conf t
#basic configuration for ASA management
!
hostname Cisco
!
interface Port-channel1
nameif PO1
security-level 0
no ip address
!
interface GigabitEthernet0/0
no shutdown
channel-group 1 mode active
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/1
no shutdown
channel-group 1 mode active
no nameif
no security-level
no ip address
!
interface Port-channel1.906
vlan 906
nameif 906-WAN
security-level 0
ip address 79.112.1.2 255.255.255.0
!
interface Port-channel1.100
vlan 100
nameif 100-LSP-MGT
security-level 100
ip address 10.140.13.135 255.255.255.128
!
ntp server 172.16.8.225 source 100-LSP-MGT
clock timezone GMT 0
domain-name marriott.com
dns domain-lookup 906-WAN
dns server-group DefaultDNS
name-server 8.8.8.8
domain-name marriott.com
logging enable
logging timestamp
logging trap critical
logging asdm informational
logging host 100-LSP-MGT 172.16.8.241
logging permit-hostdown
icmp permit 217.169.134.32 255.255.255.224 906-WAN
route 906-WAN 0.0.0.0 0.0.0.0 79.112.1.1 1
route 100-LSP-MGT 172.16.8.0 255.255.252.0 10.140.13.129 1
route 100-LSP-MGT 172.16.16.0 255.255.252.0 10.140.13.129 1
aaa-server HOIST protocol radius
aaa-server HOIST (100-LSP-MGT) host 172.16.8.102
key Sp7xyDrk
authentication-port 1812
accounting-port 1813
radius-common-pw Sp7xyDrk
no mschapv2-capable
user-identity default-domain LOCAL
aaa authentication enable console HOIST LOCAL
aaa authentication http console HOIST LOCAL
aaa authentication ssh console HOIST LOCAL
aaa authentication serial console LOCAL
http server enable
http server idle-timeout 10
http 10.140.13.0 255.255.255.128 100-LSP-MGT
http 217.169.134.33 255.255.255.255 906-WAN
http 172.16.8.0 255.255.252.0 100-LSP-MGT
http 172.16.16.0 255.255.252.0 100-LSP-MGT
ssh 217.169.134.33 255.255.255.255 906-WAN
ssh 10.140.13.0 255.255.255.128 100-LSP-MGT
ssh 172.16.16.0 255.255.252.0 100-LSP-MGT
ssh 172.16.8.0 255.255.252.0 100-LSP-MGT
ssh stricthostkeycheck
ssh timeout 10
ssh version 2
crypto key generate rsa general-keys modulus 2048 noconfirm
console timeout 10
snmp-server host 100-LSP-MGT 172.16.8.245 community b@mb1x version 2c udp-port 161
snmp-server location Cisco
snmp-server contact HoistGroup
snmp-server community cru3sl1
username admin password 8jsIb3irnfso8OxQ encrypted privilege 15
enable password djipOQZX8WxG.ccW encrypted
#—————————————————————–
#add GPNS specific interfaces
!
interface Port-channel1.105
vlan 105
nameif 105-GPMS
security-level 90
ip address 10.140.13.65 255.255.255.224
object network 105-GPMS
subnet 10.140.13.64 255.255.255.224
!
interface Port-channel1.200
vlan 200
nameif 200-SRVMIPCI
security-level 90
ip address 10.140.10.1 255.255.255.192
object network 200-SRVMIPCI
subnet 10.140.10.0 255.255.255.192
!
interface Port-channel1.201
vlan 201
nameif 201-SRVTRST
security-level 90
ip address 10.140.12.129 255.255.255.224
object network 201-SRVTRST
subnet 10.140.12.128 255.255.255.224
!
interface Port-channel1.202
vlan 202
nameif 202-SRVNTRST
security-level 90
ip address 10.140.12.161 255.255.255.224
object network 202-SRVNTRST
subnet 10.140.12.160 255.255.255.224
!
interface Port-channel1.203
vlan 203
nameif 203-MICTERM
security-level 90
ip address 10.140.11.65 255.255.255.192
object network 203-MICTERM
subnet 10.140.11.64 255.255.255.192
!
interface Port-channel1.205
vlan 205
nameif 205-MICTERM2
security-level 90
ip address 10.140.11.161 255.255.255.224
object network 205-MICTERM2
subnet 10.140.11.160 255.255.255.224
!
