Здравствуйте. У меня есть cisco 881, на ней настроен ZBF с белым списком сайтов. Конфигурация следующая:
| C |
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
| Building configuration...
Current configuration : 29276 bytes
!
! Last configuration change at 09:52:53 PCTime Tue Apr 30 2013 by newadmin
!
version 15.0
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname Cisco
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200
logging console critical
enable secret 5 $1$KNe6$71R8ILxVSZyE.ByqnFszP/
!
aaa new-model
!
!
aaa authentication login default local
!
!
!
!
!
aaa session-id common
!
!
!
memory-size iomem 10
clock timezone PCTime 4
regexp optimize
!
no ip source-route
!
ip cef
no ip bootp server
ip domain name nprogs.com
ip name-server 208.67.222.222
ip name-server 8.8.8.8
no ipv6 cef
!
!
multilink bundle-name authenticated
parameter-map type urlfpolicy local URLFilter
alert off
block-page message "Sorry bro, access to this page is closed!"
parameter-map type urlf-glob Oracle
pattern ekiga.net
pattern *.ekiga.net
pattern voipbuster.com
pattern *.voipbuster.com
pattern w3schools.com
pattern *.w3schools.com
pattern stackoverflow.com
pattern *.stackoverflow.com
pattern *oracle*
pattern error-codes.info
pattern *.error-codes.info
pattern javascript.ru
pattern *.javascript.ru
pattern demoaut.com
pattern *.demoaut.com
pattern software-testing.ru
pattern *.software-testing.ru
parameter-map type urlf-glob Google
pattern *google*
parameter-map type urlf-glob DeniedSites
pattern *
parameter-map type urlf-glob Trust
pattern trust.ru
pattern *.trust.ru
parameter-map type urlf-glob Tsconsulting
pattern tsconsulting.ru
pattern *.tsconsulting.ru
parameter-map type urlf-glob Microsoft
pattern *microsoft*
parameter-map type urlf-glob Yandex
pattern *yandex*
pattern ya.ru
pattern *.ya.ru
parameter-map type urlf-glob Siebel
pattern *siebel*
parameter-map type urlf-glob Linux
pattern *linux*
parameter-map type urlf-glob Cisco
pattern *cisco*
parameter-map type urlf-glob Intuit
pattern intuit.ru
pattern *.intuit.ru
parameter-map type urlf-glob SQL
pattern sql.ru
pattern *.sql.ru
parameter-map type urlf-glob Technoserv
pattern 194.154.81.246
pattern eventum.siblion.ru
pattern technoserv.ru
pattern *.technoserv.ru
pattern russianhelicopters.aero
pattern *.russianhelicopters.aero
parameter-map type urlf-glob Tcsbank
pattern tcsbank.ru
pattern *.tcsbank.ru
pattern 91.194.227.4
parameter-map type urlf-glob HF
pattern hflabs.ru
pattern *.hflabs.ru
pattern mango-office.ru
license udi pid CISCO881-SEC-K9 sn FCZ1534C6BT
!
!
username newadmin privilege 15 secret 5 $1$OutE$GGojcvSnwBnFX1hEyHnDA0
!
!
ip tcp synwait-time 10
no ip ftp passive
ip ssh time-out 60
ip ssh authentication-retries 2
!
class-map type urlfilter match-any PermittedSites
match server-domain urlf-glob Oracle
match server-domain urlf-glob Google
match server-domain urlf-glob Trust
match server-domain urlf-glob Tsconsulting
match server-domain urlf-glob Microsoft
match server-domain urlf-glob Yandex
match server-domain urlf-glob Siebel
match server-domain urlf-glob Linux
match server-domain urlf-glob Intuit
match server-domain urlf-glob SQL
match server-domain urlf-glob Technoserv
match server-domain urlf-glob Tcsbank
match server-domain urlf-glob HF
class-map type inspect match-all UDP
match access-group name UDP
match protocol udp
class-map type inspect match-any Control
match protocol dns
match protocol icmp
match protocol l2tp
match protocol udp
match protocol https
match protocol tcp
match protocol ssh
match protocol telnet
match protocol pptp
match protocol http
class-map type inspect match-all TCP
match access-group name TCP
match protocol tcp
class-map type inspect match-any Web
match access-group name Limited
match protocol http
class-map type inspect match-all GRE
match access-group name GRE
class-map type inspect match-any Web2
match protocol http
class-map type urlfilter match-any DeniedSites
match server-domain urlf-glob DeniedSites
!
