Firewall

ip access-list extended SECURE-ASTANA
 
! === DMVPN: GRE, ESP, ISAKMP, NAT-T ===
 permit gre any any
 permit esp any any
 permit udp any any eq 500
 permit udp any any eq 4500
 
! === EIGRP (IP Protocol 88) ===
 permit eigrp any any
 
! === BGP (TCP/179) ===
 permit tcp any any eq 179
 
! === HTTP (TCP/80) ===
 permit tcp 172.16.10.0 0.0.0.255 any eq 80
 permit tcp 10.0.0.0 0.0.0.255 any eq 80
 permit tcp 172.16.20.0 0.0.0.255 any eq 80
 permit tcp 172.20.3.0 0.0.0.255 any eq 80
 permit tcp 172.20.4.0 0.0.0.255 any eq 80
 permit tcp 192.168.39.0 0.0.0.127 any eq 80
 
! === SSH (TCP/22) ===
 permit tcp any any eq 22
 
! === SNMP (UDP/161) ===
 permit udp any any eq 161
 
! === NTP (UDP/123) ===
 permit udp any any eq 123
 
! === DNS (UDP/53) ===
 permit udp any any eq 53
 
! === ICMP ===
 permit icmp any any
 
! === Internal transport and routing links ===
 permit ip 172.20.1.0 0.0.0.3 any
 permit ip 172.20.2.0 0.0.0.3 any
 permit ip 172.20.24.0 0.0.0.3 any
 permit ip 10.0.10.0 0.0.0.3 any
 permit ip 10.0.20.0 0.0.0.3 any
 permit ip 100.10.9.4 0.0.0.3 any
 permit ip 94.121.72.0 0.0.0.255 any
 permit ip 132.87.2.0 0.0.0.255 any
 permit ip 18.31.192.0 0.0.0.255 any
 permit ip 100.71.60.252 0.0.0.3 any
 permit ip 1.1.1.0 0.0.0.3 any
 
! === Allow loopback for diagnostics ===
 permit ip host 8.8.8.8 any
 permit ip any host 8.8.8.8
 
! === Block all other traffic and log ===
 deny ip any any log
 
int range g0/0-1
ip access-group SECURE-ASTANA in