakmp
 permit udp host 74.xxx.xxx.210 host 216.xxx.xxx.142 eq isakmp
 permit esp host 66.xxx.xxx.228 host 216.xxx.xxx.142
 permit esp host 74.xxx.xxx.210 host 216.xxx.xxx.142
 remark *****   ALLOW CONNECTIONS TO SERVERS
 remark ** MAIL SERVER
 permit tcp any host 216.xxx.xxx.33 eq smtp
 permit tcp any host 216.xxx.xxx.33 eq pop3
 permit tcp any host 216.xxx.xxx.33 eq 143
 permit tcp any host 216.xxx.xxx.33 eq www
 permit tcp any host 216.xxx.xxx.33 eq 443
 permit tcp any host 216.xxx.xxx.33 eq 993
 permit tcp any host 216.xxx.xxx.33 eq 995
 permit tcp any host 216.xxx.xxx.33 eq 22
 permit tcp any host 216.xxx.xxx.33 eq 222
 permit tcp any host 216.xxx.xxx.33 eq 2222
 remark ** MAIL SERVER INTERFACE 2
 permit tcp any host 216.xxx.xxx.39 eq smtp
 permit tcp any host 216.xxx.xxx.39 eq pop3
 permit tcp any host 216.xxx.xxx.39 eq 143
 permit tcp any host 216.xxx.xxx.39 eq 443
 permit tcp any host 216.xxx.xxx.39 eq 993
 permit tcp any host 216.xxx.xxx.39 eq 995
 permit tcp any host 216.xxx.xxx.39 eq www
 remark ** TS
 permit tcp any host 216.xxx.xxx.34 eq 3389
 remark ** NXS
 permit tcp any host 216.xxx.xxx.34 eq 22
 remark ** Jabber
 permit tcp any host 216.xxx.xxx.36 eq 5222
 permit tcp any host 216.xxx.xxx.36 eq 5223
 permit tcp any host 216.xxx.xxx.36 eq 5269
 remark ** VPN SERVER 1 - OPENVPN
 permit tcp any host 216.xxx.xxx.35 eq 1194
 remark ** VPN SERVER 2 - WINDOWS PPTP
 permit gre any host 216.xxx.xxx.32
 permit tcp any host 216.xxx.xxx.32 eq 1723
 remark ** WEB Server
 permit tcp any host 216.xxx.xxx.37 eq www
 permit tcp any host 216.xxx.xxx.37 eq 443
 remark ** DNS Server
 permit tcp any host 216.xxx.xxx.38 eq domain
 permit udp any host 216.xxx.xxx.38 eq domain
 remark ***** DENY ALL OTHER TRAFFIC
 deny   ip any any log
ip access-list extended NC-VPN-ACL
 remark ##### ACL FOR TRAFFIC THROUGH NC VPN #####
 permit ip 10.66.0.0 0.0.255.255 192.168.7.0 0.0.0.255
!
logging trap debugging
logging facility local2
logging source-interface FastEthernet0/0.389
logging 192.168.7.139
snmp-server community public RO
snmp-server location DRP_Waterloo
route-map USER_OVERLOAD permit 10
 match ip address ACL_USER_OVERLOAD
!
route-map 1-1-NAT-RM permit 10
 match ip address ACL-1-1-NAT
!
!
!
control-plane
!
!
!
line con 0
 exec-timeout 5 0
 login authentication local_auth
 transport output telnet
line aux 0
 exec-timeout 15 0
 login authentication local_auth
 modem InOut
 transport output telnet
 stopbits 1
 speed 115200
 flowcontrol hardware
line vty 0 4
 access-class MGMT_ACL in
 login authentication local_auth
 transport input telnet ssh
line vty 5 10
 exec-timeout 15 0
 login authentication local_auth
 transport input telnet ssh
!
scheduler allocate 20000 1000
!
end