EA4500 Max number of Port forwards

Hi All,
Background: currently have a WRT320N, thinking of upgrading to an EA4500 assuming ONE feature has been improved: Port Forwarding.
Scenario: Currently I have a WRT320N router, and while it "does everything we need" it has one limitation that is now getting in the way: limitation on number of forwardable ports.  In the port forwarding panel, it has 15 total rows: the first five rows can be enabled for specificaly named services (SMTP, FTP, etc).  The last 10 rows are fully customizable in that we can set the name, ports and protocol. 
The problem is that of the 13 total ports I currently need to forward, only ONE of them is listed in that fixed list.  So, sadly, I can only use one of those first five rows.  I've now filled the remaining ten custom rows, and still have need for two additional ports (for now, may need more down the road).
Trying to get creative, I figured maybe I could just spill over to the Port Range Forwarding page and add a row or two there.  The only problem: it's buggy.  I've found that if the Single Port Forwarding list is filled, then the Port Forwarding Range entries don't work properly.  For example, if I wanted ports 12345 and 12346 forwarded to 192.168.1.5, they work fine with two single port forwarding entries.  However, if I delete those, add two other port lines I need forwarded (the single list being full again), and add a port forwarding range 12345..12346, they don't work properly, ports just are closed. Only the singles work, the ranges don't.
Question: Has the EA4500 resolved this issue and allow for either more lines (i.e. 20 customizable entries instead of 10), or, better, does it just have an [Add Entry] button to allow for additional rows to be created?  In today's day and age, where one single device (such as an Xbox) can take four rows, a 10-row limit is pretty sparse.  Comparing it to some competitors, for example the D-Link DIR-825 (aging, but still great) allows you to add as many as you want.
I realize "expensive" firewalls like SonicWall's have virtually unlimited customization, but I don't need many of the additional features and don't want to spend $350 on a "high-end" firewall to solve the problem of needing two more ports open.
Thanks to any help you can give!
-Dan
Solved!
Go to Solution.

If it is of any value, you can view the EA4500's GUI here to have a feel of the Admin Interface.
http://ui.linksys.com/files/EA4500/2.0.36/
The Search Function is your friend.... and Google too.
How to Secure your Network
How to Upgrade Routers Firmware
Setting-Up a Router with DSL Internet Service
Setting-Up a Router with Cable Internet Service
How to Hard Reset or 30/30/30 your Router

Similar Messages

  • Two web servers cant use same port forwarding rule???

    I have two web servers, each configured to respond to http reqests on port 80.  I use NoIP service to map a domain name to my router. I create a port forwarding assignment for Server A by selecting the WebServer rule in the port forwarding rule table.  All is fine.  For Server B, I select the same Webserver rule and the router says there is a conflict.
    I don't understand why.  I think the router has enough information to route a http request for Server B by knowing its MAC address, which is different than Server A MAC address.
    What am I missing here???
    I was able to do this on my previous router with DD-WRT.....
    So it would appear the way to resolve this is to assign a different port address to Server B???
    grrrrrrrrrr I hate this router

    You shouldn't have been able to do that on any router.  You have to change the listening port of server 2, to 8080 or something like that, or make one a secure server and run it over 443
    That is a known issue with port forwarding
    Problem #8:
    Same Port in Multiple Rules
    There are some routers such as Linksys, D-Link and many others that do not do any checks if a port is already in another port forwarding rule. A port can only be forwarded to one Computer/IP at a time. So when there are multiples of the same port number the port forwarding rule will not work.
    Here is an example.
    As you can see port 2350 is in 2 rules. The 1st one points to a different IP than that of the 2nd rule. So the router will honor the 1st rule and the 2nd port forwarding rule to port 2350 fails.
    By removing the 1st rule the 2nd one will now work.

  • Combo unix ssh port forwarding + iChatAV + Bonjour question

    I don't know which forum is best for this question, so thought I'd try here first.
    I've been tossing around the idea of picking up a couple of iSights and running iChatAV. Problem is, if I understand this correctly, iChatAV uses a couple of ports for connections to third-party servers: AOL buddy server or Jabber server, a port for something called snatmap, a port for SIP, and some other stuff. Plus, it requires that you open up nearly 20 ports on your network for the AV traffic! (I get nervous just having my non-standard ports for smtp and ssh open, and my imaps port open (which is another issue -- anybody know how to change imaps port 993 to a non-standard port if running uw-imap server?) It doesn't look like iChatAV can, normally, operate by "calling up" an IP address or hostname...it always has to set up calls using AOL or Jabber...unless, perhaps, the destination iSight/iChatAV is on your own Bonjour-capable subnet.
    So, I'm thinking, what if a calling party created a ssh tunnel and port-forwarded the dozens of UDP and couple of TCP ports over a ssh tunnel, as a lengthy list of port forward options like "-L 5297:localhost:5297 -L ...", (assuming that the forwarding host, to whom the caller ssh's, is the same computer that is running iChatAV, hence, the remote host specification in the "-L" option of "localhost"). Would the caller then be able to treat the connection like Bonjour networking and when he calls localhost on his end of the circuit, it "bonjours" to the called hostname's localhost and thus a peer-to-peer connection would be made?
    Or perhaps a reverse port forward tunnel ("-R" options) could be set up in advance by the "to-be-called" party, and then the calling party initiates a iChatAV call as a "same-subnet-as-calling-computer-via-Bonjour" type of call?
    I'm just kicking around some thoughts here; I don't know enough about the intricacies of iChatAV and Bonjour (and ssh) to really know all the "gotchas" and I'd like to get the planning done with a high degree of confidence of success before I plunk out $300 on two iSights.
    If the general concensus of the group moderator and others on this forum is that this question should be posted in another forum, I apologize, and I'll move, but I thought that the ssh tunneling nature of my inquiry (and my unrelated side question about how to change 993 to a non-standard port) made this forum the obvious, and best, choice.
    Thanks in advance for any thoughts on these issues!
    2001 Quicksilver G4   Mac OS X (10.4.5)  

    No, you can't do what you describe. You have to use port forwarding on the router for any incoming connections, and each port forward rule can only map to a single server/service.
    However, SSH has the ability to tunnel other connections, so it may be possible to remove one or more of the existing port forwarding rules and replace them with a SSH rule, then use SSH tunneling to get to those services. Of course, this will only work for services that only you (or other authorized users) need to access, and not public services such as web/http traffic (assuming you're running a public web site).
    The only other option would be to replace your router with one that doesn't have such a strict limit on the number of port forwarding rules.

  • Need more than 10 ports forwarded...any way??

    Is there a way to increase the number of port forwards allowed in theWRT54G?
    We have 15 computers that need access to port 4899 in the RAdmin remote access. Is there something I can do to gain more than 10 ip addresses access to this port .... like a ip range?
    Thanks in advance.
    Dennis

    No. Forwarding can be used only for 1 PC, in situation where you need to forward any particular traffic to particular terminal, such any servers. If you need to allow multiple Pc to access any particular traffic then you may trigger the port instead.

  • Maximum port forwarding rules in RVS4000 ?

    Hello,
    I'm wondering if there is a maximum number of port forwarding rule in the RVS4000.
    I can't find this information in the specs.
    Thanks in advance.

    great. so the better question is WHY is there a maxium? i need to set up many rules in my SMALL BUSINESS environment. this stupid sh!t is costing me A LOT OF MONEY

  • More Port Forwarding Options

    I have a WRT300N.
    I have used up all the single port forwarding options.
    I have used up all the port range forwarding options.
    What is left, i still need more options.
    Is there a way to expand the amount of port forwarding options?

    Wich version of the 300N? DD-WRT firmware is supported on V1 with V2 support as a work-in-progress. The firmware allows a much larger number of port forwarding entries to be configured.
    Tomato 1.25vpn3.4 (SgtPepperKSU MOD) on a Buffalo WHR-HP-G54
    D-Link DSM-320 (Wired)
    Wii (Wireless) - PS3 (Wired), PSP (Wireless) - XBox360 (Wired)
    SonyBDP-S360 (Wired)
    Linksys NSLU2 Firmware Unslung 6.10 Beta unslung to a 2Gb thumb, w/1 Maxtor OneTouch III 200Gb
    IOmega StorCenter ix2 1TB NAS
    Linksys WVC54G w/FW V2.12EU
    and assorted wired and wireless PCs and laptops

  • EA4500 port forwarding - Port 21 works, no other ports seem to work!! Help!!!

    I have set up my Internet Connection for Port Forwarding - I have a Bell Modem and an Linksys EA4500.
    FTP (21) works, but HTTP (80) doesn't.
    Does anyone have suggestions on why I can't get HTTP to work?
    Internet -> 70.xx.xx.xx -> Bell Modem -> 192.168.2.1 -> 192.168.2.2 -> Linksys -> 192.168.1.1 -> Computer 192.168.1.6
    Since FTP is working I'm pretty sure I've set up Port Forwarding with 2 Routers properly.
    I know my IIS Server is running because I can see the web page locally - when I stop the IIS Server I don't see the web page.  Same is true for FTP.
    Also trying to get 3389 - Remote Desktop connection - to work.
    Have tried DMZ on and off, Single Port Forwarding and Port Range Forwarding but can ONLY get FTP to work.  Have also tried Static IP on Internet Settings, Turned off IPV4 SPI Firewall Protection, etc. So frustrated!!!
    Any help would be greatly appreciated!!!

    Bridge mode instructions:
    http://kb.linksys.com/Linksys/GetArticle.aspx?docid=28cee6a2fb0d4176a2210942d1d5836c_Setting_up_the_...

  • Port Forward with EA4500 Cloud connect firmware

    Installed my new EA4500 and trying to access my PC from internet (remote desktop) in order to do so I need to forward the TCP port 3389.  In the old web admin page this option was easy to find and change.  with the new cloud connect I can't find it.  how do Ienable port forwarding on the EA4500?  thanks

    You can find port forwarding under Security. click on the "Security" icon on the left hand panel then it will open another window and there you will be able to select "APPS and GAMING" and that's where you can find Port Range Forwarding.

  • What's the max number of E1 on 3845 and max number of E3 ports ?

    kindly support me witjh the refrences that provide max number of E1's on 3845 and number of E3?

    “Thank you for your question.  This community is for Cisco Small Business products and your question is in reference to a Cisco Elite/Classic product.  Please post your question in the Cisco NetPro forums located here: http://forums.cisco.com/eforum/servlet/NetProf?page=main  This forum has subject matter experts on Cisco Elite/Classic products that may be able to answer your question.”