interface Port-channel1.206
vlan 206
nameif 206-TOKEN
security-level 90
ip address 10.140.12.193 255.255.255.192
object network 206-TOKEN
subnet 10.140.12.192 255.255.255.192
!
interface Port-channel1.601
vlan 601
nameif 601-ASSVOIP1
security-level 40
ip address 172.16.0.1 255.255.255.0
object network 601-ASSVOIP1
subnet 172.16.0.0 255.255.255.0
!
interface Port-channel1.650
vlan 650
nameif 650-WVOIP
security-level 40
ip address 172.16.2.1 255.255.255.0
object network 650-WVOIP
subnet 172.16.2.0 255.255.255.0
!
interface Port-channel1.651
vlan 651
nameif 651-GSTVOIP1
security-level 40
ip address 172.16.4.1 255.255.255.0
object network 651-GSTVOIP1
subnet 172.16.4.0 255.255.255.0
!
interface Port-channel1.699
vlan 699
nameif 699-MGTVOIP
security-level 40
ip address 10.140.11.33 255.255.255.224
object network 699-MGTVOIP
subnet 10.140.11.32 255.255.255.224
!
interface Port-channel1.700
vlan 700
nameif 700-SURVCAM
security-level 40
ip address 172.17.1.1 255.255.255.0
object network 700-SURVCAM
subnet 172.17.1.0 255.255.255.0
!
interface Port-channel1.820
vlan 820
nameif 820-KEYCRDLC
security-level 30
ip address 192.168.21.1 255.255.255.0
object network 820-KEYCRDLC
subnet 192.168.21.0 255.255.255.0
!
interface Port-channel1.850
vlan 850
nameif 850-IPTVNDR1
security-level 30
ip address 172.18.0.1 255.255.0.0
object network 850-IPTVNDR1
subnet 172.18.0.0 255.255.0.0
!
interface Port-channel1.899
vlan 899
nameif 899-MGTIPTV
security-level 30
ip address 192.168.99.1 255.255.255.0
object network 899-MGTIPTV
subnet 192.168.99.0 255.255.255.0
!
interface Port-channel1.900
vlan 900
nameif 900-MIWAN
security-level 90
ip address 10.140.13.98 255.255.255.248
object network 900-MIWAN
subnet 10.140.13.96 255.255.255.248
!
#add Marriott routes
route 900-MIWAN 10.59.103.0 255.255.255.0 10.140.13.97 1
route 900-MIWAN 159.166.0.0 255.255.0.0 10.140.13.97 1
route 900-MIWAN 162.10.146.0 255.255.255.0 10.140.13.97 1
route 900-MIWAN 162.130.0.0 255.255.0.0 10.140.13.97 1
!
#add network objects
object network 300-ASSPC
subnet 10.140.12.0 255.255.255.128
object network 301-ASSDEV
subnet 10.140.10.128 255.255.255.192
object network 302-SPACLNT
subnet 10.140.11.128 255.255.255.224
object network 305-ASSPC2
subnet 10.140.11.192 255.255.255.192
object network 351-OPERAIFC
subnet 10.10.1.10 255.255.254.0
object network 450-ASSPCW
subnet 10.140.10.192 255.255.255.224
object network 451-MICROSHH
subnet 10.140.11.0 255.255.255.224
object network GW_in_900
host 10.140.13.97
object network Net_MI_1
subnet 162.130.0.0 255.255.0.0
description MI network N# 1
object network Net_MI_3
subnet 159.166.0.0 255.255.0.0
description MI network N# 3
object network Net_MI_SRV
subnet 162.10.146.0 255.255.255.0
object network Net_MI_Accenture_1
subnet 192.168.72.0 255.255.255.0
description Accetnture network for Marriott
object network Net_MI_Accenture_2
subnet 192.168.73.0 255.255.255.0
description Accenture network for Marriott
object network Host_Marriott_ACS
host 162.130.146.47
description Marriott active Directory
object network Host_Marriott_OWA
host 162.130.196.190
description owa.marriott.com
object network MAARK1-SVR3
host 162.130.114.45
object network MAARK1_SVR1
host 162.130.128.92
object network MAARK1_SVR2
host 162.130.122.125
object network Net_MI_2
subnet 10.0.0.0 255.0.0.0
description MI network N# 2
object network SixAppCertDld_DNS
fqdn v4 services.3cint.com
object network SixAppCertDld_IP
fqdn v4 194.7.129.142
object network SixDDC_DNS
fqdn v4 ddc.3cint.com
object network SixDDC_IP
host 194.7.129.146
object network SixServerMaintenace
host 217.31.76.137
object network SixTransAuthDNS
fqdn v4 auth.3cint.com
object network SixTransAuthIP
host 194.7.129.137
object network SixTransUpl_DNS
fqdn v4 transaction.3cint.com
object network SixTransUpl_IP
host 194.7.129.139
object network SixOSSEC_DNS
