devices/configs/216.31.138.134

!RANCID-CONTENT-TYPE: cisco-clean
!
!
!
!
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime localtime
service password-encryption
no platform punt-keepalive disable-kernel-core
!
hostname TrollSystems_1GB_13KRGN615081PT_24950AnzaDr
!
boot-start-marker
boot system flash bootflash:asr1001-universalk9.03.13.01.S.154-3.S1-ext.bin
boot-end-marker
!
vrf definition Mgmt-intf
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
!
logging buffered 20000
no logging console
!
aaa new-model
!
aaa authentication fail-message ^CCCCCCCC****TACACS+************^C
aaa authentication login default group tacacs+ local
aaa authentication login userauthen local
aaa authentication enable default group tacacs+ none
aaa authorization network groupauthor local 
!
aaa session-id common
clock timezone PST -8 0
clock summer-time PST recurring
!


ip domain name auto
ip name-server 216.116.96.2
ip name-server 216.116.96.3
ip name-server 64.239.184.125

!
ipv6 multicast rpf use-bgp
ipv6 multicast vrf Mgmt-intf rpf use-bgp
!
subscriber templating
!
multilink bundle-name authenticated
!
license udi pid ASR1001 sn JAE1815095N
spanning-tree extend system-id
!
username Bcoleman privilege 0 password 7 107A1B49091B243B2255
username DDamiani password 7 06321D2E40425B
username Fkhalaf password 7 1526195C08261D140662
username Hellis password 7 1526195C08261D140662
username Jtreptow privilege 0 password 7 046F1956032D7A7E2748
username Mking password 7 033049040A0370
username Shermesh password 7 053F145F2D40783937161F
username TrollGuest1 privilege 0 password 7 075E114D5D1A0E0A0516
username TrollGuest2 privilege 0 password 7 107E080A16001D190856
username bardizzone password 7 046F1909032D1D
username dheg privilege 0 password 7 0948460C1E
username gparrish privilege 7 password 7 0030010908575A
username jhopkins privilege 0 password 7 107A1B16091B
username jpina password 7 033049040A0370
username jscott privilege 0 password 7 1351454058
username mrc privilege 0 password 7 046F1909032D
username mscott privilege 0 password 7 06121D2E4042
username nehul password 7 070124445B05
username tzcare privilege 15 secret 5 $1$QcDi$cx/mqm7rFUUwXiVU5g0OJ.
username westcom privilege 0 password 7 142300040008
!
redundancy
 mode none
!
ip tftp source-interface GigabitEthernet0
ip ssh version 2
!
class-map match-all VOIP
 match access-group 110
class-map match-all BANDWIDTH
 match any 
!
policy-map VOIP-POLICE
 class VOIP
  priority percent 40
 class class-default
  fair-queue
  random-detect dscp-based
  random-detect ecn
policy-map BANDWIDTH_1GB
 class BANDWIDTH
  shape average 1000000000
   service-policy VOIP-POLICE
 class class-default
  fair-queue
  random-detect dscp-based
  random-detect ecn
!
crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp policy 3
 encr 3des
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp policy 10
 encr aes
 authentication pre-share
 group 2
!
crypto isakmp policy 20
 hash md5
 authentication pre-share
 group 2
!
crypto isakmp policy 30
 encr 3des
 hash md5
 authentication pre-share
 group 2
crypto isakmp nat keepalive 300
!
crypto isakmp client configuration group trollsystems
 key Trollsyskey123
 dns 192.168.3.21 192.168.3.22
 domain trollsystems.com
 pool vpnpool-ipsec
 acl 150
!
crypto isakmp client configuration group trollguestgpoup
 key Trollword1
 dns 192.168.3.21 192.168.3.22
 domain trolhsystems.com
 pool vpnpool-ipsec
 acl 150
!
crypto ipsec transform-set trollguestgroup esp-aes 256 esp-sha-hmac 
 mode tunnel
crypto ipsec transform-set trollsystems esp-aes 256 esp-sha-hmac 
 mode tunnel
!
crypto dynamic-map dynmap 10
 set transform-set trollguestgroup 
 reverse-route
!
crypto map Trollsysmap client authentication list userauthen
crypto map Trollsysmap isakmp authorization list groupauthor
crypto map Trollsysmap client configuration address respond
crypto map Trollsysmap 10 ipsec-isakmp dynamic dynmap 
!
interface GigabitEthernet0/0/0
 description TrollSystems=13KRGN615081PT
 no ip address
 load-interval 30
 negotiation auto
 service-policy output BANDWIDTH_1GB
!
interface GigabitEthernet0/0/0.1
 encapsulation dot1Q 2530
 ip address 216.31.138.134 255.255.255.252
 ip nat outside
 crypto map Trollsysmap
!
