跨国公司在中国某一地区路由器的配置

tonychen

Using 14847 out of 491512 bytes
!
version 12.4
service tcp-keepalives-in
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
service password-encryption
!
hostname ********
!
boot-start-marker
boot-end-marker
!
logging buffered 16384 debugging
enable secret 5 $1$r4lZ$pWfHIBFA0F3obzW/BUNJk.
!
aaa new-model
!
!
aaa authentication login default group tacacs+ local
aaa authentication enable default group tacacs+ enable
aaa authorization console
aaa authorization config-commands
aaa authorization commands 1 default group tacacs+ local
aaa authorization commands 15 default group tacacs+ local
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting connection default start-stop group tacacs+
!
aaa session-id common
!
resource policy
!
ip subnet-zero
no ip source-route
ip cef
!
!
!
!
ip tftp source-interface Loopback2
no ip bootp server
no ip domain lookup
ip sla monitor responder
!
!
!
!
!
!         
!
!
!
!
!
!
!
!
username central password 7 ********
username local password 7 ***********
!
!
class-map match-any BAAB_SAP
match ip dscp af31  af32  af33
match access-group name baab_enhanced
class-map match-any BAAB_Network
match ip dscp cs6
match access-group name baab_mgmt
class-map match-any BASF_Voice
match ip dscp ef
match access-group name baab_premium
class-map match-any BAAB_Standard
match ip dscp af11  af12  af13
match access-group name baab_any
!
!
policy-map baab_CE@4M
class BAAB_Voice
  priority 1920
class Baab_SAP
  bandwidth 640
  random-detect dscp-based
  random-detect exponential-weighting-constant 6
  random-detect dscp 26   86    258   1   
  random-detect dscp 28   52    172   1   
  random-detect dscp 30   26    86    1   
   police 640000 80000 120000 conform-action set-dscp-transmit 26 exceed-action set-dscp-transmit 28 violate-action set-dscp-transmit 30
class baab_Network
  bandwidth 40
   police 40000 5000 7500 conform-action set-dscp-transmit cs6 exceed-action set-dscp-transmit cs6 violate-action set-dscp-transmit cs6
class baab_Standard
  bandwidth 1496
  random-detect dscp-based
  random-detect dscp 10   171   513   1   
  random-detect dscp 12   103   342   1   
  random-detect dscp 14   52    171   1   
   police 1496000 187000 280500 conform-action set-dscp-transmit af11 exceed-action set-dscp-transmit af12 violate-action set-dscp-transmit af13
policy-map limit_BAAB_4M
class class-default
  shape average 40960000
  service-policy baab_CE@4M
policy-map baab_CE@2M
class BAAB_Voice
  priority 1920
class baab_Network
  bandwidth 24
   police 24000 3000 4500 conform-action set-dscp-transmit cs6 exceed-action set-dscp-transmit cs6 violate-action set-dscp-transmit cs6
class baab_Standard
  bandwidth 104
  random-detect dscp-based
  random-detect dscp 10   11    33    1   
  random-detect dscp 12   7     22    1   
  random-detect dscp 14   4     11    1   
   police 104000 13000 19500 conform-action set-dscp-transmit af11 exceed-action set-dscp-transmit af12 violate-action set-dscp-transmit af13
policy-map limit_baab_2M
class class-default
  shape average 20480000
  service-policy baab@2M
!
!
!
!
interface Loopback0
no ip address
!
interface Loopback1
description USED FOR CHINA BEIJING MANAGEMENT
ip address 10.139.251.1 255.255.255.255
no ip redirects
no ip unreachables
no ip proxy-arp
no ip mroute-cache
!
interface Loopback2
ip address 63.130.26.31 255.255.255.255
!
interface GigabitEthernet0/0
description 100M Cross connect TO BASF_CHN_BJN_CO_DR01 Gi0/1
ip address 10.139.253.13 255.255.255.252
ip accounting output-packets
ip ospf message-digest-key 1 md5 7 130E18021B0D08
ip ospf cost 1
duplex full
speed 100
media-type rj45
negotiation auto
!
interface GigabitEthernet0/1
description 2M Connection C&W BEIJING MPLS NODE BEI-PE-W1 fa0/1/4 C2/846776
bandwidth 2048
ip address 192.168.3.74 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
no ip mroute-cache
load-interval 30
duplex full
speed 10
media-type rj45
negotiation auto
max-reserved-bandwidth 100
service-policy output limit_BASF_2M
!