  • Please Help - Only Some Port Forwards Working

    Hi all,
    I have the most annoying issue with a Cisco 887VA-K9 port forwarding. Some port work while other don’t and I just can’t see why, however I suspect it is a zone based firewall (ZBF) issue.
    Port forwards on the follow ports all work fine:
    External port 8021 to 192.168.4.253 on port 80 works
    External port 8022 to 192.168.4.253 on port 8022 works
    All the rest don’t. I also have SIP phones sitting outside the LAN which are unable to register through the internet with the PBX unit which is in the DMZ network 192.168.4..0
    Any help would be great appreciated as this sending me mad. Fully running config below.
    Louise ;-)
    Building configuration...
    Current configuration : 36870 bytes
    ! Last configuration change at 12:49:03 Magadan Fri Nov 8 2013 by cpadmin
    version 15.1
    no service pad
    service tcp-keepalives-in
    service tcp-keepalives-out
    service timestamps debug datetime msec localtime show-timezone
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    service sequence-numbers
    hostname QQQ_ADSL_Gateway
    boot-start-marker
    boot-end-marker
    security authentication failure rate 3 log
    security passwords min-length 6
    logging buffered 64000
    enable secret 4 gim.lMOdQK/21R4Wu.QJfOMAv3CIkRyN.hbSTG5xAxE
    aaa new-model
    aaa authentication login local_authen local
    aaa authentication login ciscocp_vpn_xauth_ml_1 local
    aaa authorization exec local_author local
    aaa authorization network ciscocp_vpn_group_ml_1 local
    aaa session-id common
    memory-size iomem 10
    clock timezone Magadan 11 0
    crypto pki token default removal timeout 0
    crypto pki trustpoint TP-self-signed-3471381936
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-3471381936
    revocation-check none
    rsakeypair TP-self-signed-3471381936
    crypto pki trustpoint test_trustpoint_config_created_for_sdm
    subject-name [email protected]
    revocation-check crl
    crypto pki certificate chain TP-self-signed-3471381936
    certificate self-signed 01
      3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 33343731 33383139 3336301E 170D3132 30373132 31313332
      34375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 34373133
      38313933 3630819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100AB76 5F7EE03F 306F52A0 91E82E04 7A69528D 1839409C 55BCC55A 47F180A9
      7B522E9B FBB96A32 715178FE B96B737E 788947A4 CF4791AA 15609E37 A3F66F07
      AD1B8A34 A2877711 E33A613D 8E50AE40 A106DE9C B2B03B95 73392ADB 4BB51FAD
      6F2D6F8D A90BA0B5 BD1A209C F54126A9 2E2FF5B7 85041B7E C72032C0 CECE7F79
      51550203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
      551D2304 18301680 141713AB B7F927E5 50C242DF 9912C3B6 61D93313 80301D06
      03551D0E 04160414 1713ABB7 F927E550 C242DF99 12C3B661 D9331380 300D0609
      2A864886 F70D0101 05050003 81810099 8EBE5630 2E6734A8 4D2FD0A5 F09A98F8
      9E49125F AECEF4BB E0DEBB3A 1A449E38 99B02114 7EC84845 B53C2F88 046B7290
      AE44967A 8BE20F5E 9D4A1CFC E1F64FE8 59F51892 23B88B4E 3416808A 68E65660
      644C7DA0 E3A7A525 14FE8E54 67C35F8E CF69EB40 34DFB13D EA302F66 102C822A
      3D7107BA AA4E7273 1D43690E C4A5D4
                    quit
    crypto pki certificate chain test_trustpoint_config_created_for_sdm
    no ip source-route
    ip dhcp excluded-address 192.168.0.230 192.168.0.255
    ip dhcp excluded-address 192.168.0.1 192.168.0.200
    ip dhcp pool QQQ_LAN
    import all
    network 192.168.0.0 255.255.255.0
    default-router 192.168.0.254
    dns-server 192.168.0.6 202.1.161.36
    netbios-name-server 192.168.0.6
    domain-name QQQ.Local
    lease 3
    ip cef
    no ip bootp server
    ip domain name QQQ.Local
    ip name-server 192.168.0.6
    ip name-server 202.1.161.37
    ip name-server 202.1.161.36
    ip inspect log drop-pkt
    no ipv6 cef
    parameter-map type inspect global
    log dropped-packets enable
    parameter-map type protocol-info yahoo-servers
    server name scs.msg.yahoo.com
    server name scsa.msg.yahoo.com
    server name scsb.msg.yahoo.com
    server name scsc.msg.yahoo.com
    server name scsd.msg.yahoo.com
    server name cs16.msg.dcn.yahoo.com
    server name cs19.msg.dcn.yahoo.com
    server name cs42.msg.dcn.yahoo.com
    server name cs53.msg.dcn.yahoo.com
    server name cs54.msg.dcn.yahoo.com
    server name ads1.vip.scd.yahoo.com
    server name radio1.launch.vip.dal.yahoo.com
    server name in1.msg.vip.re2.yahoo.com
    server name data1.my.vip.sc5.yahoo.com
    server name address1.pim.vip.mud.yahoo.com
    server name edit.messenger.yahoo.com
    server name messenger.yahoo.com
    server name http.pager.yahoo.com
    server name privacy.yahoo.com
    server name csa.yahoo.com
    server name csb.yahoo.com
    server name csc.yahoo.com
    parameter-map type protocol-info aol-servers
    server name login.oscar.aol.com
    server name toc.oscar.aol.com
    server name oam-d09a.blue.aol.com
    parameter-map type protocol-info msn-servers
    server name messenger.hotmail.com
    server name gateway.messenger.hotmail.com
    server name webmessenger.msn.com
    password encryption aes
    license udi pid CISCO887VA-K9 sn FGL162321CT
    object-group service MAIL-PORTS
    description QQQ User Mail Restrictions
    tcp eq smtp
    tcp eq pop3
    tcp eq 995
    tcp eq 993
    udp lt rip
    udp lt domain
    tcp eq telnet
    udp lt ntp
    udp lt tftp
    tcp eq ftp
    tcp eq domain
    tcp eq 5900
    tcp eq ftp-data
    tcp eq 3389
    tcp eq 20410
    object-group network Network1
    description QQQ Management Network
    192.168.1.0 255.255.255.0
    192.168.4.0 255.255.255.0
    192.168.5.0 255.255.255.0
    192.168.7.0 255.255.255.0
    192.168.8.0 255.255.255.0
    range 192.168.0.200 192.168.0.254
    range 192.168.0.1 192.168.0.25
    object-group network Network2
    description QQQ User Network
    192.168.2.0 255.255.255.0
    192.168.3.0 255.255.255.0
    192.168.6.0 255.255.255.0
    range 192.168.0.26 192.168.0.199
    object-group network QQQ.Local
    description QQQ_Domain
    192.168.0.0 255.255.255.0
    192.168.1.0 255.255.255.0
    192.168.2.0 255.255.255.0
    192.168.3.0 255.255.255.0
    192.168.4.0 255.255.255.0
    192.168.5.0 255.255.255.0
    192.168.6.0 255.255.255.0
    192.168.8.0 255.255.255.0
    192.168.7.0 255.255.255.0
    192.168.10.0 255.255.255.0
    10.1.0.0 255.255.0.0
    object-group network QQQ_Management_Group
    description QQQ I.T. Devices With UnRestricted Access
    range 192.168.0.200 192.168.0.254
    range 192.168.0.1 192.168.0.25
    192.168.1.0 255.255.255.0
    192.168.8.0 255.255.255.0
    192.168.7.0 255.255.255.0
    192.168.5.0 255.255.255.0
    192.168.4.0 255.255.255.0
    10.1.0.0 255.255.0.0
    192.168.10.0 255.255.255.0
    10.8.0.0 255.255.255.0
    192.168.9.0 255.255.255.0
    192.168.100.0 255.255.255.0
    192.168.20.0 255.255.255.0
    192.168.21.0 255.255.255.0
    192.168.22.0 255.255.255.0
    192.168.23.0 255.255.255.0
    object-group network QQQ_User_Group
    description QQQ I.T. Devices WIth Restricted Access
    range 192.168.0.26 192.168.0.199
    192.168.2.0 255.255.255.0
    192.168.3.0 255.255.255.0
    192.168.6.0 255.255.255.0
    object-group service WEB
    description QQQ User Web Restrictions
    tcp eq www
    tcp eq 443
    tcp eq 8080
    tcp eq 1863
    tcp eq 5190
    username cpadmin privilege 15 password 7 1406031A2C172527
    username QQQVPN privilege 15 secret 4 Hk2tP2GgJ1xXtJUqIZr4gmNSgw6q1E.rvzWiYnDAZHU
    controller VDSL 0
    ip tcp synwait-time 10
    no ip ftp passive
    class-map type inspect match-all sdm-cls-VPNOutsideToInside-1
    match access-group 118
    class-map type inspect match-all sdm-cls-VPNOutsideToInside-3
    match access-group 121
    class-map type inspect match-all sdm-cls-VPNOutsideToInside-2
    match access-group 120
    class-map type inspect imap match-any ccp-app-imap
    match  invalid-command
    class-map type inspect match-any ccp-cls-protocol-p2p
    match protocol edonkey signature
    match protocol gnutella signature
    match protocol kazaa2 signature
    match protocol fasttrack signature
    match protocol bittorrent signature
    class-map type inspect match-all sdm-cls-VPNOutsideToInside-4
    match access-group 122
    class-map type inspect match-all SDM_GRE
    match access-group name SDM_GRE
    class-map type inspect match-any CCP_PPTP
    match class-map SDM_GRE
    class-map type inspect match-any SDM_AH
    match access-group name SDM_AH
    class-map type inspect match-any ccp-skinny-inspect
    match protocol skinny
    class-map type inspect match-any SDM_ESP
    match access-group name SDM_ESP
    class-map type inspect match-any SDM_VPN_TRAFFIC
    match protocol isakmp
    match protocol ipsec-msft
    match class-map SDM_AH
    match class-map SDM_ESP
    class-map type inspect match-all SDM_VPN_PT
    match access-group 117
    match class-map SDM_VPN_TRAFFIC
    class-map type inspect match-any ccp-cls-insp-traffic
    match protocol pptp
    match protocol dns
    match protocol ftp
    match protocol https
    match protocol icmp
    match protocol imap
    match protocol pop3
    match protocol netshow
    match protocol shell
    match protocol realmedia
    match protocol rtsp
    match protocol smtp
    match protocol sql-net
    match protocol streamworks
    match protocol tftp
    match protocol vdolive
    match protocol tcp
    match protocol udp
    class-map type inspect match-all ccp-insp-traffic
    match class-map ccp-cls-insp-traffic
    class-map type inspect match-any SDM_IP
    match access-group name SDM_IP
    class-map type inspect gnutella match-any ccp-app-gnutella
    match  file-transfer
    class-map type inspect match-any SDM_HTTP
    match access-group name SDM_HTTP
