: Saved
: Written by rdrake at 02:00:04.756 UTC Thu Jul 20 2006
!
ASA Version 7.0(4) 
!
hostname ASA
domain-name stayonline.net
enable password hello 
names
!
interface GigabitEthernet0/0
 description Outside 
 nameif Outside
 security-level 0
 ip address 64.250.184.195 255.255.255.224
!
interface GigabitEthernet0/3
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/3.3
 description DNS/ntp services lan
 vlan 3
 nameif vlan3
 security-level 5
 ip address 192.168.3.1 255.255.255.0
!
interface GigabitEthernet0/3.4
 description DNS/ntp services lan
 vlan 4
 nameif vlan4
 security-level 5
 ip address 192.168.4.1 255.255.255.0
!
interface GigabitEthernet0/3.6
 description DNS/ntp services lan
 vlan 6
 nameif vlan6
 security-level 5
 ip address 192.168.6.1 255.255.255.0
!
interface GigabitEthernet0/3.7
 description DNS/ntp services lan
 vlan 7
 nameif vlan7
 security-level 5
 ip address 192.168.7.1 255.255.255.0
!
interface GigabitEthernet0/3.774
 description DNS/ntp services lan
 vlan 774
 nameif vlan774
 security-level 5
 ip address 208.118.92.94 255.255.255.248
!

interface Management0/0
 shutdown
 nameif management
 security-level 0
 no ip address
!
passwd hello
!
time-range test
!
ftp mode passive
object-group network test
 network-object host 10.1.1.1
 network-object host 10.1.1.2
 network-object host 10.1.1.3
object-group network ldap_net_obj
 network-object host 10.3.1.12
 network-object host 10.3.1.13
access-list trans-gatekeeper extended permit tcp host 10.3.1.30 any eq www 
access-list trans-gatekeeper extended permit tcp host 10.3.1.30 any eq https 
access-list acl_Inside extended permit ip 10.3.1.0 255.255.255.0 10.1.1.0 255.255.255.0 
access-list acl_Inside extended permit ip 10.3.1.0 255.255.255.0 10.4.1.0 255.255.255.0 
access-list acl_Inside extended permit tcp 10.3.1.0 255.255.255.0 any eq www 
access-list acl_Inside extended permit tcp 10.3.1.0 255.255.255.0 any eq https 
access-list acl_Inside extended permit tcp 10.3.1.0 255.255.255.0 any eq smtp 
access-list acl_Inside extended permit tcp 10.3.1.0 255.255.255.0 any eq ssh 
access-list acl_Inside extended permit tcp host 10.3.1.9 any eq domain 
access-list acl_Inside extended permit udp host 10.3.1.9 any eq domain 
access-list acl_dmz1 extended permit tcp host 10.3.3.2 any eq ssh 
access-list acl_dmz1 extended permit tcp host 10.3.3.2 any eq telnet 
access-list acl_dmz1 extended permit tcp host 10.3.3.2 any eq ftp 
access-list acl_dmz1 extended permit tcp host 10.3.3.2 any eq www 
access-list acl_dmz1 extended permit tcp host 10.3.3.2 any eq https 
access-list acl_dmz1 extended permit udp host 10.3.3.2 any eq snmp 
access-list acl_dmz1 extended permit udp host 10.3.3.2 host 10.3.1.2 eq domain 
access-list acl_dmz1 extended permit tcp host 10.3.3.2 host 10.3.1.2 eq domain 
access-list acl_dmz1 remark need to add mysql/pgsql
access-list acl_dmz1 extended permit icmp host 10.3.3.2 any 
access-list acl_dmz1 remark need to add ssh to inside stuff (10.3.1.x) but add a deny for specifics
access-list acl_dnsdmz extended deny ip any 10.3.3.0 255.255.255.0 
access-list acl_dnsdmz extended permit tcp host 10.3.3.6 any eq domain 
access-list acl_dnsdmz extended permit udp host 10.3.3.6 any eq domain 
access-list acl_outside extended permit udp any host 66.154.82.4 eq domain 
access-list acl_outside extended permit tcp any host 66.154.82.4 eq domain 
access-list acl_dmz11_svcs extended permit tcp host 10.3.3.2 any eq domain 
access-list acl_dmz11_svcs extended permit udp host 10.3.3.2 any eq domain 
access-list acl_dmz11_svcs extended permit tcp host 10.3.3.2 object-group ldap_net_obj eq ldaps 
