Исходное сообщение
"Cisco 7206-NPE-G2 VPN-туннели" Отправлено evb, 13-Янв-07 16:31
upgrade fpd auto version 12.4 service timestamps debug datetime msec service timestamps log datetime msec service password-encryption hostname xxxxx ! boot-start-marker boot system flash bootflash:c7200p-advipservicesk9-mz.124-4.XD4.bin boot-end-marker ! logging buffered 51200 warnings enable password 7 xxxxx ! aaa new-model ! aaa authentication login default local aaa authentication ppp default group radius local aaa authorization config-commands aaa authorization network default group radius aaa accounting network default start-stop group radius aaa accounting system default start-stop group radius ! aaa pod server auth-type any server-key xxxxxxx aaa session-id common ! resource policy ! clock timezone MSK 3 clock summer-time MSD recurring last Sun Mar 2:00 last Sun Oct 3:00 ip subnet-zero ip cef ! ip domain name xxxxxxx.ru ip name-server xxx.xx.xx.xx ip name-server xxx.xx.xx.xx vpdn enable ! vpdn-group 1 ! Default PPTP VPDN group accept-dialin   protocol pptp   virtual-template 1 local name xxxxxx ! interface Loopback0 ip address 172.16.0.1 255.255.255.255 ! interface GigabitEthernet0/1 ip address xxx.xx.xx.xx 255.255.255.0 duplex auto speed auto media-type rj45 negotiation auto ! interface GigabitEthernet0/2.14 description vpn-vlan encapsulation dot1Q 14 ip address xxx.xxx.xx.xxx xxx.xxx.xxx.xxx ip ospf message-digest-key 1 md5 7 xxxxxxxx no snmp trap link-status ! interface Virtual-Template1 mtu 1460 ip unnumbered Loopback0 no ip proxy-arp ip flow ingress ip flow egress ip virtual-reassembly no logging event link-status no peer default ip address ppp authentication ms-chap-v2 ! router ospf 1 router-id xxx.xxx.xxx.xxx log-adjacency-changes area 0 authentication message-digest redistribute connected subnets redistribute static network xxx.xxx.xxx.xxx x.x.xxx.xxx area 0 ! ip classless ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx no ip http server no ip http secure-server ! ip bgp-community new-format ip flow-export source GigabitEthernet0/1 ip flow-export version 5 ip flow-export destination xxx.xxx.xxx.xxx 3010 ! logging alarm informational ! access-list 140 deny   tcp any any eq 135 access-list 140 deny   tcp any any eq 139 access-list 140 deny   tcp any any eq 445 access-list 140 deny   udp any any eq 135 access-list 140 deny   udp any any eq 136 access-list 140 deny   udp any any eq netbios-ns access-list 140 deny   udp any any eq netbios-dgm access-list 140 deny   udp any any eq netbios-ss access-list 140 permit ip any any ! access-list 153 deny   tcp any any eq 135 access-list 153 deny   tcp any any eq 137 access-list 153 deny   tcp any any eq 139 access-list 153 deny   tcp any any eq 445 access-list 153 deny   udp any any eq netbios-ns access-list 153 deny   udp any any eq netbios-dgm access-list 153 permit ip any any ! radius-server attribute 8 include-in-access-req radius-server configure-nas radius-server host xxx.xxx.xxx.xxx auth-port 1812 acct-port 1813 radius-server timeout 30 radius-server key 7 xxxxxxxxx radius-server authorization default Framed-Protocol ppp radius-server vsa send accounting radius-server vsa send authentication Из радиуса передаётся ip access-list 140 in ip access-list 153 out и rate limit input rate limit output