!
! Last configuration change at 12:24:46 PST Fri May 11 2007 by vadim
! NVRAM config last updated at 12:24:46 PST Fri May 11 2007 by vadim
!
version 12.2
service timestamps debug uptime
no service timestamps log uptime
service password-encryption
!
hostname "c3620"
!
no logging buffered
no logging console
aaa new-model
aaa new-model
aaa group server tacacs+ inttac
 server 10.1.0.1
!
enable secret 5 $1$U6dJ$BfnMsC23.X8BCFJB0XIJA.
enable password 7 <removed>
!
username user1 password 7 0123456789ABCDEF00
username user2 password 7 01234567890ABCDEF01234567890
clock timezone PST -7
ip subnet-zero
!
!
ip tcp synwait-time 10
ip cef
ip domain-name fwbuilder.org
ip name-server 10.1.1.10
!
ip audit notify log
ip audit po max-events 100
!
crypto isakmp policy 10
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp key <removed> address 22.22.22.22
crypto isakmp key <removed> address 192.168.171.1
!
crypto ipsec security-association lifetime seconds 28800
!
crypto ipsec transform-set test-transform esp-3des esp-md5-hmac 
crypto ipsec transform-set pix-transform esp-3des esp-md5-hmac 
!
crypto map test 10 ipsec-isakmp   
 set peer 22.22.22.22
 set transform-set test-transform 
 match address 133
!
crypto map real 10 ipsec-isakmp   
 set peer 192.168.171.1
 set transform-set pix-transform 
 match address 144
!
! See bug 2334007 for "certificate"
! https://sourceforge.net/tracker2/?func=detail&aid=2334007&group_id=5314&atid=1070394
!
certificate self-signed 01
30820254 308201BD A0030201 02020101 300D0609 2A864886 F70D0101 04050030
E7CF84EC 9FED5F77 EBE589EF 832F6AC3 DFFE3FD8 5F73C105
quit 
!
call rsvp-sync
!
!
!
module ContentSwitchingModule 3
 ft group 1 vlan 9
  preempt
!
! -- test behavior for the "ip address" command in the "vlan" context
!    (should ignore it)
!
 vlan 706 server
  ip address 172.16.1.1 255.255.255.128
  alias 172.16.1.2 255.255.255.128
!
 vlan 111 client
  ip address 172.16.10.1 255.255.255.0
  gateway 172.16.10.254
!
 static nat virtual
  real 192.168.16.20
  real 192.168.16.19
!
!
 vserver TEST
  virtual 172.16.1.51 tcp www
  vlan 706
  serverfarm BBTEST-HTTP
  persistent rebalance
  slb-policy BBTEST
  inservice
!
! See bug 2334007 for "controller" with "description"
! https://sourceforge.net/tracker2/?func=detail&aid=2334007&group_id=5314&atid=1070394
!
controller T3 2/0
 description Any description will crash the parser
! 
!
interface FastEthernet0/0
 ip address 192.168.100.100 255.255.255.0 secondary
 ip address 10.3.14.201 255.255.255.0
 ip access-group fe0_0_acl_in in
 ip access-group fe0_0_acl_out out
 no ip mroute-cache
 duplex auto
 speed auto
!
interface Ethernet1/0
 description Test [test] {test} (and one more test) /weird:characters#$%^&*/
 ip address 192.168.171.2 255.255.255.0
 ip access-group e1_0_acl_in in
 ip access-group e1_0_acl_out out
 no ip mroute-cache
 ip ospf cost 65000
 half-duplex
 crypto map real
!
interface Serial1/0
 ip unnumbered Loopback0
 no ip mroute-cache
 shutdown
 no fair-queue
!
interface Ethernet1/1
 ip address 10.10.10.10 255.255.255.0
 no ip mroute-cache
!
!  Note - the same access list applied both in and out
 ip access-group 133 in
 ip access-group 133 out
 no shutdown
 half-duplex
!
interface Ethernet1/2
 ip address 10.10.20.20 255.255.255.0
 no ip mroute-cache
!
!  Note - the same access list applied both in and out
!  the same list is applied to eth 1/1 and eth 1/2
 ip access-group 133 in
 ip access-group 133 out
 no shutdown
 half-duplex
!
interface ATM0
 no ip address
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip route-cache flow
 no atm ilmi-keepalive
 dsl operating-mode auto
!
interface ATM0.1 point-to-point
 description $FW_OUTSIDE$$ES_WAN$
 no snmp trap link-status
 pvc 0/38
 ip address 10.0.0.1 255.255.255.252
 encapsulation aal5mux ppp dialer
 dialer pool-member 1
!
router ospf 1
 network 10.3.14.0 0.0.0.255 area 0
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.171.1
no ip http server
!
ip bgp-community new-format
ip community-list standard AS65530.INTERNAL permit 65532:10100
ip community-list expanded ASFOO permit _65533:10200_
ip community-list expanded ASFOO.CUST permit _65532:103.._
ip community-list expanded TEST99 permit 65532:102.* 65533:.*
!
! See bug 2334007 for problems with commands using character "|"
! https://sourceforge.net/tracker2/?func=detail&aid=2334007&group_id=5314&atid=1070394
!
ip community-list expanded Test2 permit ^65063:1[8-9][0-9]|65063:20[0-9]$ 
!
ip as-path access-list 10 permit ^1239_
ip as-path access-list 10 permit .*
ip flow-export source Loopback0
ip flow-export version 5
!
!################################################################
ip access-list extended e1_0_acl_in
 deny   ip any any fragments
 permit tcp host 10.3.14.40 host 192.168.171.2 eq 22 log
 permit tcp host 10.3.14.40 host 10.3.14.201 eq 22 log
 permit ip any 10.3.14.0 0.0.0.255 log
 deny   ip any any log
!################################################################
ip access-list extended e1_0_acl_out
 permit ip 10.3.14.0 0.0.0.255 any log
 deny   ip any any log
!################################################################
ip access-list extended fe0_0_acl_in
 permit tcp host 10.3.14.40 host 192.168.171.2 eq 22 log
 permit tcp host 10.3.14.40 host 10.3.14.201 eq 22 log
 permit ip 10.3.14.0 0.0.0.255 any log
 deny   ip any any log
!################################################################
ip access-list extended fe0_0_acl_out
 permit ip any 10.3.14.0 0.0.0.255 log
 deny   ip any any log
!################################################################
ip access-list extended outside
 remark //path1/path2/path3 
 remark access list comment
! destination port 
 permit udp any any eq isakmp
! source port
 permit tcp any eq 80 any
! source port and established
 permit tcp any eq 80 any established
! different port operators
 permit tcp any gt 1023 any
 deny tcp any lt 1023 any
! ports can be defined by number or by name
 permit tcp any any eq www
! port ranges
 permit tcp any any range 22 80
 permit tcp any any range 22 www
!
!  two identical services, one tcp, another udp
 deny   tcp any any eq 2967
 deny   tcp any eq 2967 any
 deny   udp any any eq 2967
 deny   udp any eq 2967 any
!
 permit ahp any any
 permit esp any any
! icmp rule with no icmp spec
 permit icmp any any
! icmp rule with icmp spec in the form of two integers
 permit icmp any any 8 0
! icmp rule with icmp spec in the form of a word
 permit icmp any any unreachable
 permit icmp any any host-unreachable
 permit icmp any any host-precedence-unreachable
!
! check for empty line inside ACL definition

