[es] - Cisco acl

smadzara

Član broj: 44254
Poruke: 23
213.191.149.*

Profil

^{17.07.2009. u 10:06 - pre 179 meseci}

kad maknem echo, i postavim ACL na FastEth4, prolazi u oba smjera...

Code:

version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname usmjernik
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging message-counter syslog
logging buffered 51200
logging console critical
enable secret 5 $1$E7AJ$hLxxxxxxxxxxxxxxxxxxxxx
!
no aaa new-model
clock timezone PCTime 1
clock summer-time PCTime date Mar 30 2003 2:00 Oct 26 2003 3:00
!
crypto pki trustpoint TP-self-signed-3416054996
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-3416054996
revocation-check none
rsakeypair TP-self-signed-3416054996
!
!
crypto pki certificate chain TP-self-signed-3416054996
certificate self-signed 01
  3082024F 308201B8 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
  69666963 6174652D 33343136 30353439 3936301E 170D3039 30373137 30373135
  30315A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 34313630
  35343939 3630819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
  81009B4A ABA276AC 1BBA97D0 D85CB578 08ABFD55 90119323 453ED336 D8246C76
  46C9FEC7 465D2F9F 09342A72 3B0DF6EA 4612BB27 95B441F8 D8820C46 DFB8BD3B
  86A7BB2E B419C65A A28888B2 46362EE1 E2E0D21C 28305B5C 5D347499 993FE368
  9D70A936 CC779C6F 518FCA64 BC3D082C 87F8ECB5 13AA4C8A 981C5C98 6290A92A
  1D6F0203 010001A3 77307530 0F060355 1D130101 FF040530 030101FF 30220603
  551D1104 1B301982 17796F75 726E616D 652E796F 7572646F 6D61696E 2E636F6D
  301F0603 551D2304 18301680 1434612F 8A1D6FCD FE294D86 4B2FF8D7 95F0D27A
  F3301D06 03551D0E 04160414 34612F8A 1D6FCDFE 294D864B 2FF8D795 F0D27AF3
  300D0609 2A864886 F70D0101 04050003 81810099 57CCE189 9D53C519 702C9E03
  C2DF3960 46750314 502BA322 4B211D9A E533C7A8 5BB43992 470E7BB1 827C2C2A
  5F4F8967 124C5179 8E2D9735 8BA4DD60 CAF1EF50 65D3AF62 85EAA2C4 C3A737E3
  E45F2EEA 01332DE6 FD4BA305 157A7846 E72DF314 55D575C0 596E0337 7E5B181D
  2755B435 5ED8EA86 4761119E 2CB0342D 2D038A
      quit
no ip source-route
!
!
ip cef
no ip bootp server
ip domain name yourdomain.com
ip name-server 213.191.xxx.x
ip name-server 213.191.xxx.x
!
!
!
!
username xxxxxx
!
!
!
archive
log config
  hidekeys
!
!
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description $FW_OUTSIDE$$ES_WAN$$ETH-WAN$
ip address 213.191.xxx.xxx 255.255.255.252
ip access-group 115 out
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
ip address 192.168.xxx.xxx 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 FastEthernet4
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip nat inside source list 1 interface FastEthernet4 overload
!
ip access-list extended Trafic-to-Internet
deny   icmp any any echo-reply
deny   icmp any any echo
permit ip any any
!
logging trap debugging
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 192.168.xxx.xxx 0.0.0.255
access-list 115 remark CCP_ACL Category=17
access-list 115 deny   icmp any any echo
access-list 115 permit ip any any
snmp-server community xxxxxxx RW
no cdp run

!
!
!
!
control-plane
!
banner exec ^C
-----------------------------------------------------------------------

AAAAAAAAA

-----------------------------------------------------------------------
^C
banner login ^CAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
login local
no modem enable
transport output telnet
line aux 0
login local
transport output telnet
line vty 0 4
privilege level 15
login local
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end

Odgovor na temu

optix
CH

SuperModerator
Član broj: 7009
Poruke: 1867
*.dynamic.swissvpn.net.

+101 Profil

Re: Cisco acl - icmp

^{17.07.2009. u 12:19 - pre 179 meseci}

Mora videti neku javnu IP adresu sa koje pristupas.
Ako si prvu poruku na ovoj temi napisao od kuce, pogledaj levo, ispod svog nick-a, nalazi se *.zg.x3d.CARNet.hr stim da korisnici na forumu naravno ne vide celu IP adresu, ali je dostupna npr. moderatorima...

Citat:

Na sto konkretno mislis?

Evo npr. na samom ruteru ti je za remote management javno dostupan telnet, ssh, http server i https server. Nema potrebe; ako ti uopste treba remote management dovoljno je da ostavis ssh, i/ili eventualno https. Inace mozes da log-ujes pakete koji dolaze na telnet recimo, i posle nekog vremena videces bujicu brute force pokusaja da se otkrije username i sifra za pristup... Dobro ako i provali, opet mora nekako dobiti i enable sifru (osim ako username vec nije nivoa 15), ali opet...

Onda, ono na sta sam mislio je da ukoliko imas podignut neki server na racunarima iza rutera, i dostupan je preko internet-a, bitno je njega osigurati najnovijim zakrpama, pogasiti nepotrebne servise itd. To je nacin na koji se moze kompromitovati mreza...

_{[Ovu poruku je menjao optix dana 17.07.2009. u 19:55 GMT+1]}

"99% of your thought process is protecting your self-conceptions,
and 98% of that is wrong."

Odgovor na temu