!
policy-map type inspect urlfilter SocialNetworking
parameter type urlfpolicy local URLFilter
class type urlfilter PermittedSites
allow
log
class type urlfilter DeniedSites
log
reset
policy-map type inspect InsideToOutside
class type inspect Web
inspect
service-policy urlfilter SocialNetworking
class type inspect Control
inspect
class type inspect GRE
inspect
class class-default
pass
policy-map type inspect OutsideToInside
class type inspect Control
inspect
class type inspect Web2
inspect
class type inspect GRE
inspect
class class-default
pass
!
zone security Inside
zone security Outside
zone-pair security Inside_to_Outside source Inside destination Outside
service-policy type inspect InsideToOutside
zone-pair security Outside_to_Inside source Outside destination Inside
service-policy type inspect OutsideToInside
!
!
!
!
!
!
!
interface FastEthernet0
!
!
interface FastEthernet1
!
!
interface FastEthernet2
!
!
interface FastEthernet3
!
!
interface FastEthernet4
ip ddns update ccp_ddns1
ip address ххх.ххх.ххх.ххх 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat outside
ip virtual-reassembly
zone-member security Outside
duplex auto
speed auto
no cdp enable
!
!
interface Vlan1
ip address 10.10.10.1 255.255.255.0
ip flow ingress
ip nat inside
ip virtual-reassembly
zone-member security Inside
!
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip flow-export source FastEthernet4
ip flow-export version 5
ip flow-export destination 10.10.10.200 2345
ip flow-top-talkers
top 20
sort-by bytes
!
ip dns server
ip nat inside source list 1 interface FastEthernet4 overload
ip nat inside source list 108 interface FastEthernet4 overload
ip route 0.0.0.0 0.0.0.0 78.31.75.129
ip route 0.0.0.0 0.0.0.0 91.214.242.1
!
ip access-list extended GRE
deny gre any any
ip access-list extended Limited
deny tcp host 10.10.10.3 any eq www time-range TIME
deny tcp host 10.10.10.4 any eq www time-range TIME
deny tcp host 10.10.10.5 any eq www time-range TIME
deny tcp host 10.10.10.7 any eq www time-range TIME
deny tcp host 10.10.10.9 any eq www time-range TIME
deny tcp host 10.10.10.11 any eq www time-range TIME
deny tcp host 10.10.10.13 any eq www time-range TIME
deny tcp host 10.10.10.16 any eq www time-range TIME
deny tcp host 10.10.10.17 any eq www time-range TIME
deny tcp host 10.10.10.37 any eq www time-range TIME
deny tcp host 10.10.10.20 any eq www time-range TIME
deny tcp host 10.10.10.21 any eq www time-range TIME
deny tcp host 10.10.10.22 any eq www time-range TIME
deny tcp host 10.10.10.25 any eq www time-range TIME
deny tcp host 10.10.10.26 any eq www time-range TIME
deny tcp host 10.10.10.33 any eq www time-range TIME
deny tcp host 10.10.10.200 any eq www time-range TIME
permit tcp any any eq www
!
logging trap debugging
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 10.10.10.0 0.0.0.255
access-list 108 permit ip 10.10.10.0 0.0.0.255 any
no cdp run
!
line con 0
no modem enable
transport output telnet
line aux 0
transport output telnet
line vty 0 4
privilege level 15
transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
time-range TIME
periodic weekdays 10:00 to 18:00
!
end |
|
Проблема возникает при добавлении в class-map type urlfilter match-any PermittedSites новые доступные сайты, например parameter-map type urlf-glob Cisco, командой:
match server-domain urlf-glob Cisco
Начинается компиляция регулярки из parameter-map и она либо заканчивается ошибкой Unable to compile regexp, либо отваливается telnet. После этого файрволл начинает пропускать все и медленно открываются страницы, при этом появляется большая задержка по telnet. После удаления фильтра из class-map, нормальная работа восстанавливается, заблокированные ресурсы перестают открываться. Проявляться эта ошибка стала после того, как cisco стал периодически подвисать с загрузкой 100% (спасает только ребут), полгода все работало нормально. С чем может быть связана такая проблема с производительностью? Какую статистику можно собрать, чтобы понять причину? Может быть сама cisco медленно подыхает?
(
