dot11 syslog
!
dot11 ssid CISCO
 vlan 500
 authentication open
 authentication key-management wpa
 guest-mode
 wpa-psk ascii 7 06273C056A05584B564353
!
ip dhcp pool VOIP
 import all
 network 192.168.20.0 255.255.255.252
 default-router 192.168.20.1
 lease 0 2
!
ip dhcp pool LOCAL_NET
 import all
 network 192.168.15.0 255.255.255.224
 default-router 192.168.15.1
 lease 0 2
!
ip dhcp pool WIFI
 import all
 network 192.168.10.0 255.255.255.224
 default-router 192.168.10.1
 lease 0 2
!ip cef
!
login block-for 600 attempts 5 within 60
login delay 5
login quiet-mode access-class VTY
login on-failure log
login on-success log
no ipv6 cef
!
multilink bundle-name authenticated
!
password encryption aes
!
!
object-group network remote-pcs
 host *.*.*.*
 host *.*.*.*
!
object-group network voip-providers
 host *.*.*.*
 host *.*.*.*
!
object-group network voip-stun-servers
 host *.*.*.*
 host *.*.*.*
 host *.*.*.*
 host *.*.*.*
!
class-map type inspect match-all OUTSIDE_TO_VOIP_EXCLUSIONS_CLASS
 match access-group name OUTSIDE_TO_VOIP_EXCLUSIONS_ACL

class-map type inspect match-all OUTSIDE_TO_SELF_EXCLUSIONS_CLASS
 match access-group name OUTSIDE_TO_SELF_EXCLUSIONS_ACL

class-map type inspect match-all INSIDE_TO_VOIP_CLASS
 match access-group name INSIDE_TO_VOIP_ACL

class-map type inspect match-all VOIP_TO_INSIDE_CLASS
 match access-group name VOIP_TO_INSIDE_ACL

class-map type inspect match-any INSIDE_TO_OUTSIDE_CLASS
 match protocol http
 match protocol https
 match protocol pop3s
 match protocol smtp
 match protocol dns
 match protocol icmp
 match protocol ntp
 match protocol tcp
 match protocol udp

class-map type inspect match-any VOIP_TO_OUTSIDE_CLASS
 match protocol ntp
 match protocol dns
 match protocol tcp
 match protocol udp
!
!
policy-map type inspect INSIDE_TO_VOIP
 class type inspect INSIDE_TO_VOIP_CLASS
  inspect
 class class-default
  drop

policy-map type inspect VOIP_TO_INSIDE
 class type inspect VOIP_TO_INSIDE_CLASS
  pass
 class class-default
  drop

policy-map type inspect OUTSIDE_TO_VOIP_EXCLUSIONS
 class type inspect OUTSIDE_TO_VOIP_EXCLUSIONS_CLASS
  pass
 class class-default
  drop

policy-map type inspect VOIP_TO_OUTSIDE
 class type inspect VOIP_TO_OUTSIDE_CLASS
  inspect
 class class-default
  drop

policy-map type inspect INSIDE_TO_OUTSIDE
 class type inspect INSIDE_TO_OUTSIDE_CLASS
  inspect
 class class-default
  drop

policy-map type inspect OUTSIDE_TO_SELF
 class type inspect OUTSIDE_TO_SELF_EXCLUSIONS_CLASS
  pass
 class class-default
  drop
!
zone security INSIDE
zone security OUTSIDE
zone security VOIP

zone-pair security INSIDE-to-OUTSIDE source INSIDE destination OUTSIDE
 service-policy type inspect INSIDE_TO_OUTSIDE

zone-pair security VOIP-to-OUTSIDE source VOIP destination OUTSIDE
 service-policy type inspect VOIP_TO_OUTSIDE

zone-pair security INSIDE-to-VOIP source INSIDE destination VOIP
 service-policy type inspect INSIDE_TO_VOIP

zone-pair security VOIP-to-INSIDE source VOIP destination INSIDE
 service-policy type inspect VOIP_TO_INSIDE

