Newsgroup: it.comp.reti.cisco
Titolo: Cisco 877 configurazione...non navigo

Ciao Ragazzi,
sto configurando il cisco 877 ma quando metto l'access-list 101 non
navigo più...
se poi la ritolgo navigo bene....
mi dovrei connettere a access-list 101 permit ip host 199.xxx.xxx.xxx
any
all'indirizzo interno .200 sulla porta 80 per esempio. Utilizzo la
loopback1 perchè voglio
uscire con quell'indirizzo ed essere raggiunto a quell'indirzzo.
Grazie a quanti vorranno aiutarmi...
Ciao Marco.Aesis
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname gw-test-sed
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
no aaa new-model
!
resource policy
!
!
!
ip cef
ip inspect log drop-pkt
ip inspect name SDM_HIGH dns
ip inspect name SDM_HIGH esmtp
ip inspect name SDM_HIGH https
ip inspect name SDM_HIGH imap reset
ip inspect name SDM_HIGH pop3 reset
ip inspect name SDM_HIGH udp
ip inspect name SDM_HIGH ftp
no ip domain lookup
ip domain name 
yourdomain.com
ip name-server 151.99.125.1
ip name-server 151.99.0.100
!
!
crypto pki trustpoint TP-self-signed-
3263051631
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-
3263051631
 revocation-check none
 rsakeypair TP-self-signed-
3263051631
!
!
crypto pki certificate chain TP-self-signed-
3263051631
 certificate self-signed 01
  3082024F 308201B8 A0030201 02020101 300D0609 2A864886 F70D0101
04050030
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D
43657274
  69666963 6174652D 33323633 30353136 3331301E 170D3032 30333031
30303035
  35315A17 0D323030 31303130 30303030 305A3031 312F302D 06035504
03132649
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33
32363330
  35313633 3130819F 300D0609 2A864886 F70D0101 01050003 818D0030
81890281
  8100C21F DE837CEE B2A252D8 543E9449 F1EE8EE1 92B1F1B6 1C0A3CD2
B28D8F36
  B185C1CD 3151AC9F C67B10F5 C1C5F80F 2850A3E0 7DECC651 F6B9A0BC
8F380AD9
  DA7FE4C6 D328184C D6EEC367 0830FEB5 B160DB2A 0910A405 CEFC6FCB
BFDEE5DE
  874D0118 1B3A49E0 F516E236 46E056AB F7A77FB4 A7DEEB6D 41814A32
C0495976
  ADCB0203 010001A3 77307530 0F060355 1D130101 FF040530 030101FF
30220603
  551D1104 1B301982 17796F75 726E616D 652E796F 7572646F 6D61696E
2E636F6D
  301F0603 551D2304 18301680 1421964A 864AD61D 4C289610 D91433E1
550CEA51
  EA301D06 03551D0E 04160414 21964A86 4AD61D4C 289610D9 1433E155
0CEA51EA
  300D0609 2A864886 F70D0101 04050003 81810090 B54AF98C 2051B828
1F7C8D74
  E86E5460 56F6A71C E98E0B59 A7053225 21692722 3018B655 34EFB5E1
27B82BAD
  4E12477A BBABE64F D4589728 6A69323F 668E7B7A 8C3F7135 C4A7C65E
866A30F2
  E459C80F FBBBCA9F E8A068BC 48E325F6 32864DB6 7D033221 ACF30BFD
C67BBD4E
  253F2D5B 08E77E00 C5AD9F21 C25EC43E 2D595B
  quit
username cisco privilege 15 secret 5 $1$JmvF$oME3Gw.Kb3huJJB.g4Fga/
archive
 log config
  hidekeys
!
!
!
!
!
interface Loopback0
 ip address xxx.xxx.xxx.241 255.255.255.255
!
interface Loopback1
 ip address xxx.xxx.xxx.242 255.255.255.255
!
interface ATM0
 description ADSL Interface
 no ip address
 no atm ilmi-keepalive
 dsl operating-mode auto
!
interface ATM0.1 point-to-point
 description PVC Alice Business
 ip address xxx.xxx.xxx.xxx 255.255.255.248
 ip access-group 101 in
 ip nat outside
 ip virtual-reassembly
 no snmp trap link-status
 pvc 8/35
  encapsulation aal5snap
 !
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
 description $FW_INSIDE$
 ip address 192.168.1.17 255.255.255.0
 ip access-group 100 in
 ip inspect SDM_HIGH in
 ip nat inside
 ip virtual-reassembly
 ip tcp adjust-mss 1452
!
no ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 ATM0.1
ip route xxx.82.xxx.xxx 255.255.255.248 Null0
!
no ip http server
no ip http secure-server
ip nat inside source list NATOUT interface Loopback1 overload
ip nat inside source static tcp 192.168.1.200 80 interface Loopback1
80
ip nat inside source static tcp 192.168.1.200 5800 interface Loopback1
5800
ip nat inside source static tcp 192.168.1.200 5900 interface Loopback1
5900
ip nat inside source static tcp 192.168.1.200 7000 interface Loopback1
7000
!
ip access-list extended NATOUT
 remark Traffico Internet
 permit ip 192.168.1.0 0.0.0.255 any
!
access-list 10 remark --------------
access-list 10 remark
access-list 10 permit 192.168.1.0 0.0.0.255
access-list 10 remark Teleassistenza
access-list 100 remark auto generated by SDM firewall configuration
access-list 100 remark SDM_ACL Catego
access-list 100 deny   ip host 255.255.255.255 any
access-list 100 deny   ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
access-list 101 permit ip host 199.xxx.xxx.xxx any
access-list 101 deny ip any any log
snmp-server community public RO 10
snmp-server community private RW 10

Innanzitutto, imagino che gli indirizzi delle Loopback siano sulla
classe dei tuoi IP pubblici, quindi la Subnet-Mask che hai usato penso
sia sbagliata: se hai 8 IP pubblici, la SM è 255.255.255.248.
E questa stessa SM va usata anche le le Loopback
Ma soprattutto, la 101 applicata sulla ATM è sbagliata:
Ti filtra i paccheti IN INGRESSO (quindi quelli che arrivano da
InterNet) che difficilmente avranno IP 192.x.x.x., che dovrebbe
esserela tua classe interna
Tu cosa volevi fare, esattamente?
Claudio


Ciao Claudio,
no filtro da internet gli indirizzi che provengono dal
199.xxx.xxx.xxx; qiundi ip pubblici.
Forse il problema sta sul ip inspect che ho omesso la direttiva per il
tcp e http. Farò una prova.
Grazie. Ciao Marco.Aesis