SOHO CISCO ROUTER CONFIG TEMPLATE v0.1.1 - 2013.04.13 1200

!
! SOHO ROUTER CONFIG TEMPLATE v0.1.1 - 2013.04.13 12:30 CET
!
!   Change the default username mgmt; password mgmt; enable mgmt
!
! Features:
!
! +ZBFW - quite default
! +LAN DHCP (DNS=Google) + ARP hardening
! +ControlPlane policing
! +Only incoming SSHv2 allowed
! +IP SLA + tracker + Event Manager Applets monitor Internet connection (generate SYSLOG message if fail)
! +NTP sync for proper SYSLOG message timestamps
! +To check the traffic flow on the router:
!  -Netflow configured with top talkers
!  -IP accounting configured
!  -IP MAC accounting configured
!  -IP NBAR protocol discovery configured
!
! Network:
! defgw 172.16.0.1--172.16.0.100[Fa0/0-NAT_OUT[ROUTER]NAT_IN-Fa0/1]10.10.10.1--HOSTS[DHCP:10.10.10.100-254]
!
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname SOHOROUTER
boot-start-marker
boot-end-marker
logging buffered 512000
enable secret 5 $1$vOvr$/GFbYa081OyyeaSFP0v/C0
aaa new-model
aaa authentication login default local-case enable
aaa authentication login console line enable none
aaa authentication enable default enable
aaa authorization exec default local
aaa session-id common
memory-size iomem 5
no ip icmp rate-limit unreachable
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 10.10.10.1 10.10.10.99
ip dhcp pool LAN
   network 10.10.10.0 255.255.255.0
   default-router 10.10.10.1
   dns-server 8.8.8.8
   lease 0 1
   update arp
ip name-server 8.8.8.8
login block-for 300 attempts 3 within 60
multilink bundle-name authenticated

parameter-map type inspect AGAINST_DOS
 max-incomplete low  2500
 max-incomplete high 3000
 one-minute low 5000
 one-minute high 5000
 tcp max-incomplete host 300 block-time 0
 sessions maximum 20000
username mgmt privilege 15 secret 5 $1$KWL7$PcIDMRcRXAemWgJZ/HTvS1
archive
 log config
  hidekeys
ip tcp synwait-time 5
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
track 1 rtr 1
track 2 rtr 2
class-map type inspect match-any inspect-LAN-to-PUBLIC
 match protocol cuseeme
 match protocol ftp
 match protocol h323
 match protocol netshow
 match protocol shell
 match protocol realmedia
 match protocol rtsp
 match protocol sql-net
 match protocol streamworks
 match protocol tftp
 match protocol tcp
 match protocol udp
 match protocol vdolive
 match protocol icmp
 match protocol dns
 match protocol imap
 match protocol imap3
 match protocol isakmp
 match protocol pop3
 match protocol sip
 match protocol ssh
 match protocol telnet
 match protocol pptp
 match protocol smtp
 match access-group name LAN
class-map match-all CoPP_traffic
 match access-group name CoPP_traffic
class-map type inspect match-any PUBLIC-to-LAN
 match access-group name WAN_hardening
class-map type inspect match-any LAN-to-PUBLIC
 match access-group name LAN
policy-map type inspect LAN-to-PUBLIC
 class type inspect inspect-LAN-to-PUBLIC
  inspect AGAINST_DOS
 class class-default
  drop
policy-map type inspect PUBLIC-to-LAN
 class type inspect PUBLIC-to-LAN
  pass
 class class-default
  drop
policy-map CoPP_policy
 class CoPP_traffic
   police cir 32000
     conform-action transmit
     exceed-action drop
zone security LAN
 description LAN
zone security PUBLIC
 description PUBLIC
zone-pair security LAN-to-PUBLIC source LAN destination PUBLIC
 description source LAN destination PUBLIC
 service-policy type inspect LAN-to-PUBLIC
zone-pair security PUBLIC-to-LAN source PUBLIC de
 description source PUBLIC destination LAN
 service-policy type inspect PUBLIC-to-LAN
