Коллеги, не могу настроить PAT на Cisco 871.
Исходные данные:
-локальная сеть 10.0.0.0/24
-cеть VPN клиентов 10.1.0.0/24
-пул белых адресов Х.Х.Х.92/30 (X.X.X.93 шлюз провайдера, X.X.X.94 внешний интерфейс 871)
-пул белых адресов Х.Х.Х.120/29 (X.X.X.121 внутренний интерфейс 871, X.X.X.126 пул для NAT, остальное под сервисы)
Хочу опубликовать несколько web сервисов, висящих на разных портах (83, 88) сервера 10.0.0.222.
Прописал:
ip nat inside source static tcp 10.0.0.222 88 X.X.X.123 80 extendable
ip nat inside source static tcp 10.0.0.222 83 X.X.X.124 80 extendable
Пытаюсь соединиться "снаружи" - не получается, порты закрыты.
Подскажите, что в консерватории поправить ?

Конфиг:

!
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname 871A-0A
!
boot-start-marker
boot system flash:c870-advipservicesk9-mz.124-24.T2.bin
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging message-counter syslog
logging buffered 50000
logging rate-limit 100
logging console critical
enable secret 5 .................................
!
aaa new-model
!
!
aaa authentication login local_authen local
aaa authentication ppp default group radius group vpn_users local
aaa authorization exec local_author local
aaa authorization network default group radius local if-authenticated
!
!
aaa session-id common
clock timezone EET 2
clock summer-time EET recurring last Sun Mar 3:00 last Sun Oct 4:00
!
crypto pki trustpoint tti
revocation-check crl
rsakeypair tti
!
crypto pki trustpoint TP-self-signed-925662336
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-925662336
revocation-check none
rsakeypair TP-self-signed-925662336
!
!
crypto pki certificate chain tti
crypto pki certificate chain TP-self-signed-925662336
certificate self-signed 01
......................................
      quit
dot11 syslog
no ip source-route
!
!
!
ip dhcp pool VPN_POOL
   network 10.0.1.0 255.255.255.0
   domain-name ................
   dns-server 10.0.0.221 10.0.0.222
   default-router 10.0.0.211
   netbios-name-server 10.0.0.221
   lease 90
!
!
ip cef
no ip bootp server
ip domain name .......................
ip name-server 10.0.0.221
ip name-server 10.0.0.222
ip ips notify SDEE
ip inspect log drop-pkt
ip inspect name CCP_LOW appfw CCP_LOW
ip inspect name CCP_LOW dns
ip inspect name CCP_LOW https
ip inspect name CCP_LOW icmp
ip inspect name CCP_LOW pop3
ip inspect name CCP_LOW rcmd
ip inspect name CCP_LOW esmtp
ip inspect name CCP_LOW tftp
ip inspect name CCP_LOW ftp
ip inspect name CCP_LOW tcp
ip inspect name CCP_LOW udp
ip inspect name CCP_LOW http
ip inspect name CCP_LOW ntp
ip inspect name CCP_LOW telnet
ip inspect name CCP_LOW ssh
ip inspect name INET_TO_LAN ftp
no ipv6 cef
!
appfw policy-name CCP_LOW
  application http
    strict-http action allow
    content-type-verification match-req-rsp action allow
    port-misuse p2p action reset alarm
!
multilink bundle-name authenticated
!
vpdn enable
!
vpdn-group 1
! Default PPTP VPDN group
accept-dialin
  protocol pptp
  virtual-template 1
!
!
!
object-group network MSUpdates
description MS updates servers
host 207.46.225.221
host 65.55.200.155
host 94.245.71.155
host 207.46.211.251
host 94.245.71.154
host 207.46.22.245
host 207.46.18.94
host 65.55.200.252
!
object-group network WS
description .......... workstations
range 10.0.0.1 10.0.0.200
!
username admin privilege 15 secret 5 .........................
username vpnuser privilege 0 password 7 .........................
username vpnuser aaa attribute list vpn_users
!
!
!
archive
log config
  hidekeys
!
!
ip tcp synwait-time 10
ip tftp source-interface Vlan1
ip ssh time-out 60
ip ssh authentication-retries 2
!
class-map match-any Gold
match protocol gre
match protocol pptp
class-map match-any Bronze
match protocol secure-ftp
match protocol ftp
match protocol http
match protocol secure-http
match protocol skype
class-map match-any Silver
match protocol dns
match protocol ntp
match protocol smtp
match protocol pop3
class-map match-any sdm_p2p_kazaa
match protocol fasttrack
match protocol kazaa2
class-map match-any sdm_p2p_edonkey
match protocol edonkey
class-map match-any sdm_p2p_gnutella
match protocol gnutella
class-map match-any sdm_p2p_bittorrent
match protocol bittorrent
!