    class-map type inspect match-any SDM_EASY_VPN_SERVER_TRAFFIC
    match protocol isakmp
    match protocol ipsec-msft
    match class-map SDM_AH
    match class-map SDM_ESP
    class-map type inspect match-all SDM_EASY_VPN_SERVER_PT
    match class-map SDM_EASY_VPN_SERVER_TRAFFIC
    class-map type inspect match-all sdm-cls-http
    match access-group name dmz-traffic
    match protocol http
    class-map type inspect match-any Telnet
    match protocol telnet
    class-map type inspect msnmsgr match-any ccp-app-msn-otherservices
    match  service any
    class-map type inspect ymsgr match-any ccp-app-yahoo-otherservices
    match  service any
    class-map type inspect match-any ccp-h323nxg-inspect
    match protocol h323-nxg
    class-map type inspect match-any ccp-cls-icmp-access
    match protocol icmp
    match protocol tcp
    match protocol udp
    class-map type inspect match-any ccp-cls-protocol-im
    match protocol ymsgr yahoo-servers
    match protocol msnmsgr msn-servers
    match protocol aol aol-servers
    class-map type inspect aol match-any ccp-app-aol-otherservices
    match  service any
    class-map type inspect match-all ccp-protocol-pop3
    match protocol pop3
    class-map type inspect match-any ccp-h225ras-inspect
    match protocol h225ras
    class-map type inspect match-any FIREWALL_EXCEPTIONS_CLASS
    match access-group name FIREWALL_EXCEPTIONS_ACL
    class-map type inspect match-any ccp-h323annexe-inspect
    match protocol h323-annexe
    class-map type inspect match-any SDM_EASY_VPN_CTCP_SERVER_PT
    match access-group 102
    match access-group 103
    match access-group 104
    match access-group 105
    match access-group 106
    match access-group 107
    match access-group 108
    match access-group 109
    match access-group 110
    match access-group 111
    match access-group 112
    match access-group 113
    match access-group 114
    match access-group 115
    class-map type inspect match-any SIP
    match protocol sip
    class-map type inspect pop3 match-any ccp-app-pop3
    class-map type inspect match-any SDM_HTTPS
    match access-group name SDM_HTTPS
    class-map type inspect sip match-any ccp-cls-sip-pv-2
    match  protocol-violation
    class-map type inspect kazaa2 match-any ccp-app-kazaa2
    match  file-transfer
    class-map type inspect match-all ccp-protocol-p2p
    match class-map ccp-cls-protocol-p2p
    class-map type inspect match-all ccp-cls-ccp-permit-1
    match access-group name ETS1
    class-map type inspect match-any ccp-h323-inspect
    match protocol h323
    class-map type inspect msnmsgr match-any ccp-app-msn
    match  service text-chat
    class-map type inspect ymsgr match-any ccp-app-yahoo
    match  service text-chat
    class-map type inspect match-all ccp-cls-ccp-pol-outToIn-1
    match access-group name ETS
    class-map type inspect match-all ccp-protocol-im
    match class-map ccp-cls-protocol-im
    class-map type inspect match-all ccp-cls-ccp-pol-outToIn-2
    match class-map Telnet
    match access-group name Telnet
    class-map type inspect match-all ccp-icmp-access
    match class-map ccp-cls-icmp-access
    class-map type inspect match-all ccp-invalid-src
    match access-group 100
    class-map type inspect http match-any ccp-app-httpmethods
    match  request method bcopy
    match  request method bdelete
    match  request method bmove
    match  request method bpropfind
    match  request method bproppatch
    match  request method connect
    match  request method copy
    match  request method delete
    match  request method edit
    match  request method getattribute
    match  request method getattributenames
    match  request method getproperties
    match  request method index
    match  request method lock
    match  request method mkcol
    match  request method mkdir
    match  request method move
    match  request method notify
    match  request method options
    match  request method poll
    match  request method propfind
    match  request method proppatch
    match  request method put
    match  request method revadd
    match  request method revlabel
    match  request method revlog
    match  request method revnum
    match  request method save
    match  request method search
    match  request method setattribute
    match  request method startrev
    match  request method stoprev
    match  request method subscribe
    match  request method trace
    match  request method unedit
    match  request method unlock
    match  request method unsubscribe
    class-map type inspect match-any ccp-dmz-protocols
    match user-group qqq
    match protocol icmp
    match protocol http
    class-map type inspect edonkey match-any ccp-app-edonkey
    match  file-transfer
    match  text-chat
    match  search-file-name
    class-map type inspect match-any ccp-sip-inspect
    match protocol sip
    class-map type inspect match-all sdm-cls-sip
    match access-group name dmz-traffic
    match protocol sip
    class-map type inspect match-all ccp-dmz-traffic
    match access-group name dmz-traffic
    match class-map ccp-dmz-protocols
    class-map type inspect http match-any ccp-http-blockparam
    match  request port-misuse im
    match  request port-misuse p2p
    class-map type inspect edonkey match-any ccp-app-edonkeydownload
    match  file-transfer
    class-map type inspect match-all ccp-protocol-imap
    match protocol imap
    class-map type inspect aol match-any ccp-app-aol
    match  service text-chat
    class-map type inspect edonkey match-any ccp-app-edonkeychat
    match  search-file-name
    match  text-chat
    class-map type inspect match-all ccp-cls-ccp-permit-dmzservice-1
    match class-map SIP
    match access-group name SIP
    class-map type inspect fasttrack match-any ccp-app-fasttrack
    match  file-transfer
    class-map type inspect http match-any ccp-http-allowparam
    match  request port-misuse tunneling
    class-map type inspect match-all ccp-protocol-http
    match protocol http
    policy-map type inspect ccp-permit-icmpreply
    class type inspect ccp-icmp-access
      inspect
    class class-default
      pass
    policy-map type inspect p2p ccp-action-app-p2p
    class type inspect edonkey ccp-app-edonkeychat
      log
      allow
    class type inspect edonkey ccp-app-edonkeydownload
      log
      allow
    class type inspect fasttrack ccp-app-fasttrack
      log
      allow
    class type inspect gnutella ccp-app-gnutella
      log
      allow
    class type inspect kazaa2 ccp-app-kazaa2
      log
      allow
    policy-map type inspect PF_OUT_TO_IN
    class type inspect FIREWALL_EXCEPTIONS_CLASS
      pass
    policy-map type inspect PF_IN_TO_OUT
    class type inspect FIREWALL_EXCEPTIONS_CLASS
      pass
    policy-map type inspect im ccp-action-app-im
    class type inspect aol ccp-app-aol
      log
      allow
    class type inspect msnmsgr ccp-app-msn
      log
      allow
    class type inspect ymsgr ccp-app-yahoo
      log
      allow
    class type inspect aol ccp-app-aol-otherservices
      log
      reset
    class type inspect msnmsgr ccp-app-msn-otherservices
      log
      reset
    class type inspect ymsgr ccp-app-yahoo-otherservices
      log
      reset
    policy-map type inspect http ccp-action-app-http
    class type inspect http ccp-http-blockparam
      log
      reset
    class type inspect http ccp-app-httpmethods
      log
      reset
    class type inspect http ccp-http-allowparam
      log
      allow
    policy-map type inspect imap ccp-action-imap
    class type inspect imap ccp-app-imap
      log
    policy-map type inspect pop3 ccp-action-pop3
    class type inspect pop3 ccp-app-pop3
      log
    policy-map type inspect ccp-inspect
    class type inspect ccp-protocol-http
      inspect
      service-policy http ccp-action-app-http
    class type inspect ccp-protocol-imap
      inspect
      service-policy imap ccp-action-imap
    class type inspect ccp-protocol-pop3
      inspect
      service-policy pop3 ccp-action-pop3
    class type inspect ccp-protocol-p2p
      inspect
      service-policy p2p ccp-action-app-p2p
    class type inspect ccp-protocol-im
      inspect
      service-policy im ccp-action-app-im
    class type inspect ccp-insp-traffic
      inspect
    class type inspect ccp-sip-inspect
      inspect
    class type inspect ccp-h323-inspect
      inspect
    class type inspect ccp-h323annexe-inspect
      inspect
    class type inspect ccp-h225ras-inspect
      inspect
    class type inspect ccp-h323nxg-inspect
      inspect
    class type inspect ccp-skinny-inspect
      inspect
    class type inspect ccp-invalid-src
      drop log
    class class-default
      drop
    policy-map type inspect ccp-permit
    class type inspect SDM_VPN_PT
      pass
    class type inspect ccp-cls-ccp-permit-1
      pass
    class type inspect SDM_EASY_VPN_SERVER_PT
      pass
    class type inspect SDM_EASY_VPN_CTCP_SERVER_PT
      inspect
    class class-default
      drop
    policy-map type inspect sip ccp-app-sip-2
    class type inspect sip ccp-cls-sip-pv-2
      allow
    policy-map type inspect ccp-permit-dmzservice
    class type inspect ccp-cls-ccp-permit-dmzservice-1
      pass
    class type inspect ccp-dmz-traffic
      inspect
    class type inspect sdm-cls-http
      inspect
      service-policy http ccp-action-app-http
    class type inspect sdm-cls-VPNOutsideToInside-1
      inspect
    class type inspect sdm-cls-VPNOutsideToInside-2
      inspect
    class type inspect sdm-cls-VPNOutsideToInside-3
      pass
    class class-default
      pass
    policy-map type inspect ccp-pol-outToIn
    class type inspect ccp-cls-ccp-pol-outToIn-1
      pass
    class type inspect ccp-cls-ccp-pol-outToIn-2
      pass
    class type inspect CCP_PPTP
      pass
    class type inspect sdm-cls-VPNOutsideToInside-1
      inspect
    class type inspect sdm-cls-VPNOutsideToInside-2
