CISCO c921-4P Konfiguration

service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime localtime
service timestamps log datetime localtime show-timezone year
no service password-encryption
!
aaa new-model
aaa authentication login default local
aaa local authentication attempts max-fail 3
!
clock timezone CET 1 0
clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
no ip gratuitous-arps
no ip source-route
!
ip domain name lowartz.home.arpa
ip domain lookup source-interface GigabitEthernet5
ip cef
login block-for 120 attempts 3 within 15
login on-failure log
login on-success log
login quiet-mode access-class SSH_ACCESS
!
security authentication failure rate 3 log
enable algorithm-type scrypt secret <password>
username <username> privilege 15 algorithm-type scrypt secret <password>
!
no cdp run
lldp run
!
!
interface GigabitEthernet0
description Security Gateway (PUB-WIF)
switchport mode access
switchport access vlan 10
!
interface GigabitEthernet1
description Security Gateway (PUB-LAN)
switchport mode access
switchport access vlan 11
!
interface GigabitEthernet2
description Security DNS Cluster
switchport mode access
switchport access vlan 12
!
interface GigabitEthernet3
description Security Firewall (DMZ)
switchport mode access
switchport access vlan 13
!
interface GigabitEthernet4
description WAN-1, ISP (5G)
shutdown
!
interface GigabitEthernet5
description WAN-2, ISP (Cable)
ip address dhcp
ip nat outside
no lldp transmit
!
!
interface vlan10
description L3 PUB-WIF
ip address 10.10.10.1 255.255.255.254 
no ip redirects
ip nat inside
!
interface vlan11
description L3 PUB-LAN
ip address 10.10.11.1 255.255.255.254
no ip redirects
ip nat inside
!
interface vlan12
description L3 DNS-Cluster
ip address 10.10.12.1 255.255.255.254
no ip redirects
ip nat inside
!
interface vlan13
description L3 Firewall-DMZ
ip address 10.10.13.1 255.255.255.254
no ip redirects
ip nat inside
!
!
ip nat inside source list NAT_WAN1 interface GigabitEthernet5 overload
!
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 2
!
ip access-list extended NAT_WAN1
3 remark NAT ACL
10 permit ip 10.10.0.0 0.0.15.255 any
!
ip access-list extended SSH_ACCESS
3 remark Konfigzugang ACL
10 permit tcp 10.10.0.0 0.0.15.255 any
!
ip dns server
!
no ip http server
no ip http secure-server
ip http authentication local
!
ntp server de.pool.ntp.org source GigabitEthernet5
ntp update-calendar 
!
banner exec #
Sie sind verbunden mit VTY $(line) auf dem Router $(hostname)
#
!
banner motd #
*****************************************************************************
*                 Cisco 921-4P Lowartz Net network device                   *
*                                                                           *
*       This system is for the use of authorized users only.                *
*       Individuals using this computer system without authority, or in     *
*       excess of their authority, are subject to having all of their       *
*       activities on this system monitored and recorded by system          *
*       personnel.                                                          *
*       In the course of monitoring individuals improperly using this       *
*       system, or in the course of system maintenance, the activities      *
*       of authorized users may also be monitored.                          *
*                                                                           *
*       Anyone using this system expressly consents to such monitoring      *
*       and is advised that if such monitoring reveals possible             *
*       evidence of criminal activity, system personnel may provide the     *
*       evidence of such monitoring to law enforcement officials.           *
*****************************************************************************
#
!
line vty 0 4
 (access-class SSH_ACCESS in)  --> Optional bei CLI Zugangsbeschränkung
 transport input telnet ssh  --> "telnet" weglassen wenn nur SSH
!
end