zone-pair security OUTSIDE-to-VOIP source OUTSIDE destination VOIP
 service-policy type inspect OUTSIDE_TO_VOIP_EXCLUSIONS

zone-pair security OUTSIDE-to-SELF source OUTSIDE destination self
 service-policy type inspect OUTSIDE_TO_SELF
!
!
!
!
bridge irb
!
!
!
interface FastEthernet0
 description VOIP
 switchport access vlan 700
 no ip address
 spanning-tree portfast
!
interface FastEthernet1
 description LOCAL_NET
 switchport access vlan 600
 no ip address
 spanning-tree portfast
!
interface FastEthernet2
 description LOCAL_NET
 switchport access vlan 600
 no ip address
 spanning-tree portfast
!
interface FastEthernet3
 description LOCAL_NET
 switchport access vlan 600
 no ip address
 spanning-tree portfast
!
interface FastEthernet4
 description INTERNET
 ip dhcp client client-id FastEthernet4
 ip address dhcp
 ip nat outside
 ip virtual-reassembly in
 zone-member security OUTSIDE
 duplex auto
 speed auto
!
interface Dot11Radio0
 no ip address
 !
 encryption vlan 500 mode ciphers aes-ccm
 !
 encryption mode ciphers aes-ccm
 !
 ssid CISCO
 !
 speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
 channel 2462
 station-role root
 antenna gain 25
 world-mode dot11d country HU both
!
interface Dot11Radio0.500
 encapsulation dot1Q 500
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan500
 no ip address
 ip virtual-reassembly in
 no autostate
 bridge-group 1
!
interface Vlan600
 ip address 192.168.15.1 255.255.255.224
 ip nat inside
 ip virtual-reassembly in
 zone-member security INSIDE
 no autostate
!
interface Vlan700
 ip address 192.168.20.1 255.255.255.252
 ip nat inside
 ip virtual-reassembly in
 zone-member security VOIP
 no autostate
!
interface BVI1
 ip address 192.168.10.1 255.255.255.224
 ip nat inside
 ip virtual-reassembly in
 zone-member security INSIDE
!
!
ip nat inside source list NAT interface FastEthernet4 overload
ip route 0.0.0.0 0.0.0.0 FastEthernet4 dhcp
!
ip access-list standard NAT
 permit 192.168.20.0 0.0.0.3
 permit 192.168.15.0 0.0.0.31
 permit 192.168.10.0 0.0.0.31

ip access-list standard VTY
 permit *.*.*.*
 permit *.*.*.*
 deny   any log
!
ip access-list extended INSIDE_TO_VOIP_ACL
 permit tcp 192.168.15.0 0.0.0.31 host 192.168.20.2 eq www
 permit tcp 192.168.10.0 0.0.0.31 host 192.168.20.2 eq www

ip access-list extended OUTSIDE_TO_SELF_EXCLUSIONS_ACL
 permit udp any eq bootps any eq bootpc
 permit udp any eq domain any
 permit udp any eq ntp any
 permit tcp object-group remote-pcs any eq *SSH_PORT*
 permit tcp host *.*.*.* eq www any

ip access-list extended OUTSIDE_TO_VOIP_EXCLUSIONS_ACL
 permit udp object-group voip-stun-servers eq 3478 any
 permit udp any any range *RTP_PORTS*

ip access-list extended VOIP_TO_INSIDE_ACL
 permit tcp host 192.168.20.2 eq www 192.168.15.0 0.0.0.31
 permit tcp host 192.168.20.2 eq www 192.168.10.0 0.0.0.31
!
!
bridge 1 protocol ieee
bridge 1 route ip
!
line con 0
 logging synchronous
 no modem enable
 speed 115200
line aux 0
 access-class VTY in
 transport input ssh
 transport output ssh
line vty 0 4
 access-class VTY in
 length 0
 transport input ssh
 transport output ssh
!
end