      inspect
    class type inspect sdm-cls-VPNOutsideToInside-3
      pass
    class type inspect sdm-cls-VPNOutsideToInside-4
      inspect
    class class-default
      drop log
    policy-map type inspect sdm-permit-ip
    class type inspect SDM_IP
      pass
    class type inspect sdm-cls-VPNOutsideToInside-2
      inspect
    class type inspect sdm-cls-VPNOutsideToInside-3
      pass
    class type inspect sdm-cls-VPNOutsideToInside-4
      inspect
    class class-default
      drop log
    zone security dmz-zone
    zone security in-zone
    zone security out-zone
    zone security ezvpn-zone
    zone-pair security ccp-zp-out-dmz source out-zone destination dmz-zone
    service-policy type inspect ccp-permit-dmzservice
    zone-pair security ccp-zp-out-self source out-zone destination self
    service-policy type inspect ccp-permit
    zone-pair security ccp-zp-in-out source in-zone destination out-zone
    service-policy type inspect ccp-inspect
    zone-pair security ccp-zp-out-zone-To-in-zone source out-zone destination in-zone
    service-policy type inspect ccp-pol-outToIn
    zone-pair security ccp-zp-in-dmz source in-zone destination dmz-zone
    service-policy type inspect ccp-permit-dmzservice
    zone-pair security ccp-zp-self-out source self destination out-zone
    service-policy type inspect ccp-permit-icmpreply
    zone-pair security dmz-to-in source dmz-zone destination in-zone
    service-policy type inspect ccp-permit-icmpreply
    zone-pair security sdm-zp-ezvpn-out1 source ezvpn-zone destination out-zone
    service-policy type inspect sdm-permit-ip
    zone-pair security sdm-zp-in-ezvpn2 source in-zone destination ezvpn-zone
    service-policy type inspect sdm-permit-ip
    zone-pair security sdm-zp-in-ezvpn1 source dmz-zone destination ezvpn-zone
    service-policy type inspect sdm-permit-ip
    zone-pair security sdm-zp-ezvpn-in2 source ezvpn-zone destination in-zone
    service-policy type inspect sdm-permit-ip
    zone-pair security sdm-zp-ezvpn-in1 source ezvpn-zone destination dmz-zone
    service-policy type inspect sdm-permit-ip
    zone-pair security sdm-zp-out-ezpn1 source out-zone destination ezvpn-zone
    service-policy type inspect sdm-permit-ip
    zone-pair security sdm-zp-ezvpn-in3 source ezvpn-zone destination ezvpn-zone
    service-policy type inspect sdm-permit-ip
    crypto ctcp port 10000 1723 6299
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp policy 2
    encr aes 256
    authentication pre-share
    group 2
    crypto isakmp key 6 PbKM_WfaCM[hYNXAFOUgCNgCB_ZdJEAAB address 220.245.109.219
    crypto isakmp key 6 NddQRR[O^KY`GRDC[VZUEPE`CSJ^CDAAB address 0.0.0.0 0.0.0.0
    crypto isakmp client configuration group QQQ
    key 6 UWVBhb`Lgc_AZbDYWDFZiGZTTadNYTAAB
    dns 192.168.0.6 202.1.161.36
    wins 192.168.0.6
    domain QQQ.Local
    pool SDM_POOL_1
    include-local-lan
    max-users 20
    max-logins 1
    netmask 255.255.255.0
    banner ^CCWelcome to QQQ VPN!!!!1                 ^C
    crypto isakmp profile ciscocp-ike-profile-1
       match identity group QQQ
       client authentication list ciscocp_vpn_xauth_ml_1
       isakmp authorization list ciscocp_vpn_group_ml_1
       client configuration address initiate
       client configuration address respond
       keepalive 10 retry 2
       virtual-template 1
    crypto ipsec transform-set ESP_AES_SHA esp-aes 256 esp-sha-hmac
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto ipsec profile CiscoCP_Profile1
    set security-association idle-time 43200
    set transform-set ESP_AES_SHA
    set isakmp-profile ciscocp-ike-profile-1
    crypto map SDM_CMAP_1 1 ipsec-isakmp
    description Tunnel to220.245.109.219
    set peer 220.245.109.219
    set transform-set ESP-3DES-SHA
    match address 119
    interface Loopback0
    description QQQ_VPN
    ip address 192.168.9.254 255.255.255.0
    interface Null0
    no ip unreachables
    interface Ethernet0
    no ip address
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    shutdown
    no fair-queue
    interface ATM0
    no ip address
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    no atm ilmi-keepalive
    interface ATM0.1 point-to-point
    description Telekom_ADSL
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    zone-member security out-zone
    pvc 8/35
      pppoe-client dial-pool-number 1
    interface FastEthernet0
    description QQQ_LAN-VLAN_1
    switchport access vlan 1
    no ip address
    interface FastEthernet1
    description QQQ_LAN-VLAN_1
    no ip address
    interface FastEthernet2
    description QQQ_WAN-VLAN_2
    switchport access vlan 2
    no ip address
    interface FastEthernet3
    description QQQ_DMZ-IP_PBX-VLAN_3
    switchport access vlan 3
    no ip address
    interface Virtual-Template1 type tunnel
    description QQQ_Easy_VPN
    ip unnumbered Loopback0
    ip nat inside
    ip virtual-reassembly in
    zone-member security ezvpn-zone
    tunnel mode ipsec ipv4
    tunnel protection ipsec profile CiscoCP_Profile1
    interface Vlan1
    description QQQ_LAN-VLAN1$FW_INSIDE$
    ip address 192.168.0.254 255.255.255.0
    ip access-group QQQ_ACL in
    ip mask-reply
    ip nat inside
    ip virtual-reassembly in
    zone-member security in-zone
    ip tcp adjust-mss 1412
    interface Vlan2
    description QQQ_WAN-VLAN2$FW_INSIDE$
    ip address 192.168.5.254 255.255.255.0
    ip access-group QQQ_ACL in
    ip mask-reply
    ip nat inside
    ip virtual-reassembly in
    zone-member security in-zone
    ip tcp adjust-mss 1412
    interface Vlan3
    description QQQ_IP-PBX_WAN-VLAN3
    ip address 192.168.4.254 255.255.255.0
    ip mask-reply
    ip nat inside
    ip virtual-reassembly in
    zone-member security dmz-zone
    interface Vlan4
    description VLAN4 - 192.168.20.xxx (Spare)
    ip address 192.168.20.253 255.255.255.0
    ip nat inside
    ip virtual-reassembly in
    zone-member security in-zone
    interface Dialer0
    description ATM Dialer
    no ip address
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip flow ingress
    ip nat outside
    ip virtual-reassembly in
    zone-member security out-zone
    no cdp enable
    interface Dialer2
    description $FW_OUTSIDE$
    ip address negotiated
    no ip redirects
    no ip unreachables
    no ip proxy-arp
    ip mtu 1452
    ip nbar protocol-discovery
    ip flow ingress
    ip flow egress
    ip nat outside
    ip virtual-reassembly in
    zone-member security out-zone
    encapsulation ppp
    dialer pool 1
    dialer-group 1
    ppp authentication chap pap callin
    ppp chap hostname xxxxxxxxxxxxxxxxxxx
    ppp chap password 7 xxxxxxxxxxxxxxxxxxxxxxxxx
    ppp pap sent-username xxxxxxxxxx0 password 7 xxxxxxxxxxxxxxxxxxxxx
    no cdp enable
    crypto map SDM_CMAP_1
    router rip
    version 2
    redistribute static
    passive-interface ATM0
    passive-interface ATM0.1
    passive-interface Dialer0
    passive-interface Dialer2
    passive-interface Ethernet0
    passive-interface Loopback0
    network 10.0.0.0
    network 192.168.0.0
    network 192.168.1.0
    network 192.168.2.0
    network 192.168.3.0
    network 192.168.4.0
    network 192.168.5.0
    network 192.168.6.0
    network 192.168.7.0
    network 192.168.8.0
    network 192.168.10.0
    network 192.168.100.0
    ip local pool SDM_POOL_1 192.168.5.100 192.168.5.200
    ip forward-protocol nd
    ip http server
    ip http access-class 5
    ip http authentication local
    ip http secure-server
    ip nat pool NAT_IP 192.168.0.210 192.168.0.235 netmask 255.255.255.0
    ip nat inside source static tcp 192.168.4.253 5060 interface Dialer2 5060
    ip nat inside source static tcp 192.168.0.240 20408 interface Dialer2 6208
    ip nat inside source static tcp 192.168.0.240 20409 interface Dialer2 6209
    ip nat inside source static tcp 192.168.0.240 20410 interface Dialer2 6200
    ip nat inside source static tcp 192.168.1.240 20408 interface Dialer2 6218
    ip nat inside source static tcp 192.168.1.240 20409 interface Dialer2 6219
    ip nat inside source static tcp 192.168.1.240 20410 interface Dialer2 6210
    ip nat inside source static tcp 192.168.7.240 20408 interface Dialer2 6278
    ip nat inside source static tcp 192.168.7.240 20409 interface Dialer2 6279
    ip nat inside source static tcp 192.168.7.240 20410 interface Dialer2 6270
    ip nat inside source static tcp 192.168.8.240 20408 interface Dialer2 6288
    ip nat inside source static tcp 192.168.8.240 20409 interface Dialer2 6289
    ip nat inside source static tcp 192.168.8.240 20410 interface Dialer2 6280
    ip nat inside source static tcp 192.168.0.6 1723 interface Dialer2 1723
    ip nat inside source static tcp 192.168.0.6 3389 interface Dialer2 6389
    ip nat inside source static tcp 192.168.0.24 3389 interface Dialer2 6390
    ip nat inside source static tcp 192.168.4.253 8022 interface Dialer2 8022
    ip nat inside source static tcp 192.168.4.253 80 interface Dialer2 8021
    ip nat inside source static tcp 192.168.0.254 23 interface Dialer2 8023
    ip nat inside source static tcp 192.168.0.6 443 interface Dialer2 443
    ip nat inside source route-map SDM_RMAP_1 interface Dialer2 overload
    ip default-network 192.168.0.0
    ip default-network 192.168.4.0
    ip route 0.0.0.0 0.0.0.0 Dialer2 permanent
    ip route 10.1.0.0 255.255.0.0 Vlan2 permanent
    ip route 10.8.0.0 255.255.255.0 Vlan2 permanent
    ip route 192.168.0.0 255.255.255.0 Vlan1 permanent
    ip route 192.168.4.0 255.255.255.0 Vlan3 permanent
    ip route 192.168.5.0 255.255.255.0 Vlan2 permanent
    ip route 192.168.100.0 255.255.255.0 Dialer2 permanent
    ip access-list extended ACCESS_FROM_INSIDE
    permit ip object-group QQQ_Management_Group any
    permit tcp object-group QQQ_User_Group any eq smtp pop3
    permit tcp object-group QQQ_User_Group any eq 993 995
    permit tcp 192.168.0.0 0.0.0.255 any eq smtp pop3
