Thanks for the tips, I knew it was something similar but just couldn't get the exact syntax down. I'm picking a lot of cisco stuff just in this post alone. As a newbie, just the act of cracking into the console of the 831 and gain access to it got me excited, and getting the 831 to the point where it was usable was ecstatic. And I did everything on the 831 mainly due to your "hold-my-hand" instructions, in one single post,..unbelievale, you must have seen many cisco questions because you sure anticipated the scenario and what users might ask. I should thank the orig poster Thetdz too since he was the one who made this post.
=========================
Now if you don't mind, I have a few questions for you.
Would you take a look at my "sh run". (apparently, "sh run" did list my DHCP pool name as "CLIENT". I just wasn't aware of it! The "pool" and ACL concepts are totally new to me.)
Router#sh run
Building configuration...
Current configuration : 4500 bytes
!
version 12.3
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 2 log
logging buffered 64000 debugging
enable password ******
!
username ***** privilege 15 secret 5 $1$70GB$LJ5UL93uhbkyBxwuG
username CRWS_Venky privilege 15 password 0 $1$W1fA$o1oSEpa2125609562
no aaa new-model
ip subnet-zero
no ip source-route
ip name-server 66.51.205.100
ip name-server 4.2.2.2
ip dhcp excluded-address 192.168.1.1 192.168.1.100
ip dhcp excluded-address 192.168.1.150 192.168.1.254
ip dhcp excluded-address 192.168.1.2
ip dhcp excluded-address 192.168.1.21
!
ip dhcp pool CLIENT
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 66.51.205.100 4.2.2.2
domain-name dslextreme.com
lease 0 2
!
!
ip inspect name myfw cuseeme timeout 3600
ip inspect name myfw ftp timeout 3600
ip inspect name myfw rcmd timeout 3600
ip inspect name myfw realaudio timeout 3600
ip inspect name myfw smtp timeout 3600
ip inspect name myfw tftp timeout 30
ip inspect name myfw udp timeout 15
ip inspect name myfw tcp timeout 3600
ip inspect name myfw h323 timeout 3600
ip audit po max-events 100
Router#ice timestamps log datetime msec
^
% Invalid input detected at '^' marker.
Router#sh run
Building configuration...
Current configuration : 4500 bytes
!
version 12.3
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 2 log
logging buffered 64000 debugging
enable password cisco831
!
username webadmin privilege 15 secret 5 $1$70GB$LYJ5ULP93tuhbkyHBxwuG1
username CRWS_Venky privilege 15 password 0 $1$W1fA$o1oSEpa2125609562
no aaa new-model
ip subnet-zero
no ip source-route
ip name-server 66.51.205.100
ip name-server 4.2.2.2
ip dhcp excluded-address 192.168.1.1 192.168.1.100
ip dhcp excluded-address 192.168.1.150 192.168.1.254
ip dhcp excluded-address 192.168.1.2
ip dhcp excluded-address 192.168.1.21
!
ip dhcp pool CLIENT
network 192.168.1.0 255.255.255.0
default-router 192.168.1.1
dns-server 66.51.205.100 4.2.2.2
domain-name dslextreme.com
lease 0 2
!
!
ip inspect name myfw cuseeme timeout 3600
ip inspect name myfw ftp timeout 3600
ip inspect name myfw rcmd timeout 3600
ip inspect name myfw realaudio timeout 3600
ip inspect name myfw smtp timeout 3600
ip inspect name myfw tftp timeout 30
ip inspect name myfw udp timeout 15
ip inspect name myfw tcp timeout 3600
ip inspect name myfw h323 timeout 3600
ip audit po max-events 100
no ftp-server write-enable
!
!
!
!
no crypto isakmp enable
!
!
!
interface Ethernet0
description CRWS Generated text. Please do not delete this:192.168.1.1-255.255.255.0
ip address 192.168.1.1 255.255.255.0
ip access-group 122 out
ip nat inside
no cdp enable
hold-queue 32 in
!
interface Ethernet1
ip address dhcp client-id Ethernet1
ip access-group 103 in
ip mtu 1492
ip nat outside
ip inspect myfw out
ip tcp adjust-mss 1452
duplex auto
no cdp enable
!
ip classless
ip http server
ip http authentication local
no ip http secure-server
ip nat inside source list 102 interface Ethernet1 overload
ip nat inside source static tcp 192.168.1.2 21 interface Ethernet1 21
ip nat inside source static tcp 192.168.1.2 3389 interface Ethernet1 3389
ip nat inside source static tcp 192.168.1.2 15900 interface Ethernet1 15900
ip nat inside source static tcp 192.168.1.2 34129 interface Ethernet1 34129
ip nat inside source static udp 192.168.1.21 5061 interface Ethernet1 5061
ip nat inside source static udp 192.168.1.21 5060 interface Ethernet1 5060
!