interface FastEthernet0/0
 description WAN
 ip address 172.16.0.100 255.255.255.0
 ip access-group no_LAN_IP_from_WAN in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip accounting output-packets
 ip accounting mac-address input
 ip accounting mac-address output
 ip nbar protocol-discovery
 ip nat outside
 ip virtual-reassembly
 zone-member security PUBLIC
 ip route-cache flow
 duplex auto
 speed auto
interface FastEthernet0/1
 description LAN
 ip address 10.10.10.1 255.255.255.0
 ip access-group LAN in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip accounting output-packets
 ip accounting mac-address input
 ip accounting mac-address output
 ip nbar protocol-discovery
 ip nat inside
 ip virtual-reassembly
 zone-member security LAN
 ip route-cache flow
 duplex auto
 speed auto
 arp probe interval 10 count 3
 arp authorized
 arp timeout 3600
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 172.16.0.1
ip flow-top-talkers
 top 20
 sort-by bytes
 cache-timeout 3600000
no ip http server
no ip http secure-server
ip nat inside source list LAN interface FastEthernet0/0 overload
ip access-list extended CoPP_traffic
 permit tcp any any eq telnet
 permit tcp any any eq 22
 permit icmp any any
ip access-list extended LAN
 remark LAN addresses allowed
 permit ip 10.10.10.0 0.0.0.255 any
 remark DHCP requests allowed
 permit udp host 0.0.0.0 host 255.255.255.255 range bootps bootpc
ip access-list extended WAN_hardening
 permit gre any any
 permit esp any any
 permit udp any any eq isakmp
 permit udp any any eq non500-isakmp
 permit icmp any any unreachable
 permit icmp any any echo-reply
 permit icmp any any packet-too-big
 permit icmp any any time-exceeded
 permit icmp any any traceroute
 permit icmp any any administratively-prohibited
 permit udp any any eq bootpc
 permit udp any eq domain any
 deny   ip any any
ip access-list extended no_LAN_IP_from_WAN
 remark No LAN IPs from the WAN allowed
 deny   ip 10.10.10.0 0.0.0.255 any
 remark No private IPs from the WAN allowed
 deny   ip 0.0.0.0 0.255.255.255 any
 deny   ip 10.0.0.0 0.255.255.255 any
 deny   ip 127.0.0.0 0.255.255.255 any
 deny   ip 169.0.0.0 0.255.255.255 any
 deny   ip 172.16.0.0 0.15.255.255 any
 deny   ip 192.168.0.0 0.0.255.255 any
 deny   ip 224.0.0.0 15.255.255.255 any
 deny   ip host 255.255.255.255 any
 remark The rest will be checked by Zone Based Firewall
 permit ip any any
ip sla 1
 icmp-echo 8.8.8.8
 frequency 30
ip sla 2
 dns ntp.ubuntu.com name-server 8.8.8.8
 frequency 30
no cdp run
control-plane
 service-policy input CoPP_policy
line con 0
 exec-timeout 0 0
 privilege level 15
 password 7 15050A1F007B797768
 logging synchronous
line aux 0
 exec-timeout 0 0
 privilege level 15
 logging synchronous
line vty 0 4
 exec-timeout 5 0
 password 7 15050A1F007B797768
 transport input ssh
 transport output all
ntp clock-period 17179978
ntp server 91.189.94.4
event manager applet Internet_access_tracker_1_down
 event track 1 state down
 action 1.0 syslog msg "Possible Internet access outage or WAN link overload"
event manager applet Internet_access_tracker_2_down
 event track 2 state down
 action 1.0 syslog msg "Possible Internet access outage or WAN link overload"
event manager applet Internet_access_tracker_1_up
 event track 1 state up
 action 1.0 syslog msg "Internet access came back or utilisation fell back"
event manager applet Internet_access_tracker_2_up
 event track 2 state up
 action 1.0 syslog msg "Internet access came back or utilisation fell back"
end