View difference between Paste ID: rdCcqgFy and mrxbqrvJ

 !
-!   SOHO CISCO ROUTER CONFIG TEMPLATE v0.1.2 - 2013.04.13 1300 CET
+!   SOHO CISCO ROUTER CONFIG TEMPLATE v0.1.2 - 2013.04.13 1330 CET
 !
 !   by Crok
 !
 !   Change the default username mgmt; password mgmt; enable mgmt
 !
     username mgmt privilege 15 secret 5 $1$KWL7$PcIDMRcRXAemWgJZ/HTvS1
     enable secret 5 $1$vOvr$/GFbYa081OyyeaSFP0v/C0
 !
 !
 ! Features:
 !
 ! +ZBFW - quite default
-! +LAN DHCP (DNS=Google) + ARP hardening
+! +LAN DHCP (DNS=Google) + ARP hardening (after router restart clients must renegotiate IP address via DHCP!)
 ! +ControlPlane policing
 ! +Only incoming SSHv2 allowed
 ! +IP SLA + tracker + Event Manager Applets monitor Internet connection (generate SYSLOG message if fail)
 ! +NTP sync for proper SYSLOG message timestamps
 ! +To check the traffic flow on the router:
 !  -Netflow configured with top talkers
 !  -IP accounting configured
 !  -IP MAC accounting configured
 !  -IP NBAR protocol discovery configured
 !
 ! Network:
 ! defgw 172.16.0.1--172.16.0.100[Fa0/0-NAT_OUT[ROUTER]NAT_IN-Fa0/1]10.10.10.1--HOSTS[DHCP:10.10.10.100-254]
 !
 !
 crypto key generate rsa label SSH modulus 2048
 service timestamps debug datetime msec
 service timestamps log datetime msec
 service password-encryption
 hostname SOHOROUTER
 boot-start-marker
 boot-end-marker
 logging buffered 512000
 aaa new-model
 aaa authentication login default local-case enable
 aaa authentication login console line enable none
 aaa authentication enable default enable
 aaa authorization exec default local
 aaa session-id common
 memory-size iomem 5
 no ip icmp rate-limit unreachable
 ip cef
 no ip dhcp use vrf connected
 ip dhcp excluded-address 10.10.10.1 10.10.10.99
 ip dhcp pool LAN
    network 10.10.10.0 255.255.255.0
    default-router 10.10.10.1
    dns-server 8.8.8.8
    lease 0 1
    update arp
 ip name-server 8.8.8.8
 login block-for 300 attempts 3 within 60
 multilink bundle-name authenticated
 parameter-map type inspect AGAINST_DOS
  max-incomplete low  2500
  max-incomplete high 3000
  one-minute low 5000
  one-minute high 5000
  tcp max-incomplete host 300 block-time 0
  sessions maximum 20000
 archive
  log config
   hidekeys
 ip tcp synwait-time 5
 ip ssh time-out 60
 ip ssh authentication-retries 2
 ip ssh version 2
 track 1 rtr 1
 track 2 rtr 2
 class-map type inspect match-any inspect-LAN-to-PUBLIC
  match protocol cuseeme
  match protocol ftp
  match protocol h323
  match protocol netshow
  match protocol shell
  match protocol realmedia
  match protocol rtsp
  match protocol sql-net
  match protocol streamworks
  match protocol tftp
  match protocol tcp
  match protocol udp
  match protocol vdolive
  match protocol icmp
  match protocol dns
  match protocol imap
  match protocol imap3
  match protocol isakmp
  match protocol pop3
  match protocol sip
  match protocol ssh
  match protocol telnet
  match protocol pptp
  match protocol smtp
  match access-group name LAN
 class-map match-all CoPP_traffic
  match access-group name CoPP_traffic
 class-map type inspect match-any PUBLIC-to-LAN
  match access-group name WAN_hardening
 class-map type inspect match-any LAN-to-PUBLIC
  match access-group name LAN
 policy-map type inspect LAN-to-PUBLIC
  class type inspect inspect-LAN-to-PUBLIC
   inspect AGAINST_DOS
  class class-default
   drop
 policy-map type inspect PUBLIC-to-LAN
  class type inspect PUBLIC-to-LAN
   pass
  class class-default
   drop
 policy-map CoPP_policy
  class CoPP_traffic
    police cir 32000
      conform-action transmit
      exceed-action drop
 zone security LAN
  description LAN
 zone security PUBLIC
  description PUBLIC
 zone-pair security LAN-to-PUBLIC source LAN destination PUBLIC
  description source LAN destination PUBLIC
  service-policy type inspect LAN-to-PUBLIC
