Below is config for router 2610 version 12.0(5)XK1
version 12.0 service timestamps debug uptime service timestamps log uptime service password-encryption ! hostname test ! logging buffered 4096 debugging enable secret 5 blahblah ! ! clock timezone PST -8 clock summer-time PDT recurring ip subnet-zero no ip domain-lookup ! ip inspect max-incomplete high 1100 ip inspect one-minute high 1100 ip inspect name Ethernet_0_0 tcp ip inspect name Ethernet_0_0 udp ip inspect name Ethernet_0_0 cuseeme ip inspect name Ethernet_0_0 ftp ip inspect name Ethernet_0_0 h323 ip inspect name Ethernet_0_0 rcmd ip inspect name Ethernet_0_0 realaudio ip inspect name Ethernet_0_0 smtp ip inspect name Ethernet_0_0 streamworks ip inspect name Ethernet_0_0 vdolive ip inspect name Ethernet_0_0 sqlnet ip inspect name Ethernet_0_0 tftp ip inspect name Ethernet_1_0 ftp ip inspect name Ethernet_1_0 tcp ip inspect name Ethernet_1_0 smtp ip audit notify log ip audit po max-events 100 ! ! process-max-time 200 ! interface Ethernet0/0 description connected to EthernetLAN ip address 10.10.10.1 255.0.0.0 ip access-group 100 in no ip directed-broadcast ip nat inside ip inspect Ethernet_0_0 in ! interface Ethernet1/0 description connected to Internet ip address a.b.c.d 255.255.255.224 ip access-group 101 in no ip directed-broadcast ip nat outside ip inspect Ethernet_1_0 in ! ip nat pool APSC-natpool-0 x.x.x.65 x.x.x.75 netmask 255.255.255.224 ip nat inside source list 1 pool APSC-natpool-0 overload ip nat inside source static 10.10.10.90 a.b.c.90 ip nat inside source static 10.10.10.89 a.b.c.89 ip nat inside source static 10.10.10.88 a.b.c.88 ip nat inside source static 10.10.10.91 a.b.c.91 ip classless ip route 0.0.0.0 0.0.0.0 Ethernet1/0 no ip http server ! logging trap debugging logging facility local0 logging 10.10.10.89 access-list 1 permit 10.0.0.0 0.255.255.255 access-list 100 permit ip any any access-list 100 deny tcp any any eq 4444 access-list 100 deny tcp any any eq 135 access-list 100 deny ip 73.10.0.0 0.0.1.255 any access-list 100 deny ip 10.0.0.0 0.255.255.255 any access-list 100 deny ip 172.16.0.0 0.15.255.255 any access-list 100 deny ip 192.168.0.0 0.0.255.255 any access-list 100 deny ip 127.0.0.0 0.255.255.255 any access-list 101 permit icmp any any access-list 101 permit tcp any host a.b.c.88 eq domain access-list 101 permit udp any host a.b.c.88 eq domain access-list 101 permit tcp any host a.b.c.88 eq 3389 log access-list 101 permit tcp any host a.b.c.89 eq 22 log access-list 101 permit tcp any host a.b.c.89 eq www access-list 101 permit tcp any host a.b.c.90 eq 4000 access-list 101 permit tcp any host a.b.c.91 eq www snmp-server engineID local numbernumbernubmer snmp-server contact Test banner motd No Unauthorized Access ! line con 0 exec-timeout 0 0 password 7 blahblah login transport input none line aux 0 line vty 0 4 exec-timeout 0 0 password 7 blahblah login ! ntp clock-period 17208321 ntp server 10.10.10.89 prefer end
Can use access group in and out for the same interface like below ip access-group 100 in ip access-group 102 out
are these in the right place access-list 100 deny ip 73.10.0.0 0.0.1.255 any access-list 100 deny ip 10.0.0.0 0.255.255.255 any access-list 100 deny ip 172.16.0.0 0.15.255.255 any access-list 100 deny ip 192.168.0.0 0.0.255.255 any access-list 100 deny ip 127.0.0.0 0.255.255.255 any
these are suppose to prevent local hack right?