Re: IOS 12.4(20) ZBF - DHCP server problems

Author	All Replies
mocah join:2003-04-11 Slovenia	reply to mocah Re: IOS 12.4(20) ZBF - DHCP server problems I have the same problem on Cisco 871. Because the config on Cisco 871 is simpler I will post that config: C871#sh run Building configuration... Current configuration : 8659 bytes ! version 12.4 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption service sequence-numbers ! hostname C871 ! boot-start-marker boot-end-marker ! security authentication failure rate 2 log security passwords min-length 10 logging message-counter syslog no logging console enable secret 5 $ ! aaa new-model ! ! ! ! aaa session-id common clock timezone CET 1 clock summer-time CET recurring last Sun Mar 2:00 last Sun Oct 3:00 ! crypto pki trustpoint TP-self-signed-2100979184 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-2100979184 revocation-check none rsakeypair TP-self-signed-2100979184 ! ! crypto pki certificate chain TP-self-signed-2100979184 certificate self-signed 01 30820248 308201B1 A0030201 02020101 300D0609 2A864886 F70D0101 04050030 5BAA36E2 2F597053 33C8C451 quit dot11 syslog no ip source-route ! ! no ip dhcp use vrf connected no ip dhcp conflict logging ip dhcp excluded-address 192.168.1.1 192.168.1.5 ! ip dhcp pool VLAN1 import all network 192.168.1.0 255.255.255.0 default-router 192.168.1.1 dns-server xxx.xxx.xxx.13 xxx.xxx.xxx.23 lease 7 7 7 ! ! ip cef no ip bootp server no ip domain lookup ip domain name koli.net ip port-map http port tcp 8080 login block-for 305 attempts 2 within 100 ! no ipv6 cef multilink bundle-name authenticated ! password encryption aes ! ! username mogul privilege 15 secret 5 $1$xpjH$q ! ! ! archive log config hidekeys ! ! ip ssh authentication-retries 2 ip ssh logging events ip ssh version 2 ! class-map type inspect match-any p2p-cmap match protocol bittorrent match protocol bittorrent signature class-map type inspect match-any Internet-cmap match protocol http match protocol https match protocol ssh match protocol ftp match protocol ftps match protocol icmp match protocol pop3s match protocol bittorrent match protocol bittorrent signature class-map type inspect match-any ISPtraffic match protocol dns match protocol pop3 match protocol smtp extended match protocol ntp class-map type inspect match-all ISPtraffic-cmap match access-group name ISPtraffic match class-map ISPtraffic class-map type inspect match-all PING-cmap match access-group name ICMP class-map type inspect match-all TIME-cmap match access-group name TIME class-map type inspect match-all RouterManagement-cmap match access-group name RouterManagement class-map type inspect match-all DHCP-cmap match access-group name DHCP class-map type inspect match-all SSHaccess-cmap match access-group name SSHaccess ! ! policy-map type inspect Inside2Router-pmap class type inspect RouterManagement-cmap inspect class type inspect PING-cmap inspect class type inspect DHCP-cmap inspect class class-default drop policy-map type inspect Router2Inside-pmap class type inspect RouterManagement-cmap inspect class type inspect PING-cmap inspect class type inspect DHCP-cmap inspect class class-default drop policy-map type inspect Outside2Router-pmap class type inspect SSHaccess-cmap inspect class type inspect PING-cmap inspect class class-default drop policy-map type inspect Router2Outside-pmap class type inspect SSHaccess-cmap inspect class type inspect PING-cmap inspect class type inspect TIME-cmap inspect policy-map type inspect Inside2Outside-pmap class type inspect Internet-cmap inspect class type inspect ISPtraffic-cmap inspect class class-default drop policy-map type inspect Outside2Inside-pmap class type inspect p2p-cmap inspect class class-default drop ! zone security Private description LAN zone security