fqdn v4 mon.3cint.com
object network SixOSSEC_IP
fqdn v4 217.31.76.152
object network SixSysConfDld_DNS
fqdn v4 3csupportsystem.com
object network SixSysConfDld_IP
host 194.7.129.144
object network SixDNS_DNS
fqdn v4 ns2.verizon.net
object network SixDNS_IP
host 194.7.15.70
object network SixNTP
fqdn v4 pool.ntp.org
object network EMV_Serv
fqdn v4 serv.ep2.telekurs.com
object network EMV_Serv_IP
host 153.46.253.156
object network EMV_Siconfig
fqdn v4 siconfig.ep2.telekurs.com
object network EMV_SiconfigIP
host 153.46.253.155
object network EMV_Siinit
fqdn v4 siinit.ep2.telekurs.com
object network EMV_SiinitIP
host 153.46.253.149
object network EMV_fe
fqdn v4 fe.ep2.telekurs.com
object network EMV_feIP
host 153.46.253.145
object network EMV_PMS
fqdn v4 pms.ep2.telekurs.com
object network EMV_PMS_IP
host 153.46.253.151
object network EMV_fecash
fqdn v4 fe.cash.telekurs.com
object network EMV_fecashIP
host 153.46.253.158
object network EMV_ep2p
fqdn v4 ep2p.a-multilink.ch
object network EMV_ep2pIP
host 62.2.162.97
object network EMV_gklp
fqdn v4 gklp.telekurs.com
object network EMV_gklpIP
host 153.46.253.217
object network EMV_ep2
fqdn v4 ep2.firstdata.de
object network EMV_ep2IP
host 217.73.32.84
object network EMV_IP
host 193.16.220.2
object network EMV_ep2rtc
fqdn v4 ep2.rtc.ch
object network EMV_ep2rtcIP
host 193.227.225.13
object network EMV_ep2post
fqdn v4 ep2.PostFinance.ch
object network EMV_ep2postIP
host 138.189.254.100
object network EMVIP2
host 62.2.162.113
object network SIX_SVR
host 172.23.0.3
object network Six_SupportIP1
host 217.31.76.146
object network Six_SupportIP2
host 194.7.129.152
object network Six_SupportIP3
host 65.216.73.194
!
#add object network groups
object-group network MI_WAN_net
description all MI routable intranet networks
network-object object Net_MI_1
network-object object Net_MI_3
network-object object Net_MI_SRV
network-object object Net_MI_Accenture_1
network-object object Net_MI_Accenture_2
network-object object Net_MI_2
object-group network DM_INLINE_NETWORK_2
network-object object MAARK1-SVR3
network-object object MAARK1_SVR1
network-object object MAARK1_SVR2
object-group protocol DM_INLINE_PROTOCOL_4
protocol-object ip
protocol-object icmp
object-group network DM_INLINE_NETWORK_3
group-object MI_WAN_net
object-group network DM_INLINE_NETWORK_5
network-object object 820-KEYCRDLC
group-object MI_WAN_net
network-object object 203-MICTERM
object-group network DM_INLINE_NETWORK_6
network-object object 105-GPMS
network-object object 203-MICTERM
network-object object 205-MICTERM2
network-object object 206-TOKEN
network-object object 300-ASSPC
network-object object 301-ASSDEV
network-object object 305-ASSPC2
network-object object 351-OPERAIFC
network-object object 450-ASSPCW
network-object object 451-MICROSHH
network-object object 900-MIWAN
object-group network DM_INLINE_NETWORK_4
network-object object 200-SRVMIPCI
network-object object 201-SRVTRST
network-object object 300-ASSPC
network-object object 301-ASSDEV
network-object object 450-ASSPCW
object-group network DM_INLINE_NETWORK_54
network-object object 200-SRVMIPCI
network-object object 201-SRVTRST
network-object object 202-SRVNTRST
network-object object 203-MICTERM
network-object object 601-ASSVOIP1
network-object object 651-GSTVOIP1
network-object object 699-MGTVOIP
network-object object 700-SURVCAM
network-object object 820-KEYCRDLC
network-object object 850-IPTVNDR1
network-object object 899-MGTIPTV
object-group network SIX_SVR_OUT
network-object object SixAppCertDld_DNS
network-object object SixAppCertDld_IP
network-object object SixDDC_DNS
network-object object SixDDC_IP
network-object object SixDNS_DNS
network-object object SixDNS_IP
network-object object SixNTP
network-object object SixOSSEC_DNS
network-object object SixOSSEC_IP