 permit udp any any eq bootpc
 permit udp any any eq bootps
 permit udp any eq domain any
!  'time-range' option
 permit tcp 10.10.10.0 0.0.0.255 eq 80 host 10.3.14.40 established time-range evening
 deny   ip any any log
!################################################################
! empty access list declaration
ip access-list extended foo
ip access-list extended tmp_acl
 permit ip 10.3.14.0 0.0.0.255 any
 deny   ip any any
!
access-list 133 permit ip 10.3.14.0 0.0.0.255 10.10.10.0 0.0.0.255
access-list 133 permit ip 10.10.10.0 0.0.0.255 10.3.14.0 0.0.0.255
access-list 133 deny   ip any any log
access-list 144 permit icmp 10.3.14.0 0.0.0.255 10.2.1.0 0.0.0.255
access-list 144 permit icmp 10.2.1.0 0.0.0.255 10.3.14.0 0.0.0.255
access-list 144 permit ip 10.3.14.0 0.0.0.255 10.2.1.0 0.0.0.255
access-list 144 permit ip 10.2.1.0 0.0.0.255 10.3.14.0 0.0.0.255
access-list 144 permit icmp 10.3.14.0 0.0.0.255 host 192.168.171.1
access-list 144 permit icmp host 192.168.171.1 10.3.14.0 0.0.0.255
access-list 144 permit ip 10.3.14.0 0.0.0.255 host 192.168.171.1
access-list 144 permit ip host 192.168.171.1 10.3.14.0 0.0.0.255
access-list 199 permit icmp 10.3.14.0 0.0.0.255 10.10.10.0 0.0.0.255 log
access-list 199 permit ip any any
!
access-list 1300 remark Standard access lists are 1 to 99 and 1300 to 1999
access-list 1300 permit 22.22.22.21
access-list 1300 permit 22.23.24.25
access-list 1300 permit 22.23.25.0 0.0.0.15
access-list 1300 permit 10.0.0.0 0.255.255.255
!
route-map AS65530_AGGREGATION permit 10
 match ip address prefix-list AS65530_AGGR
 set community 65532:111 65533:101 65533:111 65533:121 65533:131 65533:141 65533:151 65533:201 65533:301 65533:311 65533:321 65533:401
!
!
snmp-server community public RO
snmp-server enable traps tty
!
dial-peer cor custom
!
ip prefix-list AS65530_AGGR permit 22.23.24.0/19 le 24
!
logging facility syslog
logging source-interface Loopback0
logging 10.1.0.91
logging 10.1.0.92
!
!
!
banner motd ^C

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~                      B A N N E R                           ~ ~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

^C
!
line con 0
line aux 0
line vty 0 4
 password 7 <removed>
!
ntp clock-period 17179753
ntp server 10.3.14.10
!
time-range evening
 periodic daily 17:00 to 23:59
!
end