    permit tcp 192.168.0.0 0.0.0.255 any eq 993 995
    permit ip 192.168.1.0 0.0.0.255 any
    permit ip 192.168.4.0 0.0.0.255 any
    permit ip 192.168.5.0 0.0.0.255 any
    permit ip 192.168.7.0 0.0.0.255 any
    permit ip 192.168.8.0 0.0.0.255 any
    permit tcp 192.168.2.0 0.0.0.255 any eq www 443 8080 domain
    permit tcp 192.168.2.0 0.0.0.255 any eq www 443 8080 domain time-range QQQ_Control
    permit tcp 192.168.3.0 0.0.0.255 any eq www 443 8080 domain time-range QQQ_Control
    permit tcp 192.168.4.0 0.0.0.255 any eq www 443 8080 domain time-range QQQ_Control
    permit udp 192.168.2.0 0.0.0.255 any eq domain time-range QQQ_Control
    permit udp 192.168.3.0 0.0.0.255 any eq domain time-range QQQ_Control
    permit udp 192.168.4.0 0.0.0.255 any eq domain time-range QQQ_Control
    ip access-list extended ETS
    remark CCP_ACL Category=128
    permit ip host 203.219.237.252 any
    ip access-list extended ETS1
    remark CCP_ACL Category=128
    permit ip host 203.219.237.252 any
    ip access-list extended FIREWALL_EXCEPTIONS_ACL
    permit tcp any host 192.168.0.100 eq 25565
    permit tcp any eq 25565 host 192.168.0.100
    ip access-list extended QQQ_ACL
    permit ip any host 192.168.4.253
    permit udp any any eq bootps bootpc
    permit ip any 192.168.4.0 0.0.0.255
    permit ip host 203.219.237.252 any
    remark QQQ Internet Control List
    remark CCP_ACL Category=17
    remark Auto generated by CCP for NTP (123) 203.12.160.2
    permit udp host 203.12.160.2 eq ntp any eq ntp
    remark AD Services
    permit udp host 192.168.0.6 eq domain any
    remark Unrestricted Access
    permit ip object-group QQQ_Management_Group any
    remark Restricted Users
    permit object-group MAIL-PORTS object-group QQQ_User_Group any
    permit ip 192.168.0.0 0.0.0.255 any time-range QQQ_Control
    permit ip 192.168.2.0 0.0.0.255 any time-range QQQ_Control
    permit ip 192.168.3.0 0.0.0.255 any time-range QQQ_Control
    permit ip 192.168.6.0 0.0.0.255 any time-range QQQ_Control
    remark ICMP Full Access
    permit icmp object-group QQQ_User_Group any
    permit tcp 192.168.2.0 0.0.0.255 eq www 443 8080 5190 1863 any time-range QQQ_Control
    permit tcp 192.168.3.0 0.0.0.255 eq www 443 8080 5190 1863 any time-range QQQ_Control
    permit tcp 192.168.6.0 0.0.0.255 eq www 443 8080 5190 1863 any time-range QQQ_Control
    permit udp 192.168.6.0 0.0.0.255 eq 80 443 8080 5190 1863 any time-range QQQ_Control
    permit tcp 192.168.0.0 0.0.0.255 eq www 443 8080 5190 1863 any time-range QQQ_Control
    permit udp 192.168.0.0 0.0.0.255 eq 80 443 8080 5190 1863 any time-range QQQ_Control
    permit udp 192.168.2.0 0.0.0.255 eq 80 443 8080 5190 1863 any time-range QQQ_Control
    permit udp 192.168.3.0 0.0.0.255 eq 80 443 8080 5190 1863 any time-range QQQ_Control
    ip access-list extended QQQ_NAT
    remark CCP_ACL Category=18
    remark IPSec Rule
    deny   ip 192.168.0.0 0.0.255.255 192.168.100.0 0.0.0.255
    permit ip any any
    ip access-list extended SDM_AH
    remark CCP_ACL Category=1
    permit ahp any any
    ip access-list extended SDM_ESP
    remark CCP_ACL Category=1
    permit esp any any
    ip access-list extended SDM_GRE
    remark CCP_ACL Category=1
    permit gre any any
    ip access-list extended SDM_HTTP
    remark CCP_ACL Category=0
    permit tcp any any eq telnet
    ip access-list extended SDM_HTTPS
    remark CCP_ACL Category=0
    permit tcp any any eq 443
    ip access-list extended SDM_IP
    remark CCP_ACL Category=1
    permit ip any any
    ip access-list extended SIP
    remark CCP_ACL Category=128
    permit ip any 192.168.4.0 0.0.0.255
    ip access-list extended Telnet
    remark CCP_ACL Category=128
    permit ip any any
    ip access-list extended dmz-traffic
    remark CCP_ACL Category=1
    permit ip any 192.168.4.0 0.0.0.255
    access-list 1 remark CCP_ACL Category=2
    access-list 1 remark QQQ_DMZ
    access-list 1 permit 192.168.4.0 0.0.0.255
    access-list 2 remark CCP_ACL Category=2
    access-list 2 remark QQQ_LAN
    access-list 2 permit 192.168.0.0 0.0.0.255
    access-list 3 remark QQQ Insid NAT
    access-list 3 remark CCP_ACL Category=2
    access-list 3 permit 192.168.0.0 0.0.0.255
    access-list 3 permit 192.168.1.0 0.0.0.255
    access-list 3 permit 192.168.2.0 0.0.0.255
    access-list 3 permit 192.168.3.0 0.0.0.255
    access-list 3 permit 192.168.4.0 0.0.0.255
    access-list 3 permit 192.168.5.0 0.0.0.255
    access-list 3 permit 192.168.6.0 0.0.0.255
    access-list 3 permit 192.168.7.0 0.0.0.255
    access-list 3 permit 192.168.8.0 0.0.0.255
    access-list 3 permit 192.168.9.0 0.0.0.255
    access-list 3 permit 192.168.10.0 0.0.0.255
    access-list 4 remark QQQ_NAT
    access-list 4 remark CCP_ACL Category=2
    access-list 4 permit 10.1.0.0 0.0.255.255
    access-list 4 permit 10.8.0.0 0.0.0.255
    access-list 4 permit 192.168.0.0 0.0.0.255
    access-list 4 permit 192.168.1.0 0.0.0.255
    access-list 4 permit 192.168.2.0 0.0.0.255
    access-list 4 permit 192.168.3.0 0.0.0.255
    access-list 4 permit 192.168.4.0 0.0.0.255
    access-list 4 permit 192.168.5.0 0.0.0.255
    access-list 4 permit 192.168.6.0 0.0.0.255
    access-list 4 permit 192.168.7.0 0.0.0.255
    access-list 4 permit 192.168.8.0 0.0.0.255
    access-list 4 permit 192.168.9.0 0.0.0.255
    access-list 4 permit 192.168.10.0 0.0.0.255
    access-list 5 remark HTTP Access-class list
    access-list 5 remark CCP_ACL Category=1
    access-list 5 permit 192.168.4.0 0.0.0.255
    access-list 5 permit 192.168.0.0 0.0.0.255
    access-list 5 deny   any
    access-list 100 remark CCP_ACL Category=128
    access-list 100 permit ip 192.168.4.0 0.0.0.255 any
    access-list 100 permit ip 127.0.0.0 0.255.255.255 any
    access-list 100 permit ip host 255.255.255.255 any
    access-list 101 remark QQQ_Extended_ACL
    access-list 101 remark CCP_ACL Category=1
    access-list 101 permit tcp any host 192.168.0.254 eq 10000
    access-list 101 permit udp any host 192.168.0.254 eq non500-isakmp
    access-list 101 permit udp any host 192.168.0.254 eq isakmp
    access-list 101 permit esp any host 192.168.0.254
    access-list 101 permit ahp any host 192.168.0.254
    access-list 101 remark Auto generated by CCP for NTP (123) 203.12.160.2
    access-list 101 permit udp host 203.12.160.2 eq ntp host 192.168.4.254 eq ntp
    access-list 101 permit udp host 192.168.0.6 eq domain any
    access-list 101 remark NTP (123) 203.12.160.2
    access-list 101 permit udp host 203.12.160.2 eq ntp any eq ntp
    access-list 101 remark QQQ_ANY_Any
    access-list 101 permit ip object-group QQQ.Local any
    access-list 101 remark QQQ_DMZ
    access-list 101 permit ip any 192.168.4.0 0.0.0.255
    access-list 101 remark QQQ_GRE
    access-list 101 permit gre any any
    access-list 101 remark QQQ_Ping
    access-list 101 permit icmp any any
    access-list 102 remark CCP_ACL Category=1
    access-list 102 permit tcp any any eq 10000
    access-list 103 permit tcp any 192.168.0.0 0.0.0.255 eq 443
    access-list 103 remark CCP_ACL Category=1
    access-list 103 permit tcp any any eq 10000
    access-list 103 permit tcp any 192.168.4.0 0.0.0.255 eq 8022
    access-list 103 permit tcp any 192.168.4.0 0.0.0.255 eq telnet
    access-list 103 permit tcp any 192.168.4.0 0.0.0.255 eq www
    access-list 103 permit tcp any 192.168.4.0 0.0.0.255 eq 5060
    access-list 103 permit tcp any eq telnet host 192.168.0.254
    access-list 103 permit tcp any 192.168.0.0 0.0.0.255 eq telnet
    access-list 103 permit udp any 192.168.4.0 0.0.0.255 eq 5060
    access-list 103 permit udp any 192.168.4.0 0.0.0.255 range 10001 12000
    access-list 104 remark CCP_ACL Category=1
    access-list 104 permit tcp any any eq 10000
    access-list 105 remark CCP_ACL Category=1
    access-list 105 permit tcp any any eq 10000
    access-list 106 remark CCP_ACL Category=1
    access-list 106 permit tcp any any eq 10000
    access-list 107 remark CCP_ACL Category=1
    access-list 107 permit tcp any any eq 10000
    access-list 108 remark CCP_ACL Category=1
    access-list 108 permit tcp any any eq 10000
    access-list 109 remark CCP_ACL Category=1
    access-list 109 permit tcp any any eq 10000
    access-list 110 remark CCP_ACL Category=1
    access-list 110 permit tcp any any eq 10000
    access-list 111 remark CCP_ACL Category=1
    access-list 111 permit tcp any any eq 10000
    access-list 112 remark CCP_ACL Category=1
    access-list 112 permit tcp any any eq 10000
    access-list 113 remark CCP_ACL Category=1
    access-list 113 permit tcp any any eq 10000
    access-list 114 remark CCP_ACL Category=1
    access-list 114 permit tcp any any eq 10000
    access-list 115 remark CCP_ACL Category=1
    access-list 115 permit tcp any any eq 10000
    access-list 116 remark CCP_ACL Category=4
    access-list 116 remark IPSec Rule
    access-list 116 permit ip 192.168.0.0 0.0.255.255 192.168.100.0 0.0.0.255
    access-list 117 remark CCP_ACL Category=128
    access-list 117 permit ip any any
    access-list 117 permit ip host 220.245.109.219 any
    access-list 118 remark CCP_ACL Category=0
    access-list 118 permit ip 192.168.100.0 0.0.0.255 192.168.0.0 0.0.0.255
    access-list 119 remark CCP_ACL Category=4
    access-list 119 remark IPSec Rule
    access-list 119 permit ip 192.168.0.0 0.0.255.255 192.168.100.0 0.0.0.255
    access-list 120 remark CCP_ACL Category=0
    access-list 120 permit ip 192.168.100.0 0.0.0.255 192.168.0.0 0.0.0.255
    access-list 121 remark CCP_ACL Category=0
    access-list 121 permit ip 192.168.100.0 0.0.0.255 192.168.0.0 0.0.255.255
    access-list 122 remark CCP_ACL Category=0
    access-list 122 permit ip 192.168.100.0 0.0.0.255 192.168.0.0 0.0.255.255
    dialer-list 1 protocol ip permit
    route-map SDM_RMAP_1 permit 1
    match ip address QQQ_NAT
    banner login ^CCWelcome to QQQ ADSL Gateway