!
policy-map SDM-QoS-Policy-1
class Bronze
    bandwidth percent 50
     random-detect
class Silver
    bandwidth percent 10
     random-detect
class Gold
    bandwidth percent 25
class class-default
    fair-queue
     random-detect
policy-map SDM-QoS-Policy-2
class sdm_p2p_edonkey
   drop
class sdm_p2p_gnutella
   drop
class sdm_p2p_kazaa
   drop
class sdm_p2p_bittorrent
   drop
class class-default
    shape average 1000000 24000 24000
  service-policy SDM-QoS-Policy-1
policy-map sdmappfwp2p_CCP_LOW
class sdm_p2p_edonkey
   drop
class sdm_p2p_gnutella
   drop
class sdm_p2p_kazaa
   drop
class sdm_p2p_bittorrent
   drop
class class-default
   police cir 1000000 bc 24000 be 24000
     conform-action transmit
     exceed-action drop
!
!
bridge irb
!
!
interface Null0
no ip unreachables
!
interface FastEthernet0
switchport access vlan 2
!
interface FastEthernet1
switchport access vlan 2
!
interface FastEthernet2
switchport access vlan 2
!
interface FastEthernet3
!
interface FastEthernet4
description $ES_WAN$$ETH-WAN$$FW_OUTSIDE$
bandwidth 1024
ip address X.X.X.94 255.255.255.252
ip access-group 101 in
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip nat outside
ip inspect INET_TO_LAN in
ip inspect CCP_LOW out
ip virtual-reassembly
duplex auto
speed auto
snmp trap ip verify drop-rate
service-policy input sdmappfwp2p_CCP_LOW
service-policy output SDM-QoS-Policy-2
!
interface Virtual-Template1
description $FW_INSIDE$
ip unnumbered Vlan1
ip access-group 100 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly
peer default ip address dhcp-pool VPN_POOL
compress mppc
ppp encrypt mppe auto required
ppp authentication ms-chap-v2 ms-chap
!
interface Vlan1
description $FW_INSIDE$
ip address 10.0.0.211 255.255.255.0
ip access-group 104 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly
!
interface Vlan2
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
ip address X.X.X.121 255.255.255.248
ip access-group 103 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip flow ingress
ip flow egress
ip virtual-reassembly
ip tcp adjust-mss 1452
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 X.X.X.93
ip http server
ip http access-class 1
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip flow-cache timeout inactive 10
ip flow-cache timeout active 5
ip flow-export version 5
ip flow-export destination 10.0.0.222 7777
ip flow-top-talkers
top 50
sort-by bytes
!
ip nat pool nat-net X.X.X.126 X.X.X.126 prefix-length 29
ip nat inside source list 2 pool nat-net overload
ip nat inside source static tcp 10.0.0.222 88 X.X.X.123 80 extendable
ip nat inside source static tcp 10.0.0.222 83 X.X.X.124 80 extendable
!
ip access-list log-update threshold 100
logging trap debugging
logging 10.0.0.222
access-list 1 remark HTTP Access-class list
access-list 1 remark CCP_ACL Category=1
access-list 1 permit X.X.X.120 0.0.0.7
access-list 1 permit 10.0.0.0 0.0.0.255
access-list 1 deny   any log
access-list 2 remark CCP_ACL Category=2
access-list 2 permit 10.0.0.0 0.0.0.255
access-list 2 permit 10.0.1.0 0.0.0.255
access-list 60 permit X.X.X.122
access-list 60 permit 10.0.0.0 0.0.0.255
access-list 100 remark auto generated by CCP firewall configuration
access-list 100 remark CCP_ACL Category=1
access-list 100 deny   ip X.X.X.120 0.0.0.7 any
access-list 100 deny   ip X.X.X.92 0.0.0.3 any
access-list 100 deny   ip host 255.255.255.255 any
access-list 100 deny   ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
access-list 101 remark CCP_ACL Category=1
access-list 101 permit udp host X.X.X.X eq ntp host X.X.X.94 eq ntp
access-list 101 permit udp host X.X.X.121 host X.X.X.122 eq tftp
access-list 101 permit gre any host X.X.X.126
access-list 101 permit tcp any host X.X.X.122 eq www
access-list 101 permit tcp any host X.X.X.123 eq www
access-list 101 permit tcp any host X.X.X.124 eq www
access-list 101 permit tcp any host X.X.X.126 eq 1723
access-list 101 permit udp any host X.X.X.122 eq domain
access-list 101 permit tcp any host X.X.X.122 eq domain
access-list 101 permit tcp any host X.X.X.122 eq smtp log-input
access-list 101 permit tcp any host X.X.X.122 eq ftp
access-list 101 permit tcp any host X.X.X.122 eq 88 log-input
