Конфигурация сети такова: пограничный маршрутизатор Cisco 2620XM, к нему транком подключён Cisco Catalyst 3550 Switch, к каталисту соотвественно оконечные хосты (dsl-клиенты, dial-up, сервера, и т. д.). Привожу конфиги с обоих.
Звездочки в ай-пи-адресах - означает внешняя подсеть.Cisco 2620XM:
-----------------------------------------------------------------------------
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
no service dhcp
!
hostname domain-main-gw
!
boot-start-marker
boot system flash c2600-ipbasek9-mz.124-8.bin
boot-end-marker
!
logging buffered 32768 informational
no logging console
enable secret 5 ***********************************
enable password 7 ********************************
!
no aaa new-model
!
resource policy
!
clock timezone *** 8
no network-clock-participate slot 1
no network-clock-participate wic 0
no ip source-route
ip cef
!
!
!
!
no ip bootp server
ip domain list domain.ru
no ip domain lookup
ip domain name domain.ru
ip name-server *.*.116.1
ip name-server *.*.125.3
ip accounting-list 0.0.0.2 255.255.255.252
ip accounting-list 0.0.0.0 255.255.255.0
ip rcmd rsh-enable
ip rcmd remote-host root 192.168.168.2 root enable
ip rcmd remote-host billing 192.168.168.2 billing enable
!
!
!
username bob password 7 *******************
!
!
class-map match-any http-hacks
match protocol http url "*default.ida*"
match protocol http url "*x.ida*"
match protocol http url "*cmd.exe*"
match protocol http url "*root.exe*"
!
!
policy-map mark-inbound-http-hacks
class http-hacks
set ip dscp 1
!
!
!
interface Loopback0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
!
interface FastEthernet0/0
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
duplex auto
speed auto
!
interface FastEthernet0/0.1
encapsulation dot1Q 1 native
ip nat inside
!
interface FastEthernet0/0.10
encapsulation dot1Q 10
ip address 192.168.0.100 255.255.255.0 secondary
ip address *.*.125.1 255.255.255.0
ip access-group eth in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
!
interface FastEthernet0/0.20
encapsulation dot1Q 20
ip address 192.168.168.1 255.255.255.0
ip nat inside
!
interface FastEthernet0/0.30
encapsulation dot1Q 30
ip address 10.10.1.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
!
interface FastEthernet0/0.40
encapsulation dot1Q 40
ip address 10.10.2.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
!
interface Serial0/0
bandwidth 2048
ip address *.*.96.218 255.255.255.252
ip access-group in_block in
ip access-group out_block out
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
rate-limit input access-group 147 128000 8000 8000 conform-action transmit exceed-action drop
rate-limit input access-group 146 64000 8000 8000 conform-action transmit exceed-action drop
no logging event link-status
no fair-queue
service-policy input mark-inbound-http-hacks
!
interface Serial0/1
ip address *.*.96.218 255.255.255.252
shutdown
!
ip route 0.0.0.0 0.0.0.0 *.*.96.217
ip flow-export source FastEthernet0/0.10
ip flow-export version 9
ip flow-export destination *.*.125.13 9001
!
no ip http server
no ip http secure-server
ip nat inside source list 1 interface Serial0/0 overload
ip nat inside source static 10.10.1.33 *.*.125.99 extendable
ip nat inside source static 10.10.2.37 *.*.125.199 extendable
ip nat inside source static 10.10.1.45 *.*.125.200 extendable
ip nat inside source static 10.10.2.38 *.*.125.201 extendable
!
ip access-list standard eth
permit *.*.125.199
permit *.*.125.200
permit *.*.125.201
permit *.*.125.30
permit *.*.125.1
permit *.*.125.2
permit *.*.125.3
permit *.*.125.4
permit *.*.125.5
permit *.*.125.6
permit *.*.125.7
permit *.*.125.8
permit *.*.125.9
permit *.*.125.10
permit *.*.125.11
permit *.*.125.12
permit *.*.125.13
permit *.*.125.14
permit *.*.125.45
permit *.*.125.120
permit *.*.125.99
permit 10.0.0.0 0.255.255.255
permit 192.0.0.0 0.255.255.255
!