 zone-pair security PUBLIC-to-LAN source PUBLIC destination LAN
  description source PUBLIC destination LAN
  service-policy type inspect PUBLIC-to-LAN
 interface FastEthernet0/0
  description WAN
  ip address 172.16.0.100 255.255.255.0
  ip access-group no_LAN_IP_from_WAN in
  no ip redirects
  no ip unreachables
  no ip proxy-arp
  ip accounting output-packets
  ip accounting mac-address input
  ip accounting mac-address output
  ip nbar protocol-discovery
  ip nat outside
  ip virtual-reassembly
  zone-member security PUBLIC
  ip route-cache flow
  duplex auto
  speed auto
  no shut
 interface FastEthernet0/1
  description LAN
  ip address 10.10.10.1 255.255.255.0
  ip access-group LAN in
  no ip redirects
  no ip unreachables
  no ip proxy-arp
  ip accounting output-packets
  ip accounting mac-address input
  ip accounting mac-address output
  ip nbar protocol-discovery
  ip nat inside
  ip virtual-reassembly
  zone-member security LAN
  ip route-cache flow
  duplex auto
  speed auto
  arp probe interval 10 count 3
  arp authorized
  arp timeout 3600
  no shut
 ip forward-protocol nd
 ip route 0.0.0.0 0.0.0.0 172.16.0.1
 ip flow-top-talkers
  top 20
  sort-by bytes
  cache-timeout 3600000
 no ip http server
 no ip http secure-server
 ip nat inside source list LAN interface FastEthernet0/0 overload
 ip access-list extended CoPP_traffic
  permit tcp any any eq telnet
  permit tcp any any eq 22
  permit icmp any any
 ip access-list extended LAN
  remark LAN addresses allowed
  permit ip 10.10.10.0 0.0.0.255 any
  remark DHCP requests allowed
  permit udp host 0.0.0.0 host 255.255.255.255 range bootps bootpc
 ip access-list extended WAN_hardening
  permit gre any any
  permit esp any any
  permit udp any any eq isakmp
  permit udp any any eq non500-isakmp
  permit icmp any any unreachable
  permit icmp any any echo-reply
  permit icmp any any packet-too-big
  permit icmp any any time-exceeded
  permit icmp any any traceroute
  permit icmp any any administratively-prohibited
  permit udp any any eq bootpc
  permit udp any eq domain any
  deny   ip any any
 ip access-list extended no_LAN_IP_from_WAN
  remark No LAN IPs from the WAN allowed
  deny   ip 10.10.10.0 0.0.0.255 any
  remark No private IPs from the WAN allowed
  deny   ip 0.0.0.0 0.255.255.255 any
  deny   ip 10.0.0.0 0.255.255.255 any
  deny   ip 127.0.0.0 0.255.255.255 any
  deny   ip 169.0.0.0 0.255.255.255 any
  deny   ip 172.16.0.0 0.15.255.255 any
  deny   ip 192.168.0.0 0.0.255.255 any
  deny   ip 224.0.0.0 15.255.255.255 any
  deny   ip host 255.255.255.255 any
  remark The rest will be checked by Zone Based Firewall
  permit ip any any
 ip sla 1
  icmp-echo 8.8.8.8
  frequency 30
 ip sla schedule 1 start-time now life forever
 ip sla 2
  dns ntp.ubuntu.com name-server 8.8.8.8
  frequency 30
 ip sla schedule 2 start-time now life forever
 no cdp run
 control-plane
  service-policy input CoPP_policy
 line con 0
  exec-timeout 0 0
  privilege level 15
  logging synchronous
 line aux 0
  exec-timeout 0 0
  privilege level 15
  logging synchronous
 line vty 0 4
  exec-timeout 5 0
  transport input ssh
  transport output all
 ntp clock-period 17179978
 ntp server 91.189.94.4
 event manager applet Internet_access_tracker_1_down
  event track 1 state down
  action 1.0 syslog msg "Possible Internet access outage or WAN link overload"
 event manager applet Internet_access_tracker_2_down
  event track 2 state down
  action 1.0 syslog msg "Possible Internet access outage or WAN link overload"
 event manager applet Internet_access_tracker_1_up
  event track 1 state up
  action 1.0 syslog msg "Internet access came back or utilisation fell back"
 event manager applet Internet_access_tracker_2_up
  event track 2 state up
  action 1.0 syslog msg "Internet access came back or utilisation fell back"
 end