network-object object SixServerMaintenace
network-object object SixSysConfDld_DNS
network-object object SixSysConfDld_IP
network-object object SixTransAuthDNS
network-object object SixTransAuthIP
network-object object SixTransUpl_DNS
network-object object SixTransUpl_IP
object-group network EMV
network-object object EMV_IP
network-object object EMV_PMS
network-object object EMV_PMS_IP
network-object object EMV_Serv
network-object object EMV_Serv_IP
network-object object EMV_Siconfig
network-object object EMV_SiconfigIP
network-object object EMV_Siinit
network-object object EMV_SiinitIP
network-object object EMVIP2
network-object object EMV_ep2
network-object object EMV_ep2IP
network-object object EMV_ep2p
network-object object EMV_ep2pIP
network-object object EMV_ep2post
network-object object EMV_ep2postIP
network-object object EMV_ep2rtc
network-object object EMV_ep2rtcIP
network-object object EMV_fe
network-object object EMV_feIP
network-object object EMV_fecash
network-object object EMV_fecashIP
network-object object EMV_gklp
network-object object EMV_gklpIP
object-group network DM_INLINE_NETWORK_7
network-object object 200-SRVMIPCI
network-object object 201-SRVTRST
network-object object 205-MICTERM2
network-object object 300-ASSPC
network-object object 301-ASSDEV
network-object object 305-ASSPC2
network-object object 450-ASSPCW
network-object object 451-MICROSHH
network-object object 900-MIWAN
object-group network DM_INLINE_NETWORK_8
network-object object 201-SRVTRST
network-object object 203-MICTERM
network-object object 205-MICTERM2
network-object object 451-MICROSHH
object-group network DM_INLINE_NETWORK_9
network-object object 105-GPMS
network-object object 200-SRVMIPCI
network-object object 201-SRVTRST
network-object object 202-SRVNTRST
network-object object 300-ASSPC
network-object object 301-ASSDEV
network-object object 351-OPERAIFC
network-object object 450-ASSPCW
object-group network Six_Support
network-object object Six_SupportIP1
network-object object Six_SupportIP2
network-object object Six_SupportIP3
object-group network DM_INLINE_NETWORK_10
network-object object SixServerMaintenace
network-object object SixTransAuthDNS
network-object object SixTransAuthIP
object-group network DM_INLINE_NETWORK_11
network-object object SixAppCertDld_DNS
network-object object SixAppCertDld_IP
network-object object SixDDC_DNS
network-object object SixDDC_IP
network-object object SixSysConfDld_DNS
network-object object SixSysConfDld_IP
network-object object SixTransUpl_DNS
network-object object SixTransUpl_IP
object-group network DM_INLINE_NETWORK_23
network-object object SixOSSEC_DNS
network-object object SixOSSEC_IP
object-group network DM_INLINE_NETWORK_24
network-object object EMV_Serv
network-object object EMV_Serv_IP
object-group network DM_INLINE_NETWORK_25
network-object object EMV_Siconfig
network-object object EMV_SiconfigIP
object-group network DM_INLINE_NETWORK_26
network-object object EMV_Siinit
network-object object EMV_SiinitIP
object-group network DM_INLINE_NETWORK_27
network-object object EMV_fe
network-object object EMV_feIP
object-group network DM_INLINE_NETWORK_28
network-object object EMV_PMS
network-object object EMV_PMS_IP
object-group network DM_INLINE_NETWORK_29
network-object object EMV_fecash
network-object object EMV_fecashIP
object-group network DM_INLINE_NETWORK_30
network-object object EMV_gklp
network-object object EMV_gklpIP
object-group network DM_INLINE_NETWORK_31
network-object object EMV_ep2p
network-object object EMV_ep2pIP
object-group network DM_INLINE_NETWORK_32
network-object object EMV_ep2
network-object object EMV_ep2IP
object-group network DM_INLINE_NETWORK_33
network-object object EMV_ep2rtc
network-object object EMV_ep2rtcIP
object-group network DM_INLINE_NETWORK_34
network-object object EMV_ep2post
network-object object EMV_ep2postIP