    It turns out the problem had nothing to do with wires or splitters.  The Verizon tech was at my house yesterday and the ONT was failing.  He replaced part of the ONT and it fixed the problem (finally!).  At least I was able to watch the Celtics game last night.
    I have a Tellabs ONT.  Not sure the model but it's older like the ones in this thread.
    http://www.dslreports.com/forum/r19982000-Mounting-board-for-612-ONT

  • Port Forward in Cisco series 800

    Dear Support
    below the configuration of Cisco Series 800 Router that Has VDSL  port of internet , the configuration as below : 
    i add three command
    what is required in order to make port forward
    ip nat inside source static tcp  8000 10.10.10.10 8000 dilar 0
    ip nat inside source static tcp 554  10.10.10.10 554 dilar 0
    ip access list extended 100
    permit ip any any
    what is required to make port forward to the local ip address 10.10.10.10 from outside interface that is VDSL port ?
    ! Last configuration change at 10:47:44 KSA Wed Apr 22 2015 by aamalsup
    version 15.2
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime
    service password-encryption
    hostname AamalNet
    boot-start-marker
    boot-end-marker
    logging buffered 51200 warnings
    enable secret level 2 5 $1$Y4PF$K6TQ5wf0gcHiO5IxvLZba0
    enable secret level 5 5 $1$WZeO$BzTCl0C0e1078CWxExJK0/
    enable secret 5 $1$plq6$P5HVL/tR81cs0GFDrD.0V/
    aaa new-model
    aaa authentication login default local
    aaa authentication login sdm_vpn_xauth_ml_1 local
    aaa authentication login sdm_vpn_xauth_ml_2 local
    aaa authorization exec default local
    aaa authorization network sdm_vpn_group_ml_1 local
    aaa session-id common
    clock timezone KSA 3 0
    crypto pki trustpoint TP-self-signed-1682106276
     enrollment selfsigned
     subject-name cn=IOS-Self-Signed-Certificate-1682106276
     revocation-check none
     rsakeypair TP-self-signed-1682106276
    crypto pki certificate chain TP-self-signed-1682106276
     certificate self-signed 02
      30820250 308201B9 A0030201 02020102 300D0609 2A864886 F70D0101 04050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 31363832 31303632 3736301E 170D3032 30333031 30303038
      35315A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 36383231
      30363237 3630819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100C2F3 49897460 71FEB259 7794B7C6 D398958A 2D338F0F C69F0E75 1137B16C
      C261A275 8416DAF6 FC19AA6E 50024019 66CE4DB8 3AFAB6FE CE892B42 86A93490
      97259E47 D740B2F4 9AA2D307 7B676841 2CAAA879 D945A6FD 717B507F 77399332
      1644CEDE 884BF133 ACFBBC80 9869A104 54CC3EEE 9D521378 EC762D86 C3F0ABC9
      CA990203 010001A3 78307630 0F060355 1D130101 FF040530 030101FF 30230603
      551D1104 1C301A82 18417761 6C416D61 6C792E61 77616C6E 65742E6E 65742E73
      61301F06 03551D23 04183016 80149ADD A651C9F9 F8369354 5C904777 090FEB75
      72E0301D 0603551D 0E041604 149ADDA6 51C9F9F8 3693545C 90477709 0FEB7572
      E0300D06 092A8648 86F70D01 01040500 03818100 50ACCA98 1A5FCCAD FC61D703
      A8589B02 AFB8CD47 BD1CC7B0 B095C97F AA0604A8 F8495053 C8A9CBB9 644F5674
      318A7AA0 873250AD 1DE28CE2 BE21ED19 BF212CF7 E2A97CFB FFA62F1E 643CEDFE
      90D02109 719FD4D3 98E6C40B D61CE89C D2426C1E 3CBD9FBE 397F7F7C F1DD279E
      14F8BB2D ABFA784B 6E04274B EDCBFC8F A805E91D
          quit
    ip cef
    no ip dhcp use vrf connected
    ip dhcp excluded-address 10.10.10.1
    ip dhcp excluded-address 10.10.11.1
    ip dhcp pool lan
     import all
     network 10.10.10.0 255.255.255.0
     default-router 10.10.10.1
     dns-server 212.93.192.4 212.93.192.5
     lease 0 2
    ip dhcp pool wireless
     import all
     network 10.10.11.0 255.255.255.0
     default-router 10.10.11.1
     dns-server 212.93.192.4 212.93.192.5
     lease 0 2
    no ip domain lookup
    ip domain name aamal.net.sa
    ip name-server 212.93.192.4
    ip name-server 212.93.192.5
    no ipv6 cef
    cwmp agent
     enable download
     enable
     session retry limit 10
     management server password 7 094D4308151612001D05072F
     management server url http://aamalservice.aamal.net.sa:9090
    license udi pid C887VA-W-E-K9 sn FCZ17459018
    archive
     log config
      hidekeys
    username k privilege 15 password 7 020D
    username admin privilege 15 password 7 14161606050A
    controller VDSL 0
    crypto isakmp policy 1
     encr 3des
     authentication pre-share
     group 2
    crypto isakmp client configuration group aamalnet
     key aamalnet
     dns 212.93.192.4 212.93.192.5
     include-local-lan
     dhcp server 10.10.10.1
     max-users 10
     netmask 255.255.255.0
    crypto isakmp profile sdm-ike-profile-1
       match identity group aamalnet
       client authentication list sdm_vpn_xauth_ml_2
       isakmp authorization list sdm_vpn_group_ml_1
       client configuration address respond
       virtual-template 1
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
     mode tunnel
    crypto ipsec profile SDM_Profile1
     set security-association idle-time 60
     set transform-set ESP-3DES-SHA
     set isakmp-profile sdm-ike-profile-1
    bridge irb
    interface ATM0
     no ip address
     no atm ilmi-keepalive
    interface ATM0.1 point-to-point
     pvc 0/35
      pppoe-client dial-pool-number 1
    interface Ethernet0
     no ip address
     shutdown
    interface FastEthernet0
     no ip address
    interface FastEthernet1
     no ip address
    interface FastEthernet2
     no ip address
    interface FastEthernet3
     no ip address
    interface Virtual-Template1 type tunnel
     ip unnumbered Dialer0
     tunnel mode ipsec ipv4
     tunnel protection ipsec profile SDM_Profile1
    interface Wlan-GigabitEthernet0
     description Internal switch interface connecting to the embedded AP
     switchport mode trunk
     no ip address
    interface wlan-ap0
     description Embedded Service module interface to manage the embedded AP
     ip unnumbered Vlan1
    interface Vlan1
     description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
     ip address 10.10.10.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
     ip tcp adjust-mss 1452
    interface Vlan2
     no ip address
     bridge-group 2
    interface Dialer0
     ip address negotiated
     ip mtu 1452
     ip nat outside
     ip virtual-reassembly in
     encapsulation ppp
     dialer pool 1
     dialer-group 1
     ppp authentication chap callin
     ppp chap hostname [email protected]
     ppp chap password 7 0007145E2E5A05522E1858
     no cdp enable
    interface BVI2
     ip address 10.10.11.1 255.255.255.0
     ip nat inside
     ip virtual-reassembly in
    ip forward-protocol nd
    ip http server
    ip http access-class 23
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip nat inside source list 1 interface Dialer0 overload
    ip route 0.0.0.0 0.0.0.0 Dialer0
    access-list 1 remark SDM_ACL Category=2
    access-list 1 permit 10.10.10.0 0.0.0.255
    access-list 1 permit 10.10.11.0 0.0.0.255
    access-list 23 permit 212.93.196.0 0.0.0.255
    access-list 23 permit 212.93.192.0 0.0.0.255
    access-list 23 permit 212.93.193.0 0.0.0.255
    access-list 23 permit 10.10.10.0 0.0.0.255
    access-list 23 permit 10.10.11.0 0.0.0.255
    dialer-list 1 protocol ip permit
    no cdp run
    snmp-server community private RW
    snmp-server community public RO
    bridge 1 protocol ieee
    bridge 1 route ip
    bridge 2 protocol ieee
    bridge 2 route ip
    privilege interface level 5 encapsulation
    privilege interface level 5 description
    privilege interface level 5 no encapsulation
    privilege interface level 5 no description
    privilege interface level 5 no
    privilege configure level 5 ip route
    privilege configure level 5 interface
    privilege configure level 5 controller
    privilege configure level 5 ip
    privilege exec level 5 copy running-config tftp
    privilege exec level 5 copy running-config
    privilege exec level 5 copy
    privilege exec level 5 write memory
    privilege exec level 5 write
    privilege exec level 5 configure terminal
    privilege exec level 5 configure
    privilege exec level 5 show processes cpu
    privilege exec level 5 show processes
    privilege exec level 2 show running-config
    privilege exec level 5 show configuration
    privilege exec level 2 show
    privilege exec level 5 clear counters
    privilege exec level 5 clear
    banner exec
    CC
    % Password expiration warning.
    Cisco Router and Security Device Manager (SDM) is installed on this device and
    it provides the default username "cisco" for  one-time use. If you have already
    used the username "cisco" to login to the router and your IOS image supports the
    "one-time" user option, then this username has already expired. You will not be
    able to login to the router with this username after you exit this session.
    It is strongly suggested that you create a new username with a privilege level
    of 15 using the following command.
    username <myuser> privilege 15 secret 0 <mypassword>
    Replace <myuser> and <mypassword> with the username and password you want to
    use.
    banner login
    CC
    ********STC AamalNet Service****************************************
    ********Authorize Access Only. For more Support Call 909************
    line con 0
     privilege level 15
     no modem enable
    line aux 0
    line 2
     no activation-character
     no exec
     transport preferred none
     transport input all
     stopbits 1
    line vty 0 4
     access-class 23 in
     privilege level 2
     transport input telnet ssh
    scheduler max-task-time 5000
    scheduler allocate 20000 1000
    end