router ospf 65010
log-adjacency-changes
area 0.0.0.0 authentication message-digest
redistribute bgp 64716 metric 50 metric-type 1 subnets
network 10.139.251.1 0.0.0.0 area 0.0.0.0
network 10.139.253.12 0.0.0.3 area 0.0.0.0
!
router bgp 64716
no synchronization
bgp log-neighbor-changes
network 10.135.0.0 mask 255.255.0.0
network 10.136.0.0 mask 255.255.0.0
network 10.136.104.0 mask 255.255.248.0
network 10.136.160.0 mask 255.255.254.0
network 10.139.251.0 mask 255.255.255.0
network 10.139.251.38 mask 255.255.255.255
network 10.139.251.41 mask 255.255.255.255
network 10.139.251.44 mask 255.255.255.255
network 10.139.251.47 mask 255.255.255.255
network 10.139.251.50 mask 255.255.255.255
network 10.139.251.53 mask 255.255.255.255
network 10.139.253.0 mask 255.255.255.0
network 10.190.231.0 mask 255.255.255.0
network 63.130.26.31 mask 255.255.255.255
network 163.128.0.0
network 192.168.3.72 mask 255.255.255.252
network 218.2.111.144 mask 255.255.255.240
network 218.104.84.176 mask 255.255.255.248
network 218.104.84.184 mask 255.255.255.248
neighbor 192.168.3.73 remote-as 4445
neighbor 192.168.3.73 password 7 05011301285C4B1B
neighbor 192.168.3.73 soft-reconfiguration inbound
neighbor 192.168.3.73 route-map DENY_ROUTE in
no auto-summary
!
ip classless
ip route 10.135.0.0 255.255.0.0 Null0
ip route 10.136.0.0 255.255.0.0 Null0
ip route 10.139.251.0 255.255.255.0 Null0
ip route 10.139.253.0 255.255.255.0 Null0
!
!
no ip http server
no ip http secure-server
ip tacacs source-interface Loopback2
!
ip access-list extended basf_any
permit ip any any
permit udp any eq 50004 any eq 50004
ip access-list extended basf_enhanced
permit udp any eq 50002 any eq 50002
ip access-list extended basf_mgmt
permit tcp 192.168.3.0 0.0.0.255 192.168.3.0 0.0.0.255 eq bgp
permit tcp 192.168.3.0 0.0.0.255 eq bgp 192.168.3.0 0.0.0.255
permit ip 63.130.0.0 0.0.63.255 any
ip access-list extended basf_premium
permit udp any eq 50000 any eq 50000
!
!
ip prefix-list DENY_ROUTE seq 10 permit 10.135.128.0/17
ip prefix-list DENY_ROUTE seq 20 deny 10.135.0.0/16 le 32
ip prefix-list DENY_ROUTE seq 30 permit 10.136.1.0/24
ip prefix-list DENY_ROUTE seq 40 permit 10.136.16.0/21
ip prefix-list DENY_ROUTE seq 50 permit 10.136.24.0/21
ip prefix-list DENY_ROUTE seq 51 permit 10.136.32.0/21
ip prefix-list DENY_ROUTE seq 60 permit 10.136.72.0/21
ip prefix-list DENY_ROUTE seq 70 permit 10.136.96.0/21
ip prefix-list DENY_ROUTE seq 71 permit 10.136.128.0/21
ip prefix-list DENY_ROUTE seq 80 permit 10.136.212.0/24 le 32
ip prefix-list DENY_ROUTE seq 90 permit 10.136.217.0/24
ip prefix-list DENY_ROUTE seq 91 permit 10.136.219.0/24
ip prefix-list DENY_ROUTE seq 92 permit 10.136.221.0/24
ip prefix-list DENY_ROUTE seq 100 permit 10.136.223.0/24
ip prefix-list DENY_ROUTE seq 110 permit 10.136.225.0/24
ip prefix-list DENY_ROUTE seq 120 permit 10.136.227.0/24
ip prefix-list DENY_ROUTE seq 130 permit 10.136.241.0/24
ip prefix-list DENY_ROUTE seq 140 deny 10.136.0.0/16 le 32
ip prefix-list DENY_ROUTE seq 160 deny 10.139.0.0/16 le 32
ip prefix-list DENY_ROUTE seq 170 deny 10.190.231.0/24
ip prefix-list DENY_ROUTE seq 180 deny 160.100.0.0/16
ip prefix-list DENY_ROUTE seq 190 deny 160.100.0.1/32
ip prefix-list DENY_ROUTE seq 200 deny 160.100.0.2/32
ip prefix-list DENY_ROUTE seq 210 deny 163.128.0.0/16
ip prefix-list DENY_ROUTE seq 220 permit 0.0.0.0/0 le 32
logging trap debugging
logging source-interface Loopback2
logging 212.137.2.20
logging 212.137.2.16
access-list 1 deny   10.139.251.35
access-list 1 deny   10.139.251.32