ip access-list extended in_block
deny ip 10.0.0.0 0.255.255.255 any
deny ip 127.0.0.0 0.255.255.255 any
deny ip 172.16.0.0 0.15.255.255 any
deny ip 192.168.0.0 0.0.255.255 any
deny udp any any range netbios-ns netbios-ss log
deny tcp any any range 135 139 log
deny tcp any any eq 445 log
deny udp any any eq 31337 log
deny udp any any eq 22 log
deny tcp any any range exec lpd log
deny udp any any eq sunrpc log
deny tcp any any eq sunrpc log
deny udp any any eq xdmcp log
deny tcp any any eq 177 log
deny tcp any any range 6000 6063 log
deny udp any any range 6000 6063 log
deny udp any any range biff syslog log
deny tcp any any eq 11 log
deny udp any any eq tftp log
deny udp any any range snmp snmptrap log
permit ip any any
deny ip host 10.10.10.254 any
deny ip host 10.10.1.254 any
ip access-list extended out_block
permit ip any any
!
logging facility local6
logging source-interface FastEthernet0/0.10
logging *.*.125.3
access-list 1 permit 192.168.0.101
access-list 1 permit 10.10.2.31
access-list 1 permit 10.10.1.31
access-list 1 permit 10.10.1.33
access-list 1 permit 10.10.2.34
access-list 1 permit 10.10.1.32
access-list 1 permit 10.10.2.35
access-list 1 permit 10.10.1.35
access-list 1 permit 10.10.2.32
access-list 1 permit 10.10.2.33
access-list 1 permit 10.10.1.34
access-list 1 permit 10.10.2.38
access-list 1 permit 10.10.1.37
access-list 1 permit 10.10.1.36
access-list 1 permit 10.10.2.36
access-list 1 permit 10.10.1.38
access-list 1 permit 10.10.2.37
access-list 1 permit 10.10.1.41
access-list 1 permit 10.10.2.42
access-list 1 permit 10.10.2.43
access-list 1 permit 10.10.1.43
access-list 1 permit 10.10.1.42
access-list 1 permit 10.10.2.41
access-list 1 permit 10.10.2.46
access-list 1 permit 10.10.1.45
access-list 1 permit 10.10.1.44
access-list 1 permit 10.10.1.47
access-list 1 permit 10.10.2.44
access-list 1 permit 10.10.1.46
access-list 1 permit 10.10.2.45
access-list 1 permit 10.10.1.48
access-list 1 permit 10.10.1.51
access-list 1 permit 10.10.2.48
access-list 1 permit 10.10.1.53
access-list 1 permit 10.10.1.52
access-list 1 permit 192.168.0.8
access-list 1 deny 192.168.0.31
access-list 1 permit 192.168.168.10
access-list 2 deny 10.0.0.0 0.255.255.255
access-list 2 permit any
access-list 100 permit ip host 192.168.0.8 any
access-list 100 deny ip 192.168.0.0 0.0.0.255 any
access-list 101 deny ip host 192.168.0.31 any
access-list 101 deny ip host 192.168.0.8 any
access-list 101 permit ip 192.168.0.0 0.0.0.255 any
access-list 145 permit ip any host *.*.125.5
access-list 146 permit ip any host *.*.125.8
access-list 147 permit ip any host *.*.125.7
snmp-server community technology RO
snmp-server community trap_style RW
snmp-server enable traps tty
route-map 1 permit 10
!
route-map forced-proxy permit 10
match ip address 101
set ip next-hop *.*.125.3
!
!
control-plane
!
!
line con 0
login local
line aux 0
login local
line vty 0
login local
line vty 1
login local
transport input telnet
line vty 2 4
login local
line vty 5 10
login local
rotary 1
transport input pad telnet rlogin mop udptn v120
line vty 11 15
login local
!
ntp clock-period 17246762
ntp server *.*.
125.2
!
end
-----------------------------------------------------------------------------
Cisco Catalyst 3550:
-----------------------------------------------------------------------------
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname domain-main-switch
!
enable secret 5 ***************************
enable password 7 *******************************
!
username bob password 7 *************************
no aaa new-model
clock timezone **** 8
ip subnet-zero
no ip source-route
ip host-routing
!
ip domain-name domain.ru
!
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
!
!
vlan internal allocation policy ascending
!
