CORE ROUTER Current configuration : 3498 bytes ! version 12.

4 service timestamps log datetime msec no service timestamps debug datetime msec service password-encryption security passwords min-length 10 ! hostname CORP ! ! ! enable secret 5 $1$mERr$UBS6AqpcFjkupAnmSUCGG. ! ! ! ! ! aaa new-model ! --More--aaa new-model ! aaa authentication login default local !

! aaa authorization exec default local ! ! ! ! ! username CORPADMIN secret 5 $1$mERr$fPunCIN6tB/A1os48VIRu. username Internet password 7 08024F40082A261E010803 username SSHAccess secret 5 $1$mERr$3mVxZHExBNJRy65mTbcvz. ! crypto isakmp policy 10 encr aes 256 authentication pre-share group 2 ! crypto isakmp key Vpnpass101 address 198.133.219.2 ! ! crypto ipsec transform-set VPN-SET esp-3des esp-sha-hmac ! crypto map VPN-MAP 10 ipsec-isakmp set peer 198.133.219.2 set transform-set VPN-SET match address 120

! ! ! ip ssh version 2 ip ssh authentication-retries 2 ip ssh time-out 90 ip domain-name theccnas.com ! ! ip inspect audit-trail --ip inspect audit-trail ip inspect name INTOCORP icmp ip inspect name INTOCORP tcp ip inspect name INTOCORP udp spanning-tree mode pvst ! ip ips config location flash:ipsdir/ retries 1 ip ips name corpips ip ips signature-category category all retired true category ios_ips basic retired false ! !

! interface FastEthernet0/0 ip address 10.1.1.254 255.255.255.0 ip ips corpips out ip access-group DMZFIREWALL out ip nat inside duplex auto speed auto ! interface FastEthernet0/1 no ip address duplex auto speed auto ! interface FastEthernet0/1.10 encapsulation dot1Q 10 ip address 172.16.10.254 255.255.255.0 ip nat inside ! interface FastEthernet0/1.25 encapsulation dot1Q 25 ip address 172.16.25.254 255.255.255.0 ip nat inside More--interface FastEthernet0/1.99 encapsulation dot1Q 99 native

ip address 172.16.99.254 255.255.255.0 ! interface Serial0/0/0 ip address 209.165.200.226 255.255.255.252 encapsulation ppp ppp authentication chap ip access-group INCORP in ip nat outside ip inspect INTOCORP out no cdp enable crypto map VPN-MAP ! interface Serial0/0/1 no ip address shutdown ! interface Vlan1 no ip address shutdown ! ip nat pool PATPOOL 209.165.200.245 209.165.200.248 netmask 255.255.255.240 ip nat inside source list 1 pool PATPOOL overload ip nat inside source static 10.1.1.2 209.165.200.241 ip nat inside source static 10.1.1.5 209.165.200.242 ip classless

ip route 0.0.0.0 0.0.0.0 Serial0/0/0 ! ! access-list 1 permit 172.16.0.0 0.0.255.255 access-list 12 permit host 172.16.25.5 access-list 12 permit host 198.133.219.35 ip access-list extended DMZFIREWALL permit tcp any host 10.1.1.2 eq www permit tcp any host 10.1.1.5 eq domain permit udp any host 10.1.1.5 eq domain permit ip 172.16.25.0 0.0.0.255 10.1.1.0 0.0.0.255 permit tcp 198.133.219.32 0.0.0.31 host 10.1.1.2 eq ftp --More-ip access-list extended INCORP permit tcp any host 209.165.200.241 eq www permit tcp any host 209.165.200.242 eq domain permit udp any host 209.165.200.242 eq domain permit tcp 198.133.219.0 0.0.0.31 host 209.165.200.226 eq 22 permit ip host 198.133.219.2 host 209.165.200.226 permit ip 198.133.219.32 0.0.0.31 209.165.200.240 0.0.0.15 access-list 120 permit ip 209.165.200.240 0.0.0.15 198.133.219.32 0.0.0.31 ! banner motd ^CAuthorized Access Only!^C ! !

! ! logging 172.16.25.2 line con 0 exec-timeout 20 0 logging synchronous line vty 0 4 access-class 12 in exec-timeout 20 0 transport input ssh line vty 5 15 access-class 12 in exec-timeout 20 0 transport input ssh ! ! ntp server 172.16.25.2 key 0 ntp update-calendar ! end BRANCH Current configuration : 2015 bytes ! version 12.4 no service timestamps log datetime msec

no service timestamps debug datetime msec service password-encryption security passwords min-length 10 ! hostname Branch ! ! ! enable secret 5 $1$mERr$UBS6AqpcFjkupAnmSUCGG. ! ! ! ! ! ! username CORPADMIN secret 5 $1$mERr$fPunCIN6tB/A1os48VIRu.

username Internet password 7 08024F40082A261E010803 ! crypto isakmp policy 10 encr aes 256 authentication pre-share group 2 ! crypto isakmp key Vpnpass101 address 209.165.200.226

! ! crypto ipsec transform-set VPN-SET esp-3des esp-sha-hmac ! crypto map VPN-MAP 10 ipsec-isakmp set peer 209.165.200.226 set transform-set VPN-SET match address 120 ! ! ! ip ssh version 1 ip ssh authentication-retries 2 ip ssh time-out 90 ! ! spanning-tree mode pvst ! class-map type inspect match-all BR-IN-CLASS-MAP match access-group 110 ! policy-map type inspect BR-IN-OUT-PMAP class type inspect BR-IN-CLASS-MAP inspect !

! ! zone security BR-IN-ZONE --More-zone security BR-OUT-ZONE zone-pair security IN-OUT-ZPAIR source BR-IN-ZONE destination BR-OUT-ZONE service-policy type inspect BR-IN-OUT-PMAP ! interface FastEthernet0/0 ip address 198.133.219.62 255.255.255.224 zone-member security BR-IN-ZONE duplex auto speed auto ! interface FastEthernet0/1 no ip address duplex auto speed auto shutdown ! interface Serial0/0/0 ip address 198.133.219.2 255.255.255.252 zone-member security BR-OUT-ZONE encapsulation ppp ppp authentication chap

no cdp enable crypto map VPN-MAP ! interface Serial0/0/1 no ip address shutdown ! interface Vlan1 no ip address shutdown ! ip classless ip route 0.0.0.0 0.0.0.0 Serial0/0/0

access-list 110 permit ip 198.133.219.32 0.0.0.31 any access-list 120 permit ip 198.133.219.32 0.0.0.31 209.165.200.240 0.0.0.15 ! banner motd ^CAuthorized Access Only!^C ! ! ! ! line con 0 exec-timeout 20 0 logging synchronous

login local line vty 0 4 exec-timeout 20 0 login local transport input none line vty 5 15 exec-timeout 20 0 login local transport input none