access-list 1 deny   10.139.251.26
access-list 1 deny   10.139.251.29
access-list 1 deny   10.139.251.17
access-list 1 deny   10.139.251.23
access-list 1 deny   10.139.251.20
access-list 1 deny   10.139.251.14
access-list 1 deny   10.135.0.0 0.0.127.255
access-list 1 deny   10.135.128.0 0.0.127.255
access-list 1 deny   10.136.1.0 0.0.0.255
access-list 1 deny   10.136.40.0 0.0.7.255
access-list 1 deny   10.136.48.0 0.0.7.255
access-list 1 deny   10.136.72.0 0.0.7.255
access-list 1 deny   10.136.96.0 0.0.7.255
access-list 1 deny   10.136.112.0 0.0.7.255
access-list 1 deny   10.136.120.0 0.0.7.255
access-list 1 deny   10.136.56.0 0.0.7.255
access-list 1 deny   10.190.231.0 0.0.0.255
access-list 1 deny   10.136.128.0 0.0.127.255
access-list 1 permit any
access-list 10 permit 204.71.220.91
access-list 10 permit 204.71.220.90
access-list 10 permit 204.71.220.75
access-list 10 permit 204.71.220.117
access-list 10 permit 212.137.2.24
access-list 10 permit 212.137.2.23
access-list 10 permit 212.137.2.22
access-list 10 permit 212.137.2.20
access-list 10 permit 212.137.2.16
access-list 10 permit 212.137.2.15
access-list 10 permit 212.137.2.11
access-list 10 permit 212.137.2.10
access-list 10 permit 212.137.2.9
access-list 10 permit 204.71.220.55
access-list 10 permit 204.71.220.54
access-list 10 permit 212.137.2.57
access-list 10 permit 204.71.220.61
access-list 10 permit 212.137.2.52
access-list 10 permit 204.71.220.60
access-list 10 permit 204.71.220.59
access-list 10 permit 212.137.2.50
access-list 10 permit 204.71.220.58
access-list 10 permit 212.137.2.49
access-list 10 permit 204.71.220.57
access-list 10 permit 204.71.220.56
access-list 10 permit 212.137.2.47
access-list 10 permit 212.137.2.46
access-list 10 permit 204.71.124.117
access-list 10 permit 10.187.20.5
access-list 10 permit 204.71.124.91
access-list 10 permit 204.71.124.75
access-list 10 permit 10.187.20.25
access-list 10 permit 204.71.124.55
access-list 10 permit 204.71.124.54
access-list 10 permit 204.71.124.61
access-list 10 permit 204.71.124.60
access-list 10 permit 204.71.124.59
access-list 10 permit 204.71.124.58
access-list 10 permit 204.71.124.57
access-list 10 permit 204.71.124.56
access-list 10 permit 212.137.2.0 0.0.0.31
access-list 10 permit 195.27.67.160 0.0.0.31
access-list 10 permit 10.187.20.0 0.0.0.255
access-list 10 permit 204.71.124.0 0.0.0.127
access-list 10 permit 195.27.67.32 0.0.0.31
access-list 10 permit 204.71.220.0 0.0.0.127
access-list 10 permit 194.221.227.32 0.0.0.31
access-list 11 permit 10.187.20.0 0.0.0.255
access-list 99 permit 212.137.2.0 0.0.0.31
access-list 99 permit 212.137.2.32 0.0.0.31
access-list 99 permit 204.71.124.0 0.0.0.255
access-list 99 permit 204.71.220.0 0.0.0.255
access-list 99 permit 10.0.0.0 0.255.255.255
access-list 99 permit 172.16.0.0 0.15.255.255
access-list 99 permit 192.168.0.0 0.0.255.255
access-list 99 permit 195.27.67.160 0.0.0.31
access-list 99 permit 141.1.20.0 0.0.0.255
access-list 99 permit 141.1.116.0 0.0.0.255
snmp-server community w36tgo4c RO 10
snmp-server community vigy90p9 RW 10
snmp-server community bAsfIPvpNrO RO 11
snmp-server trap-source Loopback2
snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
snmp-server enable traps vrrp
snmp-server enable traps ds1
snmp-server enable traps tty
snmp-server enable traps eigrp
snmp-server enable traps xgcp
snmp-server enable traps flash insertion removal
snmp-server enable traps ds3
snmp-server enable traps envmon
snmp-server enable traps icsudsu
snmp-server enable traps isdn call-information