!
interface FastEthernet0/1
description Trunk link to Cisco 2620XM
switchport trunk encapsulation dot1q
switchport mode trunk
no logging event link-status
spanning-tree portfast
!
interface FastEthernet0/2
description LAN
switchport access vlan 10
switchport mode access
no logging event link-status
!
interface FastEthernet0/3
description AS5350 Dial-Up
switchport access vlan 10
switchport mode dynamic desirable
no logging event link-status
spanning-tree portfast
!
interface FastEthernet0/4
switchport access vlan 10
switchport mode access
no logging event link-status
spanning-tree portfast
!
interface FastEthernet0/5
switchport access vlan 10
switchport mode access
no logging event link-status
!
interface FastEthernet0/6
switchport access vlan 10
switchport mode dynamic desirable
no logging event link-status
!
interface FastEthernet0/7
switchport access vlan 20
switchport mode dynamic desirable
no logging event link-status
spanning-tree portfast
!
interface FastEthernet0/8
switchport access vlan 10
switchport mode dynamic desirable
no logging event link-status
spanning-tree portfast
!
interface FastEthernet0/9
switchport access vlan 10
switchport mode dynamic desirable
no logging event link-status
!
interface FastEthernet0/10
switchport access vlan 20
switchport mode dynamic desirable
no logging event link-status
!
interface FastEthernet0/11
switchport access vlan 10
switchport mode dynamic desirable
no logging event link-status
!
interface FastEthernet0/12
switchport access vlan 40
switchport mode dynamic desirable
no logging event link-status
spanning-tree portfast
!
interface FastEthernet0/13
description DSLAM ZYXEL ADSL_1
switchport access vlan 30
switchport mode dynamic desirable
no logging event link-status
!
interface FastEthernet0/14
description DSLAM ZYXEL ADSL_2
switchport access vlan 40
switchport mode dynamic desirable
no logging event link-status
!
interface FastEthernet0/15
description DSLAM ZYXEL ADSL_3
switchport access vlan 30
switchport mode dynamic desirable
no logging event link-status
!
interface FastEthernet0/16
description DSLAM ZYXEL ADSL_4
switchport access vlan 40
switchport mode dynamic desirable
no logging event link-status
!
interface FastEthernet0/17
switchport access vlan 30
switchport mode dynamic desirable
no logging event link-status
!
interface FastEthernet0/18
switchport mode dynamic desirable
no logging event link-status
!
interface FastEthernet0/19
switchport mode dynamic desirable
no logging event link-status
!
interface FastEthernet0/20
switchport mode dynamic desirable
no logging event link-status
!
interface FastEthernet0/21
switchport access vlan 10
switchport mode dynamic desirable
no logging event link-status
!
interface FastEthernet0/22
description Cisco AS5350 120 lines
switchport access vlan 10
switchport mode dynamic desirable
no logging event link-status
!
interface FastEthernet0/23
description DSLAM ZYXEL ADSL_5
switchport access vlan 30
switchport mode dynamic desirable
no logging event link-status
!
interface FastEthernet0/24
description Trunk link to Catalyst2950
switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate
no logging event link-status
shutdown
!
interface GigabitEthernet0/1
switchport access vlan 10
switchport mode access
no logging event link-status
!
interface GigabitEthernet0/2
switchport mode dynamic desirable
no logging event link-status
shutdown
!
interface Vlan1
no ip address
no ip route-cache
shutdown
!
interface Vlan10
ip address 192.168.0.163 255.255.255.0
no ip route-cache
!
interface Vlan20
no ip address
no ip route-cache
!
interface Vlan30
no ip address
no ip route-cache
!
interface Vlan40
no ip address
no ip route-cache
!
ip default-gateway 192.168.0.100
ip classless
no ip http server
!
!
!
!
logging *.*.125.3
access-list 1 deny 10.0.0.0 0.255.255.255
access-list 1 permit any
access-list 101 deny tcp 10.0.0.0 0.255.255.255 any
access-list 101 permit ip any any
!
control-plane
!
!
line con 0
login local
line vty 0 4
password 7 0313530E0303
login local
line vty 5 15
password 7 044C03030A2D
login local
!
ntp clock-period 17246764
ntp server *.*.125.2
!
end
-----------------------------------------------------------------------------
192.168.0.0/24 - корпоративная сеть.
*.*.125.0/24 - внешняя сеть.
Если допустим кто-то начинает копировать большой объём данных между разными подсетями - маршрутизатор уходит в ступор. Вот и хочу перенести VLANы на каталист, поднять там маршрутизацию и т. д. В связи с этим вопрос: какие грабли меня ожидают? Может кто уже сталкивался с этим - дайте дельные советы и предложения.
Вариант для распечатки
Маршрутизаторы CISCO и др. оборудование. (Public)
(ok) on 21-Июн-06, 10:40 
