zone private
network base
ip subnet 192.168.20.0/24
network center
ip subnet 192.168.10.0/24
network ospf-DR
ip subnet 224.0.0.6/32
network ospf-mc
ip subnet 224.0.0.5/32
network WAE
ip subnet 172.16.0.0/24
firewall
rule 10 permit any from private to private
rule 20 permit any from private to public
rule 30 permit isakmp from public.wan.ppp0 to public.wan
rule 40 permit isakmp from public.wan to public.wan.ppp0
rule 50 permit esp from public.wan.ppp0 to public.wan
rule 60 permit esp from public.wan to public.wan.ppp0
protect
zone private
network base
ip subnet 192.168.20.0/24
network center
ip subnet 192.168.10.0/24
network ospf-DR
ip subnet 224.0.0.6/32
network ospf-mc
ip subnet 224.0.0.5/32
network WAE
ip subnet 172.16.0.0/24
firewall
rule 10 permit any from private to private
rule 20 permit any from private to public
rule 30 permit isakmp from public.wan.ppp0 to public.wan
rule 40 permit isakmp from public.wan to public.wan.ppp0
rule 50 permit esp from public.wan.ppp0 to public.wan
rule 60 permit esp from public.wan to public.wan.ppp0
protect
!
no spanning-tree rstp enable
!
interface eth1
ip address 172.16.0.1/24
!
interface port1.0.4
no switchport
encapsulation ppp 0
!
interface ppp0
keepalive
ip address negotiated
ppp username user@ispA
ppp password isppasswdA
ip tcp adjust-mss pmtu
shutdown
!
interface vlan1
ip address 192.168.10.1/24
!
crypto isakmp key secret address 10.1.1.2
!
interface tunnel0
ip address 192.0.0.1/24
tunnel source ppp0
tunnel destination 10.1.1.2
tunnel mode ipsec ipv4
tunnel protection ipsec
ip tcp adjust-mss 1260
mtu 1300
!
zone private
network base
ip subnet 192.168.20.0/24
network center
ip subnet 192.168.10.0/24
network ospf-DR
ip subnet 224.0.0.6/32
network ospf-mc
ip subnet 224.0.0.5/32
network WAE
ip subnet 172.16.0.0/24
!
zone public
network wan
ip subnet 0.0.0.0/0 interface ppp0
host ppp0
ip address dynamic interface ppp0
!
application esp
protocol 50
!
application isakmp
protocol udp
sport 500
dport 500
!
firewall
rule 10 permit any from private to private
rule 20 permit any from private to public
rule 30 permit isakmp from public.wan.ppp0 to public.wan
rule 40 permit isakmp from public.wan to public.wan.ppp0
rule 50 permit esp from public.wan.ppp0 to public.wan
rule 60 permit esp from public.wan to public.wan.ppp0
protect
!
ping-poll 1
ip 172.16.0.2
normal-interval 10
up-count 5
sample-size 10
active
!
trigger 1
type ping-poll 1 down
script 1 flash:/pingdown.scp
trigger 2
type ping-poll 1 up
script 1 flash:/pingup.scp
!
service ospf
router ospf
ospf router-id 192.168.10.1
network 172.16.0.0/24 area 0.0.0.0
network 192.168.10.0/24 area 0
!
ip route 0.0.0.0/0 ppp0
ip route 192.168.20.0/24 tunnel0
ip route 192.168.20.0/24 Null 254
!
end
!
no spanning-tree rstp enable
!
interface eth1
ip address 172.16.0.2/24
!
interface port1.0.4
no switchport
encapsulation ppp 0
!
interface ppp0
keepalive
ip address negotiated
ppp username user@ispB
ppp password isppasswdB
ip tcp adjust-mss pmtu
shutdown
!
interface vlan1
ip address 192.168.20.1/24
!
crypto isakmp key secret address 10.1.1.1
!
interface tunnel0
ip address 192.0.0.2/24
tunnel source ppp0
tunnel destination 10.1.1.1
tunnel mode ipsec ipv4
tunnel protection ipsec
ip tcp adjust-mss 1260
mtu 1300
!
zone private
network base
ip subnet 192.168.20.0/24
network center
ip subnet 192.168.10.0/24
network ospf-DR
ip subnet 224.0.0.6/32
network ospf-mc
ip subnet 224.0.0.5/32
network WAE
ip subnet 172.16.0.0/24
!
zone public
network wan
ip subnet 0.0.0.0/0 interface ppp0
host ppp0
ip address dynamic interface ppp0
!
application esp
protocol 50
!
application isakmp
protocol udp
sport 500
dport 500
!
firewall
rule 10 permit any from private to private
rule 20 permit any from private to public
rule 30 permit isakmp from public.wan.ppp0 to public.wan
rule 40 permit isakmp from public.wan to public.wan.ppp0
rule 50 permit esp from public.wan.ppp0 to public.wan
rule 60 permit esp from public.wan to public.wan.ppp0
protect
!
ping-poll 1
ip 172.16.0.1
normal-interval 10
up-count 5
sample-size 10
active
!
trigger 1
type ping-poll 1 down
script 1 flash:/pingdown.scp
trigger 2
type ping-poll 1 up
script 1 flash:/pingup.scp
!
service ospf
router ospf
ospf router-id 0.0.0.2
network 172.16.0.0/24 area 0.0.0.0
network 192.168.20.0/24 area 0
!
ip route 0.0.0.0/0 ppp0
ip route 192.168.10.0/24 tunnel0
ip route 192.168.10.0/24 Null 254
!
end