interface GigabitEthernet0/0/1
 description CustomerLAN
 ip address 216.31.139.1 255.255.255.192
 ip nat inside
 ip access-group inbound5 in
 ip access-group outbound8 out
 load-interval 30
 negotiation auto
 service-policy output BANDWIDTH_1GB
!
interface GigabitEthernet0/0/2
 description CISCO to ADTRAN
 ip address 208.179.135.37 255.255.255.252
 load-interval 30
 negotiation auto
 service-policy output BANDWIDTH_1GB
!
interface GigabitEthernet0/0/3
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet0
 vrf forwarding Mgmt-intf
 no ip address
 shutdown
 negotiation auto
!
ip local pool vpnpool-ipsec 192.168.254.1 192.168.254.100
ip nat translation tcp-timeout 900
ip nat translation udp-timeout 900
ip nat inside source route-map nonat interface GigabitEthernet0/0/0.1 overload
ip forward-protocol nd
!
no ip http server
no ip http secure-server
ip route 0.0.0.0 0.0.0.0 216.31.138.133
ip route 192.168.2.0 255.255.255.0 192.168.3.18
ip route 192.168.4.0 255.255.255.0 192.168.3.18
ip route 192.168.5.0 255.255.255.0 192.168.3.18
!
ip access-list extended SOURCE_ROUTING
 permit ip host 99.186.242.77 any
 permit ip host 99.186.242.78 any
 deny   ip any any
ip access-list extended inbound5
 deny   tcp any any eq 3389
 deny   ip host 222.186.52.86 any
 permit ip any any
ip access-list extended inbound7
ip access-list extended inbound8
 permit ip 192.168.254.0 0.0.0.255 192.168.0.0 0.0.255.255
 deny   ip host 199.0.200.34 any
 deny   ip host 174.120.219.177 any
 deny   ip host 213.8.172.131 any
 deny   ip host 195.168.58.107 any
 deny   ip host 190.120.227.30 any
 deny   ip any host 190.120.227.30
 permit ip any host 216.31.138.134
 permit ip 76.171.0.0 0.0.255.255 any
 permit udp any eq domain any
 permit udp any eq ntp any
 permit udp any any range 2000 2099
 permit tcp any any range 2000 2099
 permit udp any eq tftp any
 permit tcp any any established
 permit tcp any host 216.31.139.2 range 4500 5000
 permit udp any host 216.31.139.2 eq 21
 permit tcp any host 216.31.139.6 eq ftp
 permit tcp any host 216.31.139.6 eq ftp-data
 permit tcp any host 216.31.139.6 range 55536 55663
 permit tcp any host 216.31.139.2 eq ftp
 permit tcp any host 216.31.139.2 eq ftp-data
 permit tcp any host 216.31.139.2 eq www
 permit tcp any host 216.31.139.2 eq 443
 permit tcp any host 216.31.139.2 eq 5721
 permit tcp any host 216.31.139.5 range 4500 5000
 permit udp any host 216.31.139.5 eq 21
 permit tcp any host 216.31.139.5 eq ftp
 permit tcp any host 216.31.139.5 eq ftp-data
 permit tcp any host 216.31.139.5 eq www
 permit tcp any host 216.31.139.5 eq 443
 permit tcp any host 216.31.139.5 eq 5721
 permit udp any host 216.31.139.3 eq 8877
 permit udp any host 216.31.139.3 eq 8878
 permit udp any host 216.31.139.3 eq 8879
 permit udp any host 216.31.139.8 eq 8879
 permit tcp any host 216.31.139.8 eq 8879
 permit udp any host 216.31.139.9 eq 8879
 permit tcp any host 216.31.139.9 eq 8879
 permit udp any host 216.31.139.9 eq echo
 permit tcp any host 216.31.139.9 eq echo
 permit tcp any host 216.31.139.10 eq 443
 permit tcp host 54.69.61.164 host 216.31.139.10 eq 3306
 permit udp any host 216.31.139.10 eq 443
 permit ip any 208.179.135.36 0.0.0.3
 permit udp any eq isakmp any
 permit udp any eq 1723 any
 permit tcp any eq 5721 any
 permit udp any eq 1701 any
 deny   tcp any eq 4430 any
 deny   tcp any eq 118 any
 permit ip 74.43.146.0 0.0.0.255 host 216.31.139.4
 permit ip 208.86.215.0 0.0.0.255 host 216.31.139.4
 permit ip any host 216.31.139.4
 permit udp any host 216.31.139.5 eq isakmp
 permit udp any host 216.31.139.5 eq 1723
 permit udp any host 216.31.139.5 eq 1701
 deny   ip any host 216.31.139.2
 permit tcp any host 216.31.139.7 eq www
 permit tcp any host 216.31.139.10 eq www
 permit tcp any host 216.31.139.10 eq 5443
 permit tcp any host 216.31.139.10 eq 1935
 permit tcp any host 216.31.139.10 eq 8086
 permit tcp any host 216.31.139.10 eq 8087
 permit tcp any host 216.31.139.10 eq 8088
 permit tcp host 54.69.61.164 host 216.31.139.10 eq 1935
 permit tcp host 54.69.61.164 host 216.31.139.10 eq 5443
 permit tcp any host 216.31.139.9 eq 22
 permit tcp any host 216.31.139.9 eq 12002
 permit udp any host 216.31.139.9 eq 12002
 permit tcp any host 216.31.139.7 eq 8080
 permit tcp any host 216.31.139.5 eq 8000
 permit tcp any host 216.31.139.5 eq 6036
 deny   ip any host 216.31.139.5
ip access-list extended outbound8
 deny   tcp host 192.168.2.21 any eq smtp
 deny   tcp any host 192.168.2.21 eq smtp
 deny   tcp host 192.168.2.21 any eq 443
 deny   tcp any host 192.168.2.21 eq 443
 permit ip any any
!
