(ups, hatte mein mcseboard-passwort verlegt und die richtige meiner x-1000 emailadressen nicht mehr gewusst, um das passwort neu zu setzen - ging deshalb etwas länger
hier das config-file: (offizielle Server-IP ist im Internet zugänglich, diese wird auf dem Router per statischem NAT auf IP 10.41.70.20, dem Mailserver weitergeleitet.)
----part1----
!This is the running config of the router: 10.41.70.2
!----------------------------------------------------------------------------
!version 12.3
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname InetRouter
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200 debugging
logging console critical
enable secret 5 <unwichtig>
!
username <unwichtig> privilege 15 secret 5 <unwichtig>
clock timezone PCTime 1
clock summer-time PCTime date Mar 30 2003 2:00 Oct 26 2003 3:00
aaa new-model
!
!
aaa authentication login default local
aaa authentication login sdm_vpn_xauth_ml_1 local
aaa authorization exec default local
aaa authorization network sdm_vpn_group_ml_1 local
aaa session-id common
ip subnet-zero
no ip source-route
!
!
!
!
ip tcp synwait-time 10
ip domain name <unwichtig>
ip name-server 10.41.70.1
no ip bootp server
ip cef
ip inspect name sdm_ins_in_100 cuseeme
ip inspect name sdm_ins_in_100 ftp
ip inspect name sdm_ins_in_100 h323
ip inspect name sdm_ins_in_100 netshow
ip inspect name sdm_ins_in_100 rcmd
ip inspect name sdm_ins_in_100 realaudio
ip inspect name sdm_ins_in_100 rtsp
ip inspect name sdm_ins_in_100 sqlnet
ip inspect name sdm_ins_in_100 streamworks
ip inspect name sdm_ins_in_100 tftp
ip inspect name sdm_ins_in_100 udp
ip inspect name sdm_ins_in_100 vdolive
ip inspect name sdm_ins_in_100 icmp
ip inspect name DEFAULT100 cuseeme
ip inspect name DEFAULT100 ftp
ip inspect name DEFAULT100 h323
ip inspect name DEFAULT100 icmp
ip inspect name DEFAULT100 netshow
ip inspect name DEFAULT100 rcmd
ip inspect name DEFAULT100 realaudio
ip inspect name DEFAULT100 rtsp
ip inspect name DEFAULT100 sqlnet
ip inspect name DEFAULT100 streamworks
ip inspect name DEFAULT100 tcp
ip inspect name DEFAULT100 tftp
ip inspect name DEFAULT100 udp
ip inspect name DEFAULT100 vdolive
ip audit notify log
ip audit po max-events 100
ip ssh time-out 60
ip ssh authentication-retries 2
no ftp-server write-enable
no scripting tcl init
no scripting tcl encdir
!
!
!
!
!
crypto isakmp policy 1
<unwichtig>
!
crypto isakmp policy 3
<unwichtig>
!
crypto isakmp client configuration group <unwichtig>
wins 10.41.70.20
pool SDM_POOL_1
!
!
crypto <unwichtig>
!
crypto dynamic-map SDM_DYNMAP_1 1
set transform-set <unwichtig>
reverse-route
!
!
crypto map SDM_CMAP_1 client authentication list sdm_vpn_xauth_ml_1
crypto map SDM_CMAP_1 isakmp authorization list sdm_vpn_group_ml_1
crypto map SDM_CMAP_1 client configuration address respond
crypto map SDM_CMAP_1 65535 ipsec-isakmp dynamic SDM_DYNMAP_1
!
!
!
!
interface FastEthernet0
description $FW_OUTSIDE$$ETH-WAN$$INTF-INFO-10/100 Ethernet$
ip address dhcp client-id FastEthernet0
ip access-group 101 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
ip inspect sdm_ins_in_100 in
ip inspect DEFAULT100 out
ip route-cache flow
speed auto
no cdp enable
crypto map SDM_CMAP_1
!
