Отклоненное соединение FIREWALLTMG 02.07.2015 17:42:37
Тип журнала: Служба межсетевого экрана
Состояние: Пользовательские запросы запрещены правилами политики.
Правило: Правило по умолчанию
Источник: Демилитаризованная зона (zzz.zzz.zzz.zzz:20389)
Назначение: Локальный компьютер (10.25.10.29:80)
Протокол: HTTP

!
version 15.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname siska
!
boot-start-marker
boot-end-marker
!
!
aaa new-model
!
!
aaa authentication login default local
!
!
!
!
!
aaa session-id common
clock timezone MSK 3 0
!
!
!
!
!
!
no ip source-route
!
!
!
!
!
!
!
!
!
!
!
!
no ip bootp server
ip domain name test.lo
ip name-server 77.88.8.8
ip name-server 8.8.8.8
ip name-server 77.88.8.1
ip name-server 8.8.4.4
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
cts logging verbose
!
!
archive
log config
logging enable
hidekeys
!
redundancy
!
!
!
!
no cdp run
!
track 10 ip sla 1 reachability
!
track 20 ip sla 2 reachability
!
track 30 ip sla 3 reachability
!
track 100 list boolean or
object 10
object 20
object 30
delay down 10 up 5
!
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
!
!
!
!
!
!
!
!
!
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
description Prov1
ip address XXX.XXX.XXX.179 255.255.255.248
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
no cdp enable
!
interface GigabitEthernet0/1
description Prov2
ip address YYY.YYY.YYY.22 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
no cdp enable
!
interface GigabitEthernet0/0/0
switchport access vlan 55
no ip address
!
interface GigabitEthernet0/0/1
no ip address
shutdown
!
interface GigabitEthernet0/0/2
no ip address
shutdown
!
interface GigabitEthernet0/0/3
no ip address
shutdown
!
interface Vlan1
no ip address
!
interface Vlan55
description ToTMG
ip address 10.25.10.30 255.255.255.252
ip nat inside
ip virtual-reassembly in
!
ip local policy route-map PBR_SLA
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip dns server
ip nat inside source route-map Inet1 interface GigabitEthernet0/0 overload
ip nat inside source route-map Inet2 interface GigabitEthernet0/1 overload
ip nat inside source static tcp 10.25.10.29 80 YYY.YYY.YYY.22 80 route-map Inet2 extendable
ip nat inside source static tcp 10.25.10.29 80 XXX.XXX.XXX.179 80 route-map Inet1 extendable
ip route 0.0.0.0 0.0.0.0 XXX.XXX.XXX.177 track 100
ip route 0.0.0.0 0.0.0.0 YYY.YYY.YYY.21 250
!
ip access-list extended DMZ
permit ip 10.25.10.28 0.0.0.3 any
ip access-list extended SLA_ACL
permit icmp host XXX.XXX.XXX.179 host 77.88.8.8
permit icmp host XXX.XXX.XXX.179 host 217.69.139.200
permit icmp host XXX.XXX.XXX.179 host 8.8.8.8
!
ip sla 1
icmp-echo 77.88.8.8 source-interface GigabitEthernet0/0
threshold 1000
timeout 1500
frequency 3
ip sla schedule 1 life forever start-time now
ip sla 2
icmp-echo 217.69.139.200 source-interface GigabitEthernet0/0
threshold 1000
timeout 1500
frequency 3
ip sla schedule 2 life forever start-time now
ip sla 3
icmp-echo 8.8.8.8 source-interface GigabitEthernet0/0
threshold 1000
timeout 1500
frequency 3
ip sla schedule 3 life forever start-time now
!
route-map Inet1 permit 10
match ip address DMZ
match interface GigabitEthernet0/0
!
route-map PBR_SLA permit 10
match ip address SLA_ACL
set ip next-hop XXX.XXX.XXX.177
!
route-map Inet2 permit 10
match ip address DMZ
match interface GigabitEthernet0/1
!
!
!
!
!
control-plane
!
!
line con 0
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport output lat pad Inet2net rlogin lapb-ta mop udptn v120 ssh
stopbits 1
line vty 0 4
privilege level 15
transport input telnet ssh
!
scheduler allocate 20000 1000
ntp update-calendar
ntp server ru.pool.ntp.org
event manager applet Inet1_UP
event track 100 state up
action 001 cli command "enable"
action 002 cli command "clear ip nat trans *"
action 003 syslog msg "Inet1 is UP"
event manager applet Inet1_DOWN
event track 100 state down
action 001 cli command "enable"
action 002 cli command "clear ip nat trans *"
action 003 syslog msg "Inet1 is DOWN"
!
end