object-group network DM_INLINE_NETWORK_1
network-object object 105-GPMS
network-object object 200-SRVMIPCI
network-object object 201-SRVTRST
network-object object 202-SRVNTRST
network-object object 300-ASSPC
network-object object 301-ASSDEV
network-object object 450-ASSPCW
object-group network DM_INLINE_NETWORK_37
network-object object 200-SRVMIPCI
network-object object 201-SRVTRST
network-object object 202-SRVNTRST
network-object object 203-MICTERM
network-object object 205-MICTERM2
network-object object 300-ASSPC
network-object object 305-ASSPC2
network-object object 450-ASSPCW
network-object object 900-MIWAN
group-object MI_WAN_net
object-group network DM_INLINE_NETWORK_38
network-object object 105-GPMS
network-object object 200-SRVMIPCI
network-object object 203-MICTERM
network-object object 205-MICTERM2
network-object object 300-ASSPC
network-object object 305-ASSPC2
object-group network DM_INLINE_NETWORK_40
network-object object 301-ASSDEV
network-object object 900-MIWAN
object-group network DM_INLINE_NETWORK_41
network-object object 105-GPMS
network-object object 200-SRVMIPCI
network-object object 300-ASSPC
network-object object 305-ASSPC2
network-object object 450-ASSPCW
network-object object 699-MGTVOIP
network-object object 899-MGTIPTV
object-group network DM_INLINE_NETWORK_44
network-object object 200-SRVMIPCI
network-object object 201-SRVTRST
network-object object 202-SRVNTRST
network-object object 300-ASSPC
network-object object 301-ASSDEV
network-object object 305-ASSPC2
network-object object 450-ASSPCW
network-object object 900-MIWAN
object-group network DM_INLINE_NETWORK_45
network-object object 100-LSP-MGT
network-object object 200-SRVMIPCI
network-object object 201-SRVTRST
network-object object 202-SRVNTRST
network-object object 203-MICTERM
network-object object 205-MICTERM2
network-object object 301-ASSDEV
network-object object 305-ASSPC2
network-object object 450-ASSPCW
network-object object 451-MICROSHH
network-object object 900-MIWAN
group-object MI_WAN_net
object-group network DM_INLINE_NETWORK_46
network-object object 100-LSP-MGT
network-object object 200-SRVMIPCI
network-object object 201-SRVTRST
network-object object 202-SRVNTRST
network-object object 203-MICTERM
network-object object 205-MICTERM2
network-object object 300-ASSPC
network-object object 301-ASSDEV
network-object object 450-ASSPCW
network-object object 451-MICROSHH
network-object object 699-MGTVOIP
network-object object 899-MGTIPTV
network-object object 900-MIWAN
group-object MI_WAN_net
object-group network DM_INLINE_NETWORK_47
network-object object 200-SRVMIPCI
network-object object 201-SRVTRST
network-object object 202-SRVNTRST
network-object object 699-MGTVOIP
network-object object 899-MGTIPTV
object-group network DM_INLINE_NETWORK_48
network-object object 100-LSP-MGT
network-object object 200-SRVMIPCI
network-object object 201-SRVTRST
network-object object 202-SRVNTRST
network-object object 203-MICTERM
network-object object 300-ASSPC
network-object object 301-ASSDEV
network-object object 305-ASSPC2
network-object object 699-MGTVOIP
network-object object 899-MGTIPTV
network-object object 900-MIWAN
group-object MI_WAN_net
object-group network DM_INLINE_NETWORK_49
network-object object 200-SRVMIPCI
network-object object 201-SRVTRST
network-object object 203-MICTERM
network-object object 300-ASSPC
network-object object 301-ASSDEV
object-group network DM_INLINE_NETWORK_50
network-object object 650-WVOIP
network-object object 651-GSTVOIP1
network-object object 699-MGTVOIP
object-group network DM_INLINE_NETWORK_51
network-object object 601-ASSVOIP1
network-object object 651-GSTVOIP1
network-object object 699-MGTVOIP
object-group network DM_INLINE_NETWORK_52
network-object object 601-ASSVOIP1
network-object object 650-WVOIP
network-object object 699-MGTVOIP
!
