Newsgroup: it.comp.reti.cisco
Titolo: Conf cisco 2610

Salve a tutti,
ho la rete configurata in questo modo:
rete 10.0.0.X --> LAN
rete 10.10.0.X --> DMZ
router cisco 827 configurato con 2 ip (uno per ogni rete)
firewall cisco 2610 configurato sulla rete 10.0.0.X
Il cisco 2610 dovrebbe filtrare i pacchetti e inviarli al router. La
navigazione di molti siti web funziona senza problemi ma siti tipo
windowsupdate mi rimangono su schermata bianca o 
tiscali.it
 che non
carica tutta la pagina. Vi posto la configurazione:
Using 3083 out of 29688 bytes
!
version 12.0
service timestamps debug uptime
service timestamps log uptime
service password-encryption
no service dhcp
!
hostname img_2610
!
logging buffered 4096 debugging
no logging console
enable secret 5 ZZZZZZZZZZZZZZZZZZZ
!
username XXXXXX password 7 ZZZZZZZZZZZZZZz
memory-size iomem 20
ip subnet-zero
ip domain-name XXXX
ip name-server 195.110.128.1
ip name-server 212.48.4.11
!
ip inspect one-minute low 36000
ip inspect one-minute high 36000
ip inspect udp idle-time 1200
ip inspect tcp idle-time 43200
ip inspect tcp finwait-time 1200
ip inspect tcp synwait-time 1000
!
!
 !
 !
 !
 !
 interface Ethernet0/0
 ip address 10.0.0.2 255.255.255.0
 no ip directed-broadcast
 ip nat inside
 full-duplex
!
interface Serial0/0
 no ip address
 no ip directed-broadcast
 no ip mroute-cache
 shutdown
!
interface Serial0/1
 no ip address
 no ip directed-broadcast
 no ip mroute-cache
 shutdown
!
ip default-gateway 10.0.0.5
ip nat translation timeout 3600
ip nat translation tcp-timeout 3600
ip nat translation udp-timeout 200
ip nat translation finrst-timeout 300
ip nat translation syn-timeout 120
ip nat translation icmp-timeout 40
ip nat translation max-entries 5000
ip nat inside source list 1 interface Ethernet0/0 overload
ip nat inside source static tcp 10.0.0.6 1194 10.0.0.5 1194 extendable
ip nat inside source static tcp 10.0.0.6 8080 10.0.0.5 8080 extendable
ip nat inside source static tcp 10.0.0.6 3306 10.0.0.5 3306 extendable
ip nat inside source static tcp 10.0.0.6 1433 10.0.0.5 1433 extendable
ip nat inside source static tcp 10.0.0.3 18881 10.0.0.5 18881
extendable
ip nat inside source static tcp 10.0.0.3 18880 10.0.0.5 18880
extendable
ip nat inside source static tcp 10.0.0.6 1433 10.10.0.11 1433
extendable
ip classless
ip route profile
ip route 0.0.0.0 0.0.0.0 10.0.0.5
no ip http server
!
!
ip access-list extended DMZ
 permit udp any host 224.0.0.2
 permit tcp host 10.10.0.10 eq 1433 host 10.0.0.6 eq 1433
ip access-list extended ESTERNA
 deny   ip 127.0.0.0 0.255.255.255 any
 deny   ip 172.16.0.0 0.15.255.255 any
ip access-list extended INTERNA
 permit udp 10.0.0.0 0.0.0.255 any eq domain
 permit tcp 10.0.0.0 0.0.0.255 any eq domain
 permit tcp 10.0.0.0 0.0.0.255 any eq www
 permit tcp 10.0.0.0 0.0.0.255 any eq 443
 permit tcp 10.0.0.0 0.0.0.255 any eq pop3
 permit tcp 10.0.0.0 0.0.0.255 any eq smtp
 permit tcp 10.0.0.0 0.0.0.255 any eq ftp
 permit tcp 10.0.0.0 0.0.0.255 any eq 1194
 permit tcp 10.0.0.0 0.0.0.255 any eq telnet
 permit tcp 10.0.0.0 0.0.0.255 any eq 1863
 permit udp 10.0.0.0 0.0.0.255 any eq 1863
 permit tcp 10.0.0.0 0.0.0.255 any eq 8080
 permit tcp 10.0.0.0 0.0.0.255 any eq ftp-data
 permit tcp 10.0.0.0 0.0.0.255 any eq echo
 permit tcp 10.0.0.0 0.0.0.255 any eq 1433
 permit tcp 10.0.0.0 0.0.0.255 any eq 143
 permit tcp 10.0.0.0 0.0.0.255 any eq 58617
access-list 1 permit 10.0.0.0 0.0.0.255
snmp-server engineID local 000000090200000196B9D120
snmp-server community public RO
!
line con 0
 transport input none
line aux 0
line vty 0 4
 password 7 123028305C1D18
 login
!
no scheduler allocate
end
Poi magari imposto anche qualche regola per gli accessi alla DMZ.
Ringrazio anticipatamente chi mi può aiutare

 ha scritto nel messaggio 
news:1166093349.6...@j72g2000cwa.googlegroups.com...


 ha scritto nel messaggionews:1166093349.6...@j72g2000cwa.googlegroups.com...


 > gianrico ficheraNon penso che ci siano problemi. Se metto come default gateway il cisco