snmp-server enable traps isdn layer2
snmp-server enable traps isdn chan-not-avail
snmp-server enable traps isdn ietf
snmp-server enable traps ds0-busyout
snmp-server enable traps ds1-loopback
snmp-server enable traps atm subif
snmp-server enable traps bgp
snmp-server enable traps bulkstat collection transfer
snmp-server enable traps cnpd
snmp-server enable traps config-copy
snmp-server enable traps config
snmp-server enable traps dial
snmp-server enable traps dsp card-status
snmp-server enable traps entity
snmp-server enable traps event-manager
snmp-server enable traps frame-relay
snmp-server enable traps frame-relay subif
snmp-server enable traps hsrp
snmp-server enable traps ipmobile
snmp-server enable traps ipmulticast
snmp-server enable traps mpls ldp
snmp-server enable traps mpls traffic-eng
snmp-server enable traps mpls vpn
snmp-server enable traps msdp
snmp-server enable traps mvpn
snmp-server enable traps ospf state-change
snmp-server enable traps ospf errors
snmp-server enable traps ospf retransmit
snmp-server enable traps ospf lsa
snmp-server enable traps ospf cisco-specific state-change nssa-trans-change
snmp-server enable traps ospf cisco-specific state-change shamlink interface-old
snmp-server enable traps ospf cisco-specific state-change shamlink neighbor
snmp-server enable traps ospf cisco-specific errors
snmp-server enable traps ospf cisco-specific retransmit
snmp-server enable traps ospf cisco-specific lsa
snmp-server enable traps pim neighbor-change rp-mapping-change invalid-pim-message
snmp-server enable traps pppoe
snmp-server enable traps cpu threshold
snmp-server enable traps rsvp
snmp-server enable traps rtr
snmp-server enable traps syslog
snmp-server enable traps l2tun session
snmp-server enable traps vsimaster
snmp-server enable traps vtp
snmp-server enable traps voice poor-qov
snmp-server enable traps voice fallback
snmp-server enable traps dnis
snmp-server host 204.71.124.117 w36tgo4c
snmp-server host 204.71.124.54 w36tgo4c
snmp-server host 204.71.220.117 w36tgo4c
snmp-server host 204.71.220.54 w36tgo4c
snmp-server host 212.137.2.20 w36tgo4c
snmp-server host 212.137.2.22 w36tgo4c
snmp-server host 212.137.2.46 w36tgo4c
snmp-server host 212.137.2.47 w36tgo4c
snmp-server host 212.137.2.49 w36tgo4c
snmp-server host 212.137.2.50 w36tgo4c
snmp-server host 212.137.2.52 w36tgo4c
snmp-server host 212.137.2.57 w36tgo4c
no cdp run
route-map DENY_ROUTE permit 10
match ip address prefix-list DENY_ROUTE
!
!
!
tacacs-server host 204.71.124.74 single-connection
tacacs-server host 204.71.220.74 single-connection
tacacs-server timeout 10
tacacs-server key 7 050F542E0759051C092D160519
!
control-plane
!
!
!
!
!
!
!
!
banner login ^C  
                  ***** WARNING *****

This computer system is private and may be accessed only
by authorized users. Data and programs in this system
are confidential and proprietary to the system owner and
may not be accessed, viewed, copied, reproduced, duplicated,
modified, distributed, or disclosed without authorization.
Unauthorized users or users who exceed their authorized
level of access are subject to prosecution under state or
federal law as well as Company initiated proceedings.
T2006     
^C
banner motd ^C!!!! NOTE THIS DEVICE IS RUNNING TACACS AUTHENTICATION !!!!^C
!
line con 0
password 7 **********
stopbits 1
line aux 0
password 7 **********
stopbits 1
line vty 0 4
access-class 99 in
exec-timeout 0 0
password 7 ***********
transport input telnet
!
scheduler allocate 20000 1000

tonychen

大家研究下哦~~~~~