    Hello,
    Sure.
    What version are you running?
    Regards,

  • Port Forwarding for RDP 3389 is not working

    Hi,
    I am having trouble getting rdp (port 3389) to forward to my server (10.20.30.20).  I have made sure it is not an issue with the servers firewall, its just the cisco.  I highlighted in red to what i thought I need in my config to get this  to work.  I have removed the last 2 octets of the public IP info for security .Here is the configuration below:
    TAMSATR1#show run
    Building configuration...
    Current configuration : 11082 bytes
    version 15.2
    no service pad
    service timestamps debug datetime msec localtime show-timezone
    service timestamps log datetime msec localtime show-timezone
    service password-encryption
    hostname TAMSATR1
    boot-start-marker
    boot system flash:/c880data-universalk9-mz.152-1.T.bin
    boot-end-marker
    logging count
    logging buffered 16384
    enable secret
    aaa new-model
    aaa authentication login default local
    aaa authentication login ipsec-vpn local
    aaa authentication login ciscocp_vpn_xauth_ml_1 local
    aaa authorization console
    aaa authorization exec default local
    aaa authorization network groupauthor local
    aaa session-id common
    memory-size iomem 10
    clock timezone CST -6 0
    clock summer-time CDT recurring
    crypto pki token default removal timeout 0
    crypto pki trustpoint TP-self-signed-1879941380
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-1879941380
    revocation-check none
    rsakeypair TP-self-signed-1879941380
    crypto pki certificate chain TP-self-signed-1879941380
    certificate self-signed 01
      3082024B 308201B4 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
      31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
      69666963 6174652D 31383739 39343133 3830301E 170D3131 30393136 31393035
      32305A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 38373939
      34313338 3030819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
      8100BD7E 754A0A89 33AFD729 7035E8E1 C29A6806 04A31923 5AE2D53E 9181F76C
      ED17D130 FC9B5767 6FD1F58B 87B3A96D FA74E919 8A87376A FF38A712 BD88DB31
      88042B9C CCA8F3A6 39DC2448 CD749FC7 08805AF6 D3CDFFCB 1FE8B9A5 5466B2A4
      E5DFA69E 636B83E4 3A2C02F9 D806A277 E6379EB8 76186B69 EA94D657 70E25B03
      542D0203 010001A3 73307130 0F060355 1D130101 FF040530 030101FF 301E0603
    ip dhcp excluded-address 10.20.30.1 10.20.30.99
    ip dhcp excluded-address 10.20.30.201 10.20.30.254
    ip dhcp excluded-address 10.20.30.250
    ip dhcp pool tamDHCPpool
    import all
    network 10.20.30.0 255.255.255.0
    default-router 10.20.30.1
    domain-name domain.com
    dns-server 10.20.30.20 8.8.8.8
    ip domain name domain.com
    ip name-server 10.20.30.20
    ip cef
    no ipv6 cef
    license udi pid CISCO881W-GN-A-K9 sn
    crypto vpn anyconnect flash:/webvpn/anyconnect-dart-win-2.5.3054-k9.pkg sequence 1
    ip tftp source-interface Vlan1
    class-map type inspect match-all CCP_SSLVPN
    match access-group name CCP_IP
    policy-map type inspect ccp-sslvpn-pol
    class type inspect CCP_SSLVPN
      pass
    zone security sslvpn-zone
    crypto isakmp policy 10
    encr aes 256
    authentication pre-share
    group 2
    crypto isakmp policy 20
    encr aes 192
    authentication pre-share
    group 2
    crypto isakmp key password
    crypto isakmp client configuration group ipsec-ra
    key password
    dns 10.20.30.20
    domain tamgmt.com
    pool sat-ipsec-vpn-pool
    netmask 255.255.255.0
    crypto ipsec transform-set ipsec-ra esp-aes esp-sha-hmac
    crypto ipsec transform-set TSET esp-aes esp-sha-hmac
    crypto ipsec profile VTI
    set security-association replay window-size 512
    set transform-set TSET
    crypto dynamic-map dynmap 10
    set transform-set ipsec-ra
    reverse-route
    crypto map clientmap client authentication list ipsec-vpn
    crypto map clientmap isakmp authorization list groupauthor
    crypto map clientmap client configuration address respond
    crypto map clientmap 10 ipsec-isakmp dynamic dynmap
    interface Loopback0
    ip address 10.20.250.1 255.255.255.252
    ip nat inside
    ip virtual-reassembly in
    interface Tunnel0
    description To AUS
    ip address 192.168.10.1 255.255.255.252
    load-interval 30
    tunnel source
    tunnel mode ipsec ipv4
    tunnel destination
    tunnel protection ipsec profile VTI
    interface FastEthernet0
    no ip address
    interface FastEthernet1
    no ip address
    interface FastEthernet2
    no ip address
    interface FastEthernet3
    no ip address
    interface FastEthernet4
    ip address 1.2.3.4
    ip access-group INTERNET_IN in
    ip access-group INTERNET_OUT out
    ip nat outside
    ip virtual-reassembly in
    no ip route-cache cef
    ip route-cache policy
    ip policy route-map IPSEC-RA-ROUTE-MAP
    duplex auto
    speed auto
    crypto map clientmap
    interface Virtual-Template1
    ip unnumbered Vlan1
    zone-member security sslvpn-zone
    interface wlan-ap0
    description Service module interface to manage the embedded AP
    ip unnumbered Vlan1
    arp timeout 0
    interface Wlan-GigabitEthernet0
    description Internal switch interface connecting to the embedded AP
    switchport mode trunk
    no ip address
    interface Vlan1
    description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
    ip address 10.20.30.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly in
    ip tcp adjust-mss 1452
    ip local pool sat-ipsec-vpn-pool 10.20.30.209 10.20.30.239
    ip default-gateway 71.41.20.129
    ip forward-protocol nd
    ip http server
    ip http access-class 23
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip dns server
    ip nat inside source list ACL-POLICY-NAT interface FastEthernet4 overload
    ip nat inside source static tcp 10.20.30.20 3389 interface FastEthernet4 3389
    ip nat inside source static 10.20.30.20 (public ip)
    ip route 0.0.0.0 0.0.0.0 public ip
    ip route 10.20.40.0 255.255.255.0 192.168.10.2 name AUS_LAN
    ip access-list extended ACL-POLICY-NAT
    deny   ip 10.0.0.0 0.255.255.255 10.20.30.208 0.0.0.15
    deny   ip 172.16.0.0 0.15.255.255 10.20.30.208 0.0.0.15
    deny   ip 192.168.0.0 0.0.255.255 10.20.30.208 0.0.0.15
    permit ip 10.20.30.0 0.0.0.255 any
    permit ip 10.20.31.208 0.0.0.15 any
    ip access-list extended CCP_IP
    remark CCP_ACL Category=128
    permit ip any any
    ip access-list extended INTERNET_IN
    permit icmp any any echo
    permit icmp any any echo-reply
    permit icmp any any unreachable
    permit icmp any any time-exceeded
    permit esp host 24.153. host 66.196
    permit udp host 24.153 host 71.41.eq isakmp
    permit tcp host 70.123. host 71.41 eq 22
    permit tcp host 72.177. host 71.41 eq 22
    permit tcp host 70.123. host 71.41. eq 22
    permit tcp any host 71..134 eq 443
    permit tcp host 70.123. host 71.41 eq 443
    permit tcp host 72.177. host 71.41. eq 443
    permit udp host 198.82. host 71.41 eq ntp
    permit udp any host 71.41. eq isakmp
    permit udp any host 71.41eq non500-isakmp
    permit tcp host 192.223. host 71.41. eq 4022
    permit tcp host 155.199. host 71.41 eq 4022
    permit tcp host 155.199. host 71.41. eq 4022
    permit udp host 192.223. host 71.41. eq 4022
    permit udp host 155.199. host 71.41. eq 4022
    permit udp host 155.199. host 71.41. eq 4022
    permit tcp any host 10.20.30.20 eq 3389
    evaluate INTERNET_REFLECTED
    deny   ip any any
    ip access-list extended INTERNET_OUT
    permit ip any any reflect INTERNET_REFLECTED timeout 300
    ip access-list extended IPSEC-RA-ROUTE-MAP
    deny   ip 10.20.30.208 0.0.0.15 10.0.0.0 0.255.255.255
    deny   ip 10.20.30.224 0.0.0.15 10.0.0.0 0.255.255.255
    deny   ip 10.20.30.208 0.0.0.15 172.16.0.0 0.15.255.255
    deny   ip 10.20.30.224 0.0.0.15 172.16.0.0 0.15.255.255
    deny   ip 10.20.30.208 0.0.0.15 192.168.0.0 0.0.255.255
    deny   ip 10.20.30.224 0.0.0.15 192.168.0.0 0.0.255.255
    permit ip 10.20.30.208 0.0.0.15 any
    deny   ip any any
    access-list 23 permit 70.123.
    access-list 23 permit 10.20.30.0 0.0.0.255
    access-list 24 permit 72.177.
    no cdp run
    route-map IPSEC-RA-ROUTE-MAP permit 10
    match ip address IPSEC-RA-ROUTE-MAP
    set ip next-hop 10.20.250.2
    banner motd ^C
    UNAUTHORIZED ACCESS TO THIS NETWORK DEVICE IS PROHIBITED.
    You must have explicit permission to access or configure this device.  All activities performed on this device are logged and violations of this policy may result in disciplinary and/or legal action.
    ^C
    line con 0
    logging synchronous
    line aux 0
    line 2
    no activation-character
    no exec
    transport preferred none
    transport input all
    line vty 0
    access-class 23 in
    privilege level 15
    logging synchronous
    transport input telnet ssh
    line vty 1 4
    access-class 23 in
    exec-timeout 5 0
    privilege level 15
    logging synchronous
    transport input telnet ssh
    scheduler max-task-time 5000
    ntp server 198.82.1.201
    webvpn gateway gateway_1
    ip address 71.41. port 443
    http-redirect port 80
    ssl encryption rc4-md5
    ssl trustpoint TP-self-signed-1879941380
    inservice
    webvpn context TAM-SSL-VPN
    title "title"
    logo file titleist_logo.jpg
    secondary-color white
    title-color #CCCC66
    text-color black
    login-message "RESTRICTED ACCESS"
    policy group policy_1
       functions svc-enabled
       svc address-pool "sat-ipsec-vpn-pool"
       svc default-domain "domain.com"
       svc keep-client-installed
       svc split dns "domain.com"
       svc split include 10.0.0.0 255.0.0.0
       svc split include 192.168.0.0 255.255.0.0
       svc split include 172.16.0.0 255.240.0.0
       svc dns-server primary 10.20.30.20
       svc dns-server secondary 66.196.216.10
    default-group-policy policy_1
    aaa authentication list ciscocp_vpn_xauth_ml_1
    gateway gateway_1
    ssl authenticate verify all
    inservice
    end

    Hi,
    I didnt see anything marked with red in the above? (Atleast when I was reading)
    I have not really had to deal with Routers at all since we all access control and NAT with firewalls.
    But to me it seems you have allowed the traffic to the actual IP address of the internal server rather than the public IP NAT IP address which in this case seems to be configured to use your FastEthernet4 interfaces public IP address.
    There also seems to be a Static NAT configured for the same internal host so I am wondering why the Static PAT (Port Forward) is used?
    - Jouni

  • Cisco 5520 ASA Port Forward to Endian Firewall VPN Question

    Hello,
    We have had a VPN operational on our Endian Firewall which uses OpenVPN server on port number 1194.  We recently purchased a Cisco 5520 ASA to put in front of our Endian Firewall and I am still hoping to use our current Endian Firewall VPN server.  So I am thinking the easiest way to make this happen is to port forward all vpn traffic through the ASA to our Endian Firewall to access the VPN.  Anyhow, I am just hoping someone with higher knowledge can let me know if this is the best course of action or if there is another easier or more efficient way of doing this?
    Thanks for your comments in advance I am new to cisco technology,
    Joe        

    Wrong forum, post in "Secuirity - Firewalling". You can move your posting with the Actions panel on the right.

