>upgrade fpd auto
>version 12.4
>service timestamps debug datetime msec
>service timestamps log datetime msec
>service password-encryption
>hostname xxxxx
>!
>boot-start-marker
>boot system flash bootflash:c7200p-advipservicesk9-mz.124-4.XD4.bin
>boot-end-marker
>!
>logging buffered 51200 warnings
>enable password 7 xxxxx
>!
>aaa new-model
>!
>aaa authentication login default local
>aaa authentication ppp default group radius local
>aaa authorization config-commands
>aaa authorization network default group radius
>aaa accounting network default start-stop group radius
>aaa accounting system default start-stop group radius
>!
>aaa pod server auth-type any server-key xxxxxxx
>aaa session-id common
>!
>resource policy
>!
>clock timezone MSK 3
>clock summer-time MSD recurring last Sun Mar 2:00 last Sun Oct 3:00
>
>ip subnet-zero
>ip cef
>!
>ip domain name xxxxxxx.ru
>ip name-server xxx.xx.xx.xx
>ip name-server xxx.xx.xx.xx
>vpdn enable
>!
>vpdn-group 1
>! Default PPTP VPDN group
> accept-dialin
> protocol pptp
> virtual-template 1
> local name xxxxxx
>!
>interface Loopback0
> ip address 172.16.0.1 255.255.255.255
>!
>interface GigabitEthernet0/1
> ip address xxx.xx.xx.xx 255.255.255.0
> duplex auto
> speed auto
> media-type rj45
> negotiation auto
>!
>interface GigabitEthernet0/2.14
> description vpn-vlan
> encapsulation dot1Q 14
> ip address xxx.xxx.xx.xxx xxx.xxx.xxx.xxx
> ip ospf message-digest-key 1 md5 7 xxxxxxxx
> no snmp trap link-status
>!
>interface Virtual-Template1
> mtu 1460
> ip unnumbered Loopback0
> no ip proxy-arp
> ip flow ingress
> ip flow egress
> ip virtual-reassembly
> no logging event link-status
> no peer default ip address
> ppp authentication ms-chap-v2
>!
>router ospf 1
> router-id xxx.xxx.xxx.xxx
> log-adjacency-changes
> area 0 authentication message-digest
> redistribute connected subnets
> redistribute static
> network xxx.xxx.xxx.xxx x.x.xxx.xxx area 0
>!
>ip classless
>ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx
>no ip http server
>no ip http secure-server
>!
>ip bgp-community new-format
>ip flow-export source GigabitEthernet0/1
>ip flow-export version 5
>ip flow-export destination xxx.xxx.xxx.xxx 3010
>!
>logging alarm informational
>!
>access-list 140 deny tcp any any eq 135
>access-list 140 deny tcp any any eq 139
>access-list 140 deny tcp any any eq 445
>access-list 140 deny udp any any eq 135
>access-list 140 deny udp any any eq 136
>access-list 140 deny udp any any eq netbios-ns
>access-list 140 deny udp any any eq netbios-dgm
>access-list 140 deny udp any any eq netbios-ss
>access-list 140 permit ip any any
>!
>access-list 153 deny tcp any any eq 135
>access-list 153 deny tcp any any eq 137
>access-list 153 deny tcp any any eq 139
>access-list 153 deny tcp any any eq 445
>access-list 153 deny udp any any eq netbios-ns
>access-list 153 deny udp any any eq netbios-dgm
>access-list 153 permit ip any any
>!
>radius-server attribute 8 include-in-access-req
>radius-server configure-nas
>radius-server host xxx.xxx.xxx.xxx auth-port 1812 acct-port 1813
>radius-server timeout 30
>radius-server key 7 xxxxxxxxx
>radius-server authorization default Framed-Protocol ppp
>radius-server vsa send accounting
>radius-server vsa send authentication
>
>Из радиуса передаётся
>ip access-list 140 in
>ip access-list 153 out
>и
>rate limit input
>rate limit output попробуйте сделать шейпинг через полиси
типа так
задать статично на самой циске типа
policy-map Vpn56
class class-default
police rate 56000 bps burst 7000 bytes peak-rate 64000 bps peak-burst 8000 byt es
policy-map Vpn56in
class class-default
police rate 56000 bps burst 7000 bytes
и передавать на циску уже
service-policy output Vpn56
service-policy input Vpn56in
получше ratelimit будет
и аксес листы можно статично на темплейт прописать, нахрен их выдавать если они не меняются?
