Здравствуйте.Есть cisco 3845.
int Gi0/0 смотрит в локалку.
int Gi0/1 смотрит в серую сетку ЮТК.
По области у меня есть больше полусотни филиалов, которые могут быть подключены в видеоконференцию на 4-х точечный TANDBERG с IP=10.65.0.104
Для этой цели поднят NAT.
Подключение в видеоконференцию осуществляется исходящим вызовом "МОЯ_КОРПОРАТ.СЕТЬ-->ПОЛЬЗОВАТЕЛЬ_ОБЛАСТИ"
Теперь задача стоит разрешить ходить пользователям с определенными IP из серой сетки ЮТК в мою корпоративную сеть.
Как бы это лучше реализовать? Краем уха слышал, что нужно прописывать каждый IP, но как его пустить в свою сетку не знаю.
Вот конфиг маршрутизатора:
!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
no service password-encryption
service sequence-numbers
!
hostname GW2
!
boot-start-marker
boot system flash c3845-advipservicesk9-mz.124-24.T1.bin
boot-end-marker
!
!card type command needed for slot 1
!card type command needed for slot 1
security authentication failure rate 3 log
security passwords min-length 6
logging message-counter syslog
logging buffered 51200
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxx
!
no aaa new-model
clock timezone MSK 3
clock summer-time MSK recurring last Sun Mar 2:00 last Sun Oct 2:00
no network-clock-participate slot 1
no network-clock-participate slot 2
!
dot11 syslog
ip source-route
!
ip cef
!
multilink bundle-name authenticated
!
voice-card 0
!
voice-card 2
!
voice service voip
allow-connections h323 to h323
redirect ip2ip
fax protocol t38 ls-redundancy 0 hs-redundancy 0 fallback cisco
h323
no call service stop
!
voice translation-rule 1
rule 1 /....\(..\)/ /\1/
!
voice translation-rule 2
rule 1 /.\(..\)/ /\1/
!
!
voice translation-profile 1
translate called 1
!
voice translation-profile 2
translate called 2
!
username xxx privilege 15 secret 5 xxxxxxxxxxxxxxxxxx
username xxx privilege 15 secret 5 xxxxxxxxxxxxxxxxxx
archive
log config
hidekeys
!
class-map match-all tandberg_video_signaling
match access-group name tandberg_control
class-map match-all voice_ip
match access-group name voice_ip
match ip precedence 5
class-map match-all video_ftp
match access-group name video_ftp
class-map match-all voice_signaling
match access-group name voice_signaling
class-map match-all tandberg_video_ip
match access-group name tandberg_video_ip
!
policy-map voice_video_policy
class voice_ip
priority 300
set dscp cs4
class voice_signaling
bandwidth 15
set dscp af21
class tandberg_video_signaling
bandwidth 30
set dscp af21
class tandberg_video_ip
bandwidth 1000
set dscp cs4
class video_ftp
set precedence 1
police 128000 4000 4000 conform-action transmit exceed-action drop violate-action drop
class class-default
fair-queue
random-detect
set ip precedence 0
!
interface GigabitEthernet0/0
description LAN
ip address 10.65.0.2 255.255.128.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
media-type rj45
no mop enabled
!
interface GigabitEthernet0/1
description UTK
ip address 10.9.4.186 255.255.255.248
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
media-type rj45
no mop enabled
service-policy output voice_video_policy
!
interface Serial0/0/0
no ip address
shutdown
clock rate 2000000
!
interface Serial0/0/1
no ip address
shutdown
clock rate 2000000
!
interface Serial0/1/0
no ip address
shutdown
clock rate 2000000
!
interface Serial0/1/1
no ip address
shutdown
clock rate 2000000
!
router bgp 65003
no synchronization
bgp log-neighbor-changes
neighbor 10.65.0.1 remote-as 65003
no auto-summary
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 10.65.0.1
ip route 10.9.0.0 255.255.0.0 10.9.4.185
ip http server
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip http path flash:/gui
!
ip nat inside source static 10.65.0.104 interface GigabitEthernet0/1
!
ip access-list extended LAN
deny udp any any range netbios-ns netbios-dgm
permit ip any 10.0.0.0 0.255.255.255
permit udp any any eq bootps
permit icmp any any
deny ip any any log
ip access-list extended tandberg_control
permit tcp any any range 5555 5587
permit tcp any range 5555 5587 any
ip access-list extended tandberg_video_ip
permit udp any any range 2326 2837
permit udp any range 2326 2837 any
ip access-list extended video_ftp
permit tcp any any eq ftp-data
ip access-list extended voice_ip
permit udp any any range 16384 32767
permit udp any range 16384 32767 any
ip access-list extended voice_signaling
permit tcp any eq 1720 any
permit tcp any any eq 1720
!
line con 0
exec-timeout 60 0
logging synchronous
login local
transport output telnet
line aux 0
login local
transport output telnet
line vty 0 4
exec-timeout 60 0
privilege level 15
logging synchronous
login local
transport input telnet
line vty 5 15
exec-timeout 60 0
privilege level 15
logging synchronous
login local
transport input telnet
!
scheduler allocate 20000 1000
end