#add service objects
object service 1433
service tcp destination eq 1433
object service 50020
service tcp destination eq 50020
object service 50026
service tcp destination eq 50026
object service 5009
service tcp destination eq 5009
object service 5055
service tcp destination eq 5055
object service 52311
service tcp destination eq 52311
object service 8000
service tcp destination eq 8000
object service 8050
service tcp destination eq 8050
object service 8080
service tcp destination eq 8080
object service 8081
service tcp destination eq 8081
object service 88
service tcp destination eq 88
object service activedirectory-tcp
service tcp destination eq 445
object service dce-endpointmapper
service tcp destination eq 135
object service ldap-udp
service udp destination eq 389
object service 10000
service tcp destination eq 10000
object service 10081
service tcp destination eq 10081
object service 135
service tcp destination eq 135
object service 18900
service tcp destination eq 18900
object service 25760
service tcp destination eq 25760
object service 25762
service tcp destination eq 25762
object service 3389
service tcp destination eq 3389
object service 35760
service tcp destination eq 35760
object service 445
service udp destination eq 445
object service 50002
service tcp destination eq 50002
object service 9100
service tcp destination eq 9100
description Micros Printer
object service 2638
service tcp destination eq 2638
object service 5012
service tcp destination eq 5012
description Distributed Service Manager
object service 50123
service tcp destination eq 50123
description MDS HTTP Service
object service 5900
service tcp destination eq 5900
description VNC fr Fernzugriff
object service 6001-6002
service tcp destination range 6001 6002
description Sentinel License
object service 7019
service tcp destination eq 7019
description Caller ID Service
object service 7300-7301
service tcp destination range 7300 7301
description Micros Cal Server FileTransfer
object service 9000
service tcp destination eq 9000
description SIX_CARDS
object service OSSEC
service udp destination eq 1514
object service 8115
service tcp destination eq 8115
object service 8953
service tcp destination eq 8953
object service 2252
service tcp destination eq 2252
object service 2251
service tcp destination eq 2251
object service 2254
service tcp destination eq 2254
object service 2270
service tcp destination eq 2270
object service 62000
service tcp destination eq 62000
object service 3000
service tcp destination eq 3000
object service 3100
service tcp destination eq 3100
object service 3200
service tcp destination eq 3200
object service 41563
service tcp destination eq 41563
object service 5061-5062
service tcp destination range 5061 5062
object service 8001
service tcp destination eq 8001
object service 8002
service tcp destination eq 8002
object service 1637
service tcp destination eq 1637
object service 1639
service tcp destination eq 1639
object service 1641
service tcp destination eq 1641
object service 1603
service tcp destination eq 1603
object service 1605
service tcp destination eq 1605
object service 1607
service tcp destination eq 1607
object service 11022
service tcp destination eq 11022
object service 5900-5902
service tcp destination range 5900 5902
object service 8443
service tcp destination eq 8443
!