  • How do you set up Port Forwarding for ARD 2.2 in AEB N?

    Help,
    I'm a novice at Apple Remote Desktop (ARD) - not an IT guy, so it has to be pretty basic and detailed.
    How do you set up Port Forwarding for ARD 2.2 on the Apple Airport Extreme BS router, 802.11 N. I have one at each end of the internet connection. At one end I have an Airport Extreme N router with 2 macs and eventually 1 windows XP machine (if I can) that I would like to be able to connect to over the interenet (the clients) and at the other end, I have a Mac with ARD 2.2 installed also with an Airport Extreme N router. Note: Both routers use Static IP addresses and all computers use static IP's internally not through DHCP. What are the settings or directions to do this.
    I have read and printed out the directions for Configuration of ARD 3.0 that are posted many times in the ARD discusion group, but it uses a Linksys router ( http://www.starkpr.com/ard.htm posted by Dave Sawyer). The Mac router is different, particularly with the place to set a Private IP address. I'm not sure about alot of things, but especially about the Private IP address, what number do I set it to, the one that is in my Network connections list? It automatically changes to a different number in AE N setup for Port Forwarding (by one) as if it is not suppose to the same?????
    Are there any directions available that are as straight forward for the Airport Extreme N router, as the one's that are listed here for the Linksys Router's? ( http://www.starkpr.com/ard.htm )
    Any and All help will be greatly appreciated.
    P.S. I know I should have 3.0 but bought 2.2 just weeks before 3.0 came out and they would not give me an upgrade price, so I'm waiting for 4.0 to upgrade.
    Thanks,
    Jim

    Try the following for each AirPort Extreme ...
    AEBSn - Port Mapping Setup
    To setup port mapping on an 802.11n AirPort Extreme Base Station (AEBSn), either connect to the AEBSn's wireless network or temporarily connect directly, using an Ethernet cable, to one of the LAN port of the AEBSn, and then use the AirPort Utility, in Manual Setup, to make these settings:
    1. Reserve a DHCP-provided IP address for the host device.
    Internet > DHCP tab
    o On the DHCP tab, click the "+" (Add) button to enter DHCP Reservations.
    o Description: <enter the desired description of the host device>
    o Reserve address by: MAC Address
    o Click Continue.
    o MAC Address: <enter the MAC (what Apple calls Ethernet ID if you are using wired or AirPort ID if wireless) hardware address of the host computer>
    o IPv4 Address: <enter the desired IP address>
    o Click Done.
    2. Setup Port Mapping on the AEBSn.
    Advanced > Port Mapping tab
    o Click the "+" (Add) button
    o Service: <choose the appropriate service from the Service pop-up menu>
    o Public UDP Port(s): 3283
    o Public TCP Port(s): 3283
    o Private IP Address: <enter the IP address of the host server>
    o Private UDP Port(s): 3283
    o Private TCP Port(s): 3283
    o Click "Continue"
    o Click the "+" (Add) button
    o Service: <choose the appropriate service from the Service pop-up menu>
    o Public UDP Port(s):
    o Public TCP Port(s): 5900
    o Private IP Address: <enter the IP address of the host server>
    o Private UDP Port(s):
    o Private TCP Port(s): 5900
    o Click "Continue"
    o Click the "+" (Add) button
    o Service: <choose the appropriate service from the Service pop-up menu>
    o Public UDP Port(s):
    o Public TCP Port(s): 5988
    o Private IP Address: <enter the IP address of the host server>
    o Private UDP Port(s):
    o Private TCP Port(s): 5988
    o Click "Continue"
    (ref: "Well Known" TCP and UDP ports used by Apple software products)

  • How to IPsec site to site vpn port forwarding to remote site?

    Hi All,
    The scenario where a Site to Site VPN tunnel has been established between Site A and Site B. Lan on Site A can ping Lan on Site B. My problem is a Printer behind Site B needs to be accessed by using the WAN IP address of Site A. Also i could not ping the remote lan or printer from the router.
    Below are my configure on the Cisco 877 in site A. Would you please advise the solution for that?
    Building configuration...
    Current configuration : 5425 bytes
    ! Last configuration change at 15:09:21 PCTime Fri Jun 15 2012 by admin01
    version 12.4
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname Laverton
    boot-start-marker
    boot-end-marker
    logging message-counter syslog
    no logging buffered
    aaa new-model
    aaa authentication login default local
    aaa authorization exec default local
    aaa session-id common
    clock timezone PCTime 10
    crypto pki trustpoint TP-self-signed-1119949081
    enrollment selfsigned
    subject-name cn=IOS-Self-Signed-Certificate-1119949081
    revocation-check none
    rsakeypair TP-self-signed-1119949081
    crypto pki certificate chain TP-self-signed-1119949081
    certificate self-signed 01
      XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
      XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
      69666963 6174652D 31313139 39343930 3831301E 170D3132 30363135 30343032
      30385A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
      4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 31313939
                quit
    dot11 syslog
    ip source-route
    no ip dhcp use vrf connected
    ip dhcp excluded-address 192.168.1.1 192.168.1.50
    ip dhcp pool DHCP_LAN
       network 192.168.1.0 255.255.255.0
       default-router 192.168.1.1
       dns-server 61.9.134.49
       lease infinite
    ip cef
    no ipv6 cef
    multilink bundle-name authenticated
    object-group network VPN
    description ---Port Forward to vpn Turnnel---
    host 192.168.2.99
    username admin01 privilege 15 secret 5 $1$6pJE$ngWtGp051xpSXLAizsX6B.
    crypto isakmp policy 1
    encr 3des
    authentication pre-share
    group 2
    crypto isakmp key mypasswordkey address 0.0.0.0 0.0.0.0
    crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
    crypto dynamic-map SDM_DYNMAP_1 1
    set transform-set ESP-3DES-SHA
    match address 100
    crypto map SDM_CMAP_1 65535 ipsec-isakmp dynamic SDM_DYNMAP_1
    archive
    log config
      hidekeys
    no ip ftp passive
    interface ATM0
    description ---Telstra ADSL---
    no ip address
    no atm ilmi-keepalive
    pvc 8/35
      tx-ring-limit 3
      encapsulation aal5snap
      protocol ppp dialer
      dialer pool-member 1
    dsl operating-mode auto
    interface FastEthernet0
    interface FastEthernet1
    interface FastEthernet2
    switchport access vlan 10
    shutdown
    interface FastEthernet3
    interface Vlan1
    description ---Ethernet LAN---
    ip address 192.168.1.1 255.255.255.0
    ip nat inside
    ip virtual-reassembly
    ip tcp adjust-mss 1420
    interface Vlan10
    ip dhcp relay information trusted
    ip dhcp relay information check-reply none
    no ip dhcp client request tftp-server-address
    no ip dhcp client request netbios-nameserver
    no ip dhcp client request vendor-specific
    no ip dhcp client request static-route
    ip address dhcp
    ip nat outside
    ip virtual-reassembly
    interface Dialer0
    description ---ADSL Detail---
    ip address negotiated
    ip mtu 1460
    ip nat outside
    ip virtual-reassembly
    encapsulation ppp
    ip tcp adjust-mss 1420
    dialer pool 1
    dialer-group 1
    ppp chap hostname [email protected]
    ppp chap password 0 mypassword
    crypto map SDM_CMAP_1
    ip forward-protocol nd
    ip route 0.0.0.0 0.0.0.0 Dialer0
    ip http server
    ip http authentication local
    ip http secure-server
    ip http timeout-policy idle 60 life 86400 requests 10000
    ip dns server
    ip nat inside source static tcp 192.168.2.99 80 interface Dialer0 8000
    ip nat inside source static tcp 192.168.2.99 9100 interface Dialer0 9100
    ip nat inside source route-map SDM_RMAP_1 interface Dialer0 overload
    ip nat inside source route-map SDM_RMAP_2 interface Dialer0 overload
    ip access-list extended NAT
    remark CCP_ACL Category=16
    remark IPSec Rule
    deny   ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
    permit ip 192.168.1.0 0.0.0.255 any
    access-list 1 permit 192.168.1.0 0.0.0.255
    access-list 100 remark CCP_ACL Category=4
    access-list 100 remark IPSec Rule
    access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
    access-list 101 remark CCP_ACL Category=2
    access-list 101 remark IPSec Rule
    access-list 101 deny   ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
    access-list 101 permit ip 192.168.2.0 0.0.0.255 any
    route-map SDM_RMAP_1 permit 1
    match ip address NAT
    route-map SDM_RMAP_2 permit 1
    match ip address 101
    control-plane
    line con 0
    no modem enable
    line aux 0
    line vty 0 4
    transport input telnet ssh
    scheduler max-task-time 5000
    end
    Your help would be very appreciated!
    PS: I know it is easier if i config Site A as the VPN server but in out scenario, we need to access printer from internet over static WAN IP of site A.
    Thanks,
    Thai

    Is there anyone can help please?

Maybe you are looking for

  • LG Revolution isn't receiving text messages?

    I got my cell phone on Black Friday, I was so excited and no I am just frustrated. I don't receive text messages half the time and my phone randomly turns off and on. Is there anyway to fix the text message problem because as a young adult that is ho

  • Problem with restore win8 after change hardware. (GT70 0ND-492US)

    Hi everyone! I have de notebook model GT70 0ND-492US  this came with one msata ssd with 128gb and i add other the same model for use super raid, that came with win8, but i make the downgrade to win7.  But now i cant make the recovery to win8 with ori

  • Checking the OS X disk...

    Hi, is there any way, I could test the installation DVD (OS X Leopard) for consistency, i.e. that it doesn't have errors, and is not damaged, before I perform the installation? I know, that when I insert the DVD, and the Installer is being launched,

  • Banshee and streaming .pls files

    Hey fellas. I'm trying to stream some .pls internet radio stations through Banshee 1.4.2 (on GNOME 2.24.3 on Arch64) with no success, but Banshee 1.4.3 under Ubuntu 8.10 on my netbook can stream the station fine. The Banshee website states that Bansh

  • Come riattivare il mio Reader?

      Da  quando ho fatto un ripristino avanzato del mio computer in seguito al quale si sono cancellati tutti i programmi istallati sulmio computer, il mio Id Adobe non viene riconosciuto e, se cerco di aprire i nuovi libri che ho acquistato e caricato