
PIX Version 7.0(5) 
!
hostname fw-dmz
domain-name uk.thecloud.net
names
dns-guard
!
interface Ethernet0
 nameif outside
 security-level 0
 ip address xx.xx.xx.xx 255.255.255.192 
!
interface Ethernet1
 nameif dmz
 security-level 100
 ip address yy.yy.yy.32 255.255.255.224 
!
interface Ethernet2
 shutdown
 no nameif
 security-level 0
 no ip address
interface Ethernet3
 shutdown
 no nameif
 security-level 100
 no ip address
!
interface Ethernet4
 nameif monitor
 security-level 100
 ip address 10.5.10.33 255.255.255.0 
!
interface Ethernet5
 nameif inside
 security-level 100
 ip address 10.5.60.33 255.255.255.0 
!
passwd Leo6oh9pl4fo1oN6 encrypted
ftp mode passive

access-list http-list2 extended permit ip any any 
access-list DEVPN2 extended permit ip yy.yy.yy.32 255.255.255.224 10.5.245.0 255.255.255.0 
access-list inside_nat0_outbound extended permit ip yy.yy.yy.32 255.255.255.224 10.5.245.0 255.255.255.0
 
global (outside) 1 interface
nat (dmz) 0 access-list inside_nat0_outbound

tcp-map mss-map
  exceed-mss allow
!
pager lines 24
logging enable
logging console debugging
logging monitor debugging
logging asdm debugging
mtu outside 1500
mtu inside 1500
mtu monitor 1500
mtu dmz 1500
no failover
asdm image flash:/asdm-505.bin
asdm history enable
arp timeout 14400
route outside 0.0.0.0 0.0.0.0 router_ip 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 0.0.0.0 0.0.0.0 monitor
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 
crypto map VPNList 20 match address DEVPN2
crypto map VPNList 20 set peer tt.tt.tt.tt 
crypto map VPNList 20 set transform-set ESP-3DES-SHA
crypto map VPNList interface outside
isakmp enable outside
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash sha
isakmp policy 10 group 2
isakmp policy 10 lifetime 28800
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash sha
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
isakmp policy 30 authentication pre-share
isakmp policy 30 encryption 3des
isakmp policy 30 hash md5
isakmp policy 30 group 2
isakmp policy 30 lifetime 28800
isakmp policy 40 authentication pre-share
isakmp policy 40 encryption 3des
isakmp policy 40 hash md5
isakmp policy 40 group 2
isakmp policy 40 lifetime 86400
tunnel-group DefaultL2LGroup ipsec-attributes
 isakmp keepalive threshold 30
tunnel-group DefaultRAGroup ipsec-attributes
 isakmp keepalive threshold 10
tunnel-group tt.tt.tt.tt type ipsec-l2l
tunnel-group tt.tt.tt.tt ipsec-attributes
 pre-shared-key *
telnet timeout 20
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 monitor
ssh timeout 5
console timeout 0
management-access monitor
!
class-map inspection_default
 match default-inspection-traffic
class-map http-map1
 match access-list http-list2
!
!
policy-map global_policy
 class inspection_default
  inspect dns maximum-length 512 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect netbios 
  inspect rsh 
  inspect rtsp 
  inspect skinny 
  inspect esmtp 
  inspect sqlnet 
  inspect sunrpc 
  inspect tftp 
  inspect sip 
  inspect xdmcp 
 class http-map1
  set connection advanced-options mss-map
service-policy global_policy global
: end