#add service object groups
object-group protocol DM_INLINE_PROTOCOL_7
protocol-object ip
protocol-object icmp
object-group service MAARK1
service-object object 10000
service-object object 10081
service-object object 135
service-object object 18900
service-object object 25760
service-object object 25762
service-object object 3389
service-object object 35760
service-object object 445
service-object object 50002
service-object object 9100
service-object tcp destination eq lpd
service-object tcp destination eq netbios-ssn
service-object udp destination eq netbios-dgm
service-object udp destination eq netbios-ns
service-object udp destination eq snmp
service-object udp destination eq snmptrap
object-group service GPOD
service-object object 1433
service-object object 50020
service-object object 50026
service-object object 5009
service-object object 5055
service-object object 52311
service-object object 8000
service-object object 8050
service-object object 8080
service-object object 8081
service-object object 88
service-object object activedirectory-tcp
service-object object dce-endpointmapper
service-object object ldap-udp
service-object tcp-udp destination eq 9100
service-object tcp-udp destination eq domain
service-object tcp-udp destination eq sunrpc
service-object tcp destination eq www
service-object tcp destination eq https
service-object tcp destination eq ldap
service-object tcp destination eq ldaps
service-object tcp destination eq netbios-ssn
service-object udp destination eq netbios-dgm
service-object udp destination eq netbios-ns
object-group service MICROS
service-object object 2638
service-object object 5012
service-object object 50123
service-object object 5900
service-object object 6001-6002
service-object object 7019
service-object object 9100
service-object tcp destination eq ftp
service-object tcp destination eq www
service-object object 7300-7301
service-object icmp
object-group service DM_INLINE_SERVICE_1
service-object object 3000
service-object object 3100
service-object object 3200
object-group service DM_INLINE_SERVICE_2
service-object object 8000
service-object object 8001
service-object object 8002
object-group service DM_INLINE_SERVICE_3
service-object object 1637
service-object object 1639
service-object object 1641
object-group service DM_INLINE_SERVICE_4
service-object object 1603
service-object object 1605
service-object object 1607
object-group service IPTV_OUT
description Outbound policy for IPTV management
service-object object 11022
service-object object 8080
service-object object 8443
service-object tcp-udp destination eq domain
service-object tcp destination eq ftp
service-object tcp destination eq www
service-object tcp destination eq https
object-group service DM_INLINE_SERVICE_7
service-object object 8000
service-object object 8001
service-object object 8002
object-group service DM_INLINE_SERVICE_8
service-object object 1637
service-object object 1639
service-object object 1641
object-group service DM_INLINE_SERVICE_9
service-object object 1603
service-object object 1605
service-object object 1607
object-group service SIX_CARDS
service-object icmp
service-object object 9000
service-object icmp echo
service-object icmp echo-reply
object-group service IPTV_IN
service-object object 5900-5902
service-object object 8080
object-group service DM_INLINE_SERVICE_6
service-object object 3000
service-object object 3100
service-object object 3200
!
#add ACLs
access-list 100-LSP-MGT_access_in extended permit ip object 100-LSP-MGT object-group MI_WAN_net
access-list 200-SRVMIPCI_access_in extended permit ip object 200-SRVMIPCI object-group DM_INLINE_NETWORK_6
access-list 203-MICTERM_access_in extended permit ip object 203-MICTERM object-group DM_INLINE_NETWORK_7
access-list 699-MGTVOIP_access_in extended permit ip object 699-MGTVOIP object-group DM_INLINE_NETWORK_8
access-list 899-MGTIPTV_access_in extended permit ip object 899-MGTIPTV object-group DM_INLINE_NETWORK_9
access-list 900-MIWAN_access_in extended permit ip object-group DM_INLINE_NETWORK_2 object 100-LSP-MGT
access-list 900-MIWAN_access_in extended permit ip object-group MI_WAN_net object-group DM_INLINE_NETWORK_4
access-list 900-MIWAN_access_in extended permit ip any object 699-MGTVOIP
access-list 105-GPMS_access_in extended permit ip object 300-ASSPC object-group DM_INLINE_NETWORK_45
access-list 105-GPMS_access_in extended permit ip object 301-ASSDEV object-group DM_INLINE_NETWORK_37