access-list 101 permit tcp any host X.X.X.122 eq 83 log-input
access-list 101 permit tcp any host X.X.X.125 eq 5002 log-input
access-list 101 permit tcp any host X.X.X.125 eq 5005 log-input
access-list 101 permit udp host 10.0.0.222 eq domain host X.X.X.94
access-list 101 permit udp host 10.0.0.221 eq domain host X.X.X.94
access-list 101 permit icmp any host X.X.X.94 echo-reply
access-list 101 permit icmp any host X.X.X.94 time-exceeded
access-list 101 permit icmp any host X.X.X.94 unreachable
access-list 101 deny   ip any any log-input
access-list 102 remark VTY Access-class list
access-list 102 remark CCP_ACL Category=1
access-list 102 permit ip X.X.X.120 0.0.0.7 any
access-list 102 permit ip 10.0.0.0 0.0.0.255 any
access-list 102 deny   ip any any log
access-list 103 remark CCP_ACL Category=1
access-list 103 permit tcp host 10.0.0.222 eq 88 host X.X.X.123 eq www
access-list 103 permit tcp host 10.0.0.222 eq 83 host X.X.X.124 eq www
access-list 103 permit tcp host X.X.X.123 eq www host 10.0.0.222 eq 88
access-list 103 permit tcp host X.X.X.124 eq www host 10.0.0.222 eq 83
access-list 103 deny   ip 10.0.0.0 0.0.0.255 any
access-list 103 deny   ip 10.0.1.0 0.0.0.255 any
access-list 103 deny   ip X.X.X.92 0.0.0.3 any
access-list 103 deny   ip host 255.255.255.255 any
access-list 103 deny   ip 127.0.0.0 0.255.255.255 any
access-list 103 permit ip any any
access-list 104 remark auto generated by CCP firewall configuration
access-list 104 remark CCP_ACL Category=1
access-list 104 remark MS updates deny from WS
access-list 104 deny   ip object-group WS object-group MSUpdates log-input
access-list 104 permit ip 10.0.0.0 0.0.0.255 10.0.1.0 0.0.0.255 log-input
access-list 104 permit udp host 10.0.0.221 eq 1645 host 10.0.0.211
access-list 104 permit udp host 10.0.0.221 eq 1646 host 10.0.0.211
access-list 104 permit tcp 10.0.0.0 0.0.0.255 host 10.0.0.211
access-list 104 permit udp 10.0.0.0 0.0.0.255 host 10.0.0.211
access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq ftp
access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq ftp-data
access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq pop3
access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq smtp
access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq telnet
access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq www
access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 443
access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 5190
access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 5002
access-list 104 permit gre 10.0.0.0 0.0.0.255 any
access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 1723
access-list 104 permit tcp 10.0.0.0 0.0.0.255 host X.X.X.122 eq 88
access-list 104 permit tcp 10.0.0.0 0.0.0.255 host X.X.X.122 eq 83
access-list 104 permit tcp 10.0.0.0 0.0.0.255 host X.X.X.123 eq www
access-list 104 permit tcp 10.0.0.0 0.0.0.255 host X.X.X.124 eq www
access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 995
access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 465
access-list 104 permit tcp 10.0.0.0 0.0.0.255 any eq 993
access-list 104 permit icmp 10.0.0.0 0.0.0.255 any echo-reply
access-list 104 permit icmp 10.0.0.0 0.0.0.255 any echo
access-list 104 permit udp host 10.0.0.221 any eq ntp
access-list 104 permit udp host 10.0.0.221 any eq domain
access-list 104 permit tcp host 10.0.0.221 any eq domain
access-list 104 deny   ip any any log-input
no cdp run

!
!
!
!
snmp-server community .......... RO 60
snmp-server community .......... RW 60
snmp-server ifindex persist
snmp-server trap-source Vlan1
........................................
radius-server host 10.0.0.221 auth-port 1645 acct-port 1646 key 7 .....................
!
control-plane
!
!
line con 0
login authentication local_authen
no modem enable
transport output telnet
line aux 0
login authentication local_authen
transport output telnet
line vty 0 4
access-class 102 in
authorization exec local_author
login authentication local_authen
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
ntp server X.X.X.X source FastEthernet4
ntp server X.X.X.X source FastEthernet4
end

P.S. В цисках я "чайник".