!
access-list 102 permit ip 192.168.1.0 0.0.0.255 any
access-list 103 deny ip 10.0.0.0 0.255.255.255 any log
access-list 103 deny ip 172.16.0.0 0.15.255.255 any log
access-list 103 deny ip 192.168.0.0 0.0.255.255 any log
access-list 103 deny ip 127.0.0.0 0.255.255.255 any log
access-list 103 deny ip 224.0.0.0 7.255.255.255 any log
access-list 103 deny ip host 0.0.0.0 any log
access-list 103 deny ip 255.0.0.0 0.255.255.255 any log
access-list 103 permit ip any any
access-list 111 permit tcp any any eq ftp
access-list 111 permit tcp any any eq 3389
access-list 111 permit tcp any any eq 15900
access-list 111 permit tcp any any eq 34129
access-list 111 permit udp any any eq 5061
access-list 111 permit udp any any eq 5060
access-list 111 permit tcp any any eq telnet
access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any traceroute
access-list 111 permit icmp any any unreachable
access-list 111 permit udp any eq bootps any eq bootpc
access-list 111 permit udp any eq bootps any eq bootps
access-list 111 permit udp any eq domain any
access-list 111 permit esp any any
access-list 111 permit udp any any eq isakmp
access-list 111 permit udp any any eq 10000
access-list 111 permit tcp any any eq 1723
access-list 111 permit tcp any any eq 139
access-list 111 permit udp any any eq netbios-ns
access-list 111 permit udp any any eq netbios-dgm
access-list 111 permit gre any any
access-list 111 deny ip any any
access-list 122 deny tcp any any eq telnet
access-list 122 permit ip any any
no cdp run
!
control-plane
!
!
line con 0
password cisco831
login
no modem enable
transport preferred all
transport output all
line aux 0
transport preferred all
transport output all
line vty 0 4
exec-timeout 120 0
password cisco831
login local
length 0
transport preferred all
transport input all
transport output all
!
scheduler max-task-time 5000
!
end
QUESTIONS:
==================================
1)
Does my config look ok and "safe" I've pretty much mimicked what you've posted in here for Paublo. I
2)
I asteriked (*****) out my username & password above.
But what/who is this user listed below me?
"CRWS_Venky privilege 15 password 0"
Is this the "console" user? I sure didn't create any CRWS_Venky user. And right now, I'm able to telnet (regular telnet using DOS cmd in XP) into the 831 from the WAN side. Is safe at all? or should I use some sort of "more secured & encrypted" telneting way?
3)
I'm currently running IOS 12.3(7)T. There are newer IOS for the 831. I've gone to here
to do a IOS comparison. Select search by "Platform", then select "Compare Images" tab. I see that there are 2 major releases for the 831, and within each major release, there are many "Release Number". Here's what I see that I think are what I might need/want to upgrade to...:
Major release 1 (T version):
IOS 12.4(15)T4 IP/FW 3DES
IOS 12.4(15)T4 IP/FW/PLUS 3DES
Major release 2 (non-T version):
IOS 12.4(19) IP/FW 3DES
IOS 12.4(19) IP/FW/PLUS 3DES
Seems like the T release has more features than the non-T. And the IP/FW/PLUS variety has more features than the IP/FW variety.
Between the T and the non-T releases, seems like the non-T has 3 features unique to it, namely:
- IGMP Version 3
- Large Scale Dial Out (LSDO) VRF Aware
- NAT - Scalability for Stateful NAT
The T release has a load of features not found in non-T, things like:
- AAA call trace, CLI stop
- CNS stuff
- Easy VNP stuff
- some DHCP stuff
- NAT Sip session stuff
...etc..
Between the IP/FW/PLUS and IP/FW, the IP/FW/PLUS has much more features dealing with
- BGP
- IPv6
-NBAR,
- NSF
- OSPF
- QoS
- RSVP
....etc...
My question is, which IOS version should I use if i'm the following:
- a home user with 4 PCs
- would like a firewall
- would like to VPN into my home network (if possible)
- I do have a Voip box
- use bit torrent
- would like to experiment/learn IOS commands/concept down the road, but if putting a larger IOS image on the router would SLOW the router down, then I rather not install a larger image for the sake of experimenting/learning.
My current IOS version is 12.3(7)T, so I know for a fact that the T version will work for me. But to be honest, I don't completely comprehend 10% of the list of features in any IOS version. I can read the mini-discription associated with each feature, and have an idea what they are after googling it up, but I can't say I fully understand them.
So Burt, if you could, would you make a quick recommendation as to what IOS version I should use? My 831 has 64 mb RAM and 16 mb flash, so I believe it can run all of the different IOS versions.
4)
When it comes to the actual uploading the newer IOS, I plan to follow these instructions from Cisco.
..in the "Task 2: Install a Supported Cisco IOS Image" section.
Is this the correct instruction set for me Burt? Do you have any pointers/warnings for the steps at Cisco?
And will I lose all my settings when upgrading the IOS? (I would like to think not!).
Sorry for asking a bunch of newbie questions, but I wanna get up and running with the latest IOS,..while taking my time to learn the details of IOS as I go along.