access-list 105-GPMS_access_in extended permit ip object 305-ASSPC2 object-group DM_INLINE_NETWORK_46
access-list 105-GPMS_access_in extended permit ip object 351-OPERAIFC object-group DM_INLINE_NETWORK_47
access-list 105-GPMS_access_in extended permit ip object 450-ASSPCW object-group DM_INLINE_NETWORK_48
access-list 105-GPMS_access_in extended permit ip object 451-MICROSHH object-group DM_INLINE_NETWORK_49
access-list 201-SRVTRST_access_in extended permit ip object 201-SRVTRST object-group DM_INLINE_NETWORK_38
access-list 201-SRVTRST_access_in extended permit ip object 201-SRVTRST object-group DM_INLINE_NETWORK_40
access-list 202-SRVNTRST_access_in extended permit ip object 202-SRVNTRST object-group DM_INLINE_NETWORK_41
access-list 205-MICTERM2_access_in extended permit ip object 205-MICTERM2 object-group DM_INLINE_NETWORK_44
access-list 205-MICTERM2_access_in extended permit ip object 205-MICTERM2 object 451-MICROSHH
access-list 206-TOKEN_access_in extended permit ip object 206-TOKEN object 200-SRVMIPCI
access-list 601-ASSVOIP1_access_in extended permit ip object 601-ASSVOIP1 object-group DM_INLINE_NETWORK_50
access-list 651-GSTVOIP1_access_in extended permit ip object 651-GSTVOIP1 object-group DM_INLINE_NETWORK_52
access-list 650-WVOIP_access_in extended permit ip object 650-WVOIP object-group DM_INLINE_NETWORK_51
access-list 700-SURVCAM_access_in extended permit ip object 700-SURVCAM any
access-list 820-KEYCRDLC_access_in extended permit ip object 820-KEYCRDLC object-group DM_INLINE_NETWORK_1
access-list 850-IPTVNDR1_access_in extended permit ip object 850-IPTVNDR1 object 899-MGTIPTV
access-group 100-LSP-MGT_access_in in interface 100-LSP-MGT
access-group 105-GPMS_access_in in interface 105-GPMS
access-group 200-SRVMIPCI_access_in in interface 200-SRVMIPCI
access-group 201-SRVTRST_access_in in interface 201-SRVTRST
access-group 202-SRVNTRST_access_in in interface 202-SRVNTRST
access-group 203-MICTERM_access_in in interface 203-MICTERM
access-group 205-MICTERM2_access_in in interface 205-MICTERM2
access-group 206-TOKEN_access_in in interface 206-TOKEN
access-group 601-ASSVOIP1_access_in in interface 601-ASSVOIP1
access-group 650-WVOIP_access_in in interface 650-WVOIP
access-group 651-GSTVOIP1_access_in in interface 651-GSTVOIP1
access-group 699-MGTVOIP_access_in in interface 699-MGTVOIP
access-group 700-SURVCAM_access_in in interface 700-SURVCAM
access-group 820-KEYCRDLC_access_in in interface 820-KEYCRDLC
access-group 850-IPTVNDR1_access_in in interface 850-IPTVNDR1
access-group 899-MGTIPTV_access_in in interface 899-MGTIPTV
access-group 900-MIWAN_access_in in interface 900-MIWAN
!
#add NAT rules
object network 699-MGTVOIP
nat (699-MGTVOIP,906-WAN) dynamic interface
object network 899-MGTIPTV
nat (899-MGTIPTV,906-WAN) dynamic interface
object network 700-SURVCAM
nat (700-SURVCAM,906-WAN) dynamic interface
!
#configure anti-spoofing on all interfaces
ip verify reverse-path interface 100-LSP-MGT
ip verify reverse-path interface 105-GPMS
ip verify reverse-path interface 200-SRVMIPCI
ip verify reverse-path interface 201-SRVTRST
ip verify reverse-path interface 202-SRVNTRST
ip verify reverse-path interface 203-MICTERM
ip verify reverse-path interface 205-MICTERM2
ip verify reverse-path interface 206-TOKEN
ip verify reverse-path interface 601-ASSVOIP1
ip verify reverse-path interface 650-WVOIP
ip verify reverse-path interface 651-GSTVOIP1
ip verify reverse-path interface 699-MGTVOIP
ip verify reverse-path interface 700-SURVCAM
ip verify reverse-path interface 820-KEYCRDLC
ip verify reverse-path interface 850-IPTVNDR1
ip verify reverse-path interface 899-MGTIPTV
ip verify reverse-path interface 900-MIWAN
ip verify reverse-path interface 906-WAN
!
#Marriott access
username marriott password C3c1SVg5MO77QDY1 encrypted privilege 2
snmp-server host 900-MIWAN 162.130.114.45 community m@rr10tt version 2c
snmp-server host 900-MIWAN 162.130.122.125 community m@rr10tt version 2c
snmp-server host 900-MIWAN 162.130.128.92 community m@rr10tt version 2c
snmp-server location SL41TX
snmp-server contact Hoist
snmp-server community m@rr10tt
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
ssh 162.130.128.92 255.255.255.255 900-MIWAN
ssh 162.130.114.45 255.255.255.255 900-MIWAN
ssh 162.130.122.125 255.255.255.255 900-MIWAN
#—save config
end
wr mem
cisco_asa_5515-x_conf
cisco_asa_5515-x_conf.txt · Last modified: 2017/04/12 15:45 by 92.29.79.119