access-list acl_dmz11_svcs extended permit tcp host 10.3.3.2 any eq www 
access-list acl_dmz11_svcs extended permit tcp host 10.3.3.2 any eq https 
access-list acl_dmz11_svcs remark Need to restrict this to one SMTP smarthost
access-list acl_dmz11_svcs extended permit tcp host 10.3.3.2 any eq smtp log warnings 
access-list acl_dmz11_svcs extended permit ip any any log warnings 
pager lines 24
logging enable
logging console debugging
logging buffered warnings
mtu Outside 1500
mtu Inside 1500
mtu 69net 1500
mtu management 1500
mtu dmz11_svcs 1500
ip local pool INSIDE_POOL 10.3.1.50-10.3.1.55 mask 255.255.255.0
ip verify reverse-path interface Outside
ip verify reverse-path interface Inside
ip verify reverse-path interface 69net
ip verify reverse-path interface dmz11_svcs
no failover
asdm image disk0:/asdm504.bin
asdm group ldap_net_obj Inside
no asdm history enable
arp timeout 14400
global (Outside) 20 interface
global (69net) 20 interface
static (dmz11_svcs,Outside) 66.154.82.4 10.3.3.2 netmask 255.255.255.255 
access-group acl_outside in interface Outside
access-group acl_dmz11_svcs in interface dmz11_svcs
route Outside 0.0.0.0 0.0.0.0 66.154.82.1 1
route Inside 10.1.1.0 255.255.255.0 10.3.1.1 1
route 69net 66.56.72.153 255.255.255.255 69.61.23.177 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
group-policy DfltGrpPolicy attributes
 banner none
 wins-server none
 dns-server none
 dhcp-network-scope none
 vpn-access-hours none
 vpn-simultaneous-logins 3
 vpn-idle-timeout 30
 vpn-session-timeout none
 vpn-filter none
 vpn-tunnel-protocol IPSec 
 password-storage disable
 ip-comp disable
 re-xauth disable
 group-lock none
 pfs enable
 ipsec-udp enable
 ipsec-udp-port 10000
 split-tunnel-policy tunnelall
 split-tunnel-network-list none
 default-domain none
 split-dns none
 secure-unit-authentication disable
 user-authentication disable
 user-authentication-idle-timeout 30
 ip-phone-bypass disable
 leap-bypass disable
 nem disable
 backup-servers keep-client-config
 client-firewall none
 client-access-rule none
 webvpn
  functions url-entry
  port-forward-name value Application Access
username jhardeman password WjdlE2lPJfcud7l5 encrypted privilege 15
username rdrake password GMo5zNo09bAzywyL encrypted privilege 15
aaa authentication ssh console LOCAL 
aaa authentication enable console LOCAL 
http server enable
http 208.50.96.2 255.255.255.255 Outside
http 66.56.72.153 255.255.255.255 Outside
http 10.3.1.0 255.255.255.0 Inside
http 10.1.1.0 255.255.255.0 Inside
http 66.56.72.153 255.255.255.255 69net
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac 
crypto dynamic-map 69net_dyn_map 65534 set transform-set ESP-AES-256-SHA
crypto map 69net_map 65535 ipsec-isakmp dynamic 69net_dyn_map
crypto map 69net_map interface 69net
isakmp enable Outside
isakmp enable 69net
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption aes-256
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
tunnel-group DefaultRAGroup general-attributes
 address-pool INSIDE_POOL
tunnel-group DefaultRAGroup ipsec-attributes
 pre-shared-key test
telnet timeout 5
ssh 10.3.1.0 255.255.255.0 Inside
ssh 10.1.1.0 255.255.255.0 Inside
ssh timeout 5
console timeout 0
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map global_policy
 class inspection_default
  inspect dns maximum-length 512 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect netbios 
  inspect rsh 
  inspect rtsp 
  inspect skinny 
  inspect esmtp 
  inspect sqlnet 
  inspect sunrpc 
  inspect tftp 
  inspect sip 
  inspect xdmcp 
  inspect icmp 
!
service-policy global_policy global
tftp-server Inside 10.3.1.12 /
Cryptochecksum:664cf0f1f350e025956d4c4fe0b1476f
: end