Zwei Standorte über VPN Vernetzen und Zugriff von Mobilen Clients

!
! Last configuration change at 21:55:13 CET Sun Feb 3 2013
! NVRAM config last updated at 21:55:22 CET Sun Feb 3 2013 by admin
! NVRAM config last updated at 21:55:22 CET Sun Feb 3 2013 by admin
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service sequence-numbers
!
hostname router_XXXX
!
boot-start-marker
boot-end-marker
!
!
no logging buffered
enable secret 5 XXXX
enable password XXXXX
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login USER local
aaa authorization network GROUP local 
!
!
!
!
!
aaa session-id common
!
memory-size iomem 15
clock timezone CET 1 0
clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
!
no ipv6 cef
no ip source-route
no ip gratuitous-arps
ip auth-proxy max-login-attempts 5
ip admission max-login-attempts 5
ip cef
!
!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 10.48.53.1 10.48.53.99
ip dhcp excluded-address 10.48.53.151 10.48.53.254
!
ip dhcp pool 1941-dhcp
 network 10.48.53.0 255.255.255.0
 default-router 10.48.53.1 
 domain-name XXXXX.secure.intern
 dns-server 208.67.222.222 208.67.220.220 
 netbios-name-server 10.48.53.1 
 lease 7
!
!
ip domain name XXXX.secure.intern
ip name-server 208.67.222.222
ip name-server 208.67.220.220
ip inspect name meinefw udp
ip inspect name meinefw tcp
ip ddns update method dyndns
!
login block-for 300 attempts 3 within 30
login on-failure log
login on-success log
!
multilink bundle-name authenticated
!
vpdn enable
!
crypto pki token default removal timeout 0
!
crypto pki trustpoint TP-self-signed-2189981532
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-2189981532
 revocation-check none
 rsakeypair TP-self-signed-2189981532
!
crypto pki trustpoint test_trustpoint_config_created_for_sdm
 subject-name e=sdmtest@sdmtest.com
 revocation-check crl
!
!
crypto pki certificate chain TP-self-signed-2189981532
 certificate self-signed 01
  3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030 
  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274 
  69666963 6174652D 32313839 39383135 3332301E 170D3132 31323233 32323033 
  32325A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649 
  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 31383939 
  38313533 3230819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 
  81009EDC E1D5EEF7 F2B128A7 0473D2A1 A6F119CD 3A99F94F 11CD4A60 0016B17E 
  1EB094A6 EC198B92 D88C9139 5A06152B 3B4437C7 882062CB 80DEB2B5 D2F86240 
  A0ACFD0C 67359E39 D8106B72 D4BA859F D7604FD0 1000BC6D 155D32DF 8D6789B3 
  994A6606 7D5926DC 5E83AF67 73A96652 9E0FF96D 9697377B 0375CC01 31A8772C 
  DEEB0203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 
  551D2304 18301680 14213091 1216EDC8 9ABD3EA6 54940336 AFB56F50 1C301D06 
  03551D0E 04160414 21309112 16EDC89A BD3EA654 940336AF B56F501C 300D0609 
  2A864886 F70D0101 05050003 8181003B 218A47AF CD1DBF81 05E5DA54 533EE732 
  1AB7A313 7270C170 71CD5B76 C2520203 5C5A1219 557F6C11 2FB5AB15 C3235F78 
  DB333C1F 9E4DC3E1 54EDA106 158A9C7C 59FFCAC2 2E20AC86 B757F5E9 747C9774 
  EE2638A6 9BFE9FAD 18E89781 A7375509 19D6B70D 43CEDB96 7F009EC2 F43E5336 
  7514E3DB B59FC4A6 C7D23086 250070
  	quit
crypto pki certificate chain test_trustpoint_config_created_for_sdm
license udi pid XXXXXXXXXXXXXXXX
license boot module c1900 technology-package securityk9
license boot module c1900 technology-package datak9
!
!
username vpnuser01 password 0 XXXXXXXXXXXXXX
username admin privilege 15 secret 4 XXXXXXXXXXXXXXXX
!
redundancy
!
!
!
!
!
class-map match-any SOCIAL_NET
 match protocol http host "www.facebook.com"  
 match protocol http host "www.aol.de"  
!
!
policy-map DROP_SOCIAL_NET
 class SOCIAL_NET
  drop
!
! 
!
crypto isakmp policy 1
 encr aes
 authentication pre-share
 group 2
 lifetime 7200
crypto isakmp key Cisco address 0.0.0.0 0.0.0.0
crypto isakmp client configuration address-pool local EZVPN_POOL
!
crypto isakmp client configuration group EZVPN
 key XXXXXXX
 dns 10.48.53.1
 wins 10.48.53.1
 pool EZVPN_POOL
 netmask 255.255.255.0
crypto isakmp profile EZVPN_PROFILE
   match identity group EZVPN
   client authentication list USER
   isakmp authorization list GROUP
   client configuration address respond
   virtual-template 1
!
!
crypto ipsec transform-set EZVPN_SET esp-aes esp-sha-hmac 
!
crypto ipsec profile EZVPN_PROFILE
 set transform-set EZVPN_SET 
 set isakmp-profile EZVPN_PROFILE
!
!
!
!
!
!
interface Embedded-Service-Engine0/0
 no ip address
 shutdown
!
interface GigabitEthernet0/0
 description Lokales Ethernet LAN $ES_LAN$
 ip address 10.48.53.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 duplex auto
 speed auto
 no mop enabled
!
interface GigabitEthernet0/1
 description Internet Verbindung Kabel TV $ETH-WAN$
 ip address dhcp client-id GigabitEthernet0/1 hostname router_XXXXX
 ip access-group 111 in
 ip nat outside
 ip inspect meinefw out
 ip virtual-reassembly in
 duplex auto
 speed auto
 no cdp enable
 service-policy output DROP_SOCIAL_NET
!
interface FastEthernet0/0/0
 no ip address
 shutdown
 duplex auto
 speed auto
!
interface Virtual-Template1 type tunnel
 ip unnumbered GigabitEthernet0/1
 tunnel mode ipsec ipv4
 tunnel path-mtu-discovery
 tunnel protection ipsec profile EZVPN_PROFILE
!
ip local pool EZVPN_POOL 10.0.0.10 10.0.0.50
ip forward-protocol nd
!
ip http server
ip http secure-server
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
ip route 0.0.0.0 0.0.0.0 dhcp
!
!
access-list 1 permit 10.48.53.0 0.0.0.255
access-list 1 permit 10.48.50.0 0.0.0.255
access-list 111 remark CCP_ACL Category=17
access-list 111 remark Auto generated by CCP for NTP (123) 134.130.4.17
access-list 111 permit udp host 134.130.4.17 eq ntp any eq ntp
access-list 111 permit udp any any eq bootpc
access-list 111 permit udp any any eq bootps
access-list 111 permit udp any eq domain any
access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any unreachable
access-list 111 permit gre any any
access-list 111 deny   ip any any log
!
!
!
!
!
snmp-server community read_me RO
snmp-server community write_me RW
!
!
!
control-plane
!
!
!
line con 0
line aux 0
line 2
 no activation-character
 no exec
 transport preferred none
 transport input all
 transport output lat pad telnet rlogin lapb-ta mop udptn v120 ssh
 stopbits 1
line vty 0 4
 password XXXXXXXXXXX
 transport input all
!
scheduler allocate 20000 1000
ntp update-calendar
ntp server 134.130.4.17 source GigabitEthernet0/0
end