WAN description WAN zone security DMZ description DMZ zone-pair security Inside2Outside source Private destination WAN service-policy type inspect Inside2Outside-pmap zone-pair security Outside2Router source WAN destination self service-policy type inspect Outside2Router-pmap zone-pair security Router2Outside source self destination WAN service-policy type inspect Outside2Router-pmap zone-pair security Lan2Router source Private destination self service-policy type inspect Inside2Router-pmap zone-pair security Router2Lan source self destination Private service-policy type inspect Router2Inside-pmap zone-pair security Outside2Inside source WAN destination Private description Za p2p protocol bittorent service-policy type inspect Outside2Inside-pmap ! ! ! interface FastEthernet0 ! interface FastEthernet1 ! interface FastEthernet2 ! interface FastEthernet3 ! interface FastEthernet4 description $ETH-WAN$ no ip address no ip unreachables zone-member security WAN duplex auto speed auto pppoe enable group global pppoe-client dial-pool-number 1 ! interface Vlan1 description Local LAN ip address 192.168.1.1 255.255.255.0 ip nat inside ip virtual-reassembly zone-member security Private ip tcp adjust-mss 1452 ! interface Dialer1 description IP address xxx.xxx.xxx.xxx ip address negotiated no ip unreachables ip mtu 1492 ip nat outside ip virtual-reassembly zone-member security WAN encapsulation ppp dialer pool 1 dialer-group 1 no cdp enable ppp authentication chap callin ppp chap hostname username12 ppp chap password 7 0118423346756343 ! interface Dialer0 no ip address no cdp enable ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Dialer1 no ip http server no ip http secure-server ! ! ip nat inside source list 1 interface Dialer1 overload ip nat inside source static udp 192.168.1.10 6885 interface Dialer1 6885 ip nat inside source static tcp 192.168.1.10 6881 interface Dialer1 6881 ip nat inside source static tcp 192.168.1.10 6882 interface Dialer1 6882 ip nat inside source static tcp 192.168.1.10 6883 interface Dialer1 6883 ip nat inside source static tcp 192.168.1.10 6884 interface Dialer1 6884 ip nat inside source static tcp 192.168.1.10 6885 interface Dialer1 6885 ip nat inside source static tcp 192.168.1.10 6886 interface Dialer1 6886 ip nat inside source static tcp 192.168.1.10 6887 interface Dialer1 6887 ip nat inside source static tcp 192.168.1.10 6888 interface Dialer1 6888 ip nat inside source static tcp 192.168.1.10 6889 interface Dialer1 6889 ! ip access-list extended DHCP permit udp any any eq bootps permit udp any any eq bootpc ip access-list extended ICMP permit icmp any any echo permit icmp any any echo-reply permit icmp any any traceroute permit icmp any any host-unreachable permit icmp any any packet-too-big deny icmp any any fragments ip access-list extended ISPtraffic permit udp any host xxx.xxx.160.13 eq domain permit udp any host xxx.xxx.160.23 eq domain permit tcp any any eq pop3 permit tcp any any eq smtp ip access-list extended RouterManagement permit tcp any any eq 22 permit tcp any any eq 443 ip access-list extended SSHaccess permit tcp any any eq 22 ip access-list extended TIME permit udp any any eq ntp ! access-list 1 remark Access List for Dialer 1 access-list 1 permit 192.168.1.0 0.0.0.255 dialer-list 1 protocol ip permit no cdp run ! ! ! ! ! control-plane ! ! line con 0 no modem enable line aux 0 line vty 0 4 transport input ssh transport output ssh ! scheduler max-task-time 5000 ntp server xxx.xxx.xxx.xxx end C871#
mocah join:2003-04-11 Slovenia	to forum · permalink · · 2008-08-12 09:54:09 ·


Saturday, 22-Nov 11:41:02	Terms of Use \| Privacy Policy \| Hosting by www.nac.net - DSL,Hosting & Co-lo \| feedback \| contact over 9 years online! © 1999-2008 dslreports.com.republican-creole page compression OFF