logging trap debugging
logging facility local1
logging source-interface GigabitEthernet0/0/0.1
logging host 216.116.96.3
access-list 25 permit 64.239.128.0 0.0.63.255
access-list 25 permit 72.18.0.0 0.0.255.255
access-list 25 permit 208.179.0.0 0.0.255.255
access-list 25 permit 216.31.128.0 0.0.63.255
access-list 25 permit 216.116.96.0 0.0.31.255
access-list 25 deny   any
access-list 110 permit ip any host 64.239.185.8
access-list 110 permit ip any host 64.239.185.9
access-list 110 permit ip any host 64.239.185.5
access-list 110 permit ip any host 64.239.188.8
access-list 110 permit ip any host 64.239.188.9
access-list 150 permit ip 192.168.2.0 0.0.0.255 192.168.254.0 0.0.0.255
access-list 150 permit ip 192.168.3.0 0.0.0.255 192.168.254.0 0.0.0.255
access-list 150 permit ip 192.168.4.0 0.0.0.255 192.168.254.0 0.0.0.255
access-list 151 deny   ip 192.168.3.0 0.0.0.255 192.168.254.0 0.0.0.255
access-list 151 deny   ip 192.168.254.0 0.0.0.255 192.168.3.0 0.0.0.255
access-list 151 permit ip 192.168.2.0 0.0.0.255 any
access-list 151 permit ip 192.168.3.0 0.0.0.255 any
access-list 151 permit ip 192.168.4.0 0.0.0.255 any
access-list 151 permit ip 192.168.254.0 0.0.0.255 any
access-list 152 deny   ip 192.168.2.0 0.0.0.255 192.168.254.0 0.0.0.255
access-list 152 deny   ip 192.168.3.0 0.0.0.255 192.168.254.0 0.0.0.255
access-list 152 deny   ip 192.168.4.0 0.0.0.255 192.168.254.0 0.0.0.255
access-list 152 deny   ip 192.168.254.0 0.0.0.255 192.168.254.0 0.0.0.255
access-list 152 permit ip 192.168.2.0 0.0.0.255 any
access-list 152 permit ip 192.168.3.0 0.0.0.255 any
access-list 152 permit ip 192.168.4.0 0.0.0.255 any
access-list 152 permit ip 192.168.254.0 0.0.0.255 any
access-list 198 deny   ip any any log
!
route-map SOURCE-ROUTING permit 10
 match ip address SOURCE_ROUTING
 set ip next-hop 192.168.3.115
!
route-map nonat permit 10
 match ip address 152
!
snmp-server engineID local 0000000902000050547D0984
snmp-server community tierzero RO
!
tacacs-server host 216.116.96.47
tacacs-server timeout 10
tacacs-server directed-request
tacacs-server key 7 01040E554F58165F2F5501
!
control-plane
!
 !
 !
 !
 !
!
banner motd ^CCCCCCCCC
*************************************************************
Tierzero:
Unauthorized access to this device or the attached
networks is prohibited without express written permission.
Violators may be prosecuted to the fullest extent of the law.
Phone: 213-784-1400 option 1
Email: [tac@tierzero.net]
*********TACACS+*************************
^C
!
line con 0
 stopbits 1
line aux 0
 stopbits 1
line vty 0 4
 access-class 25 in
line vty 5 15
 access-class 25 in
!
ntp server 204.152.184.72
ntp server 216.31.128.192
ntp server 216.116.96.3
!
end