interface Ethernet 0/0 ! Mosbach lokal
   　　ip address 129.143.204.13 255.255.255.252
   　　description Ethernet zum RZ-Router
   　　no ip directed-broadcast ! wg. Hacker (denial of service)
   　　ip inspect FIWA in ! Ueberpruefung des IP-Verkehrs
   　　ip access-group 101 in ! Anti-Spoofing
   　　ip access-group 102 out ! zusaetzliches Welt-LAN-Filter wegen Servern
   　　no shutdown
   　　!
   　　no access-list 101
   　　access-list 101 permit tcp 129.143.204.12 0.0.0.3 any ! RZ-Router Anti-Spoofing
   　　access-list 101 permit udp 129.143.204.12 0.0.0.3 any ! RZ-Router Anti-Spoofing
   　　access-list 101 permit icmp 129.143.204.12 0.0.0.3 any ! RZ-Router Anti-Spoofing
   　　access-list 101 permit tcp 193.196.5.0 0.0.0.255 any ! Netz der BA-Mo Anti-Spoofing
   　　access-list 101 permit udp 193.196.5.0 0.0.0.255 any ! Netz der BA-Mo Anti-Spoofing
   　　access-list 101 permit icmp 193.196.5.0 0.0.0.255 any ! Netz der BA-Mo Anti-Spoofing
   　　access-list 101 deny ip any any
   　　!
   　　! Zulassen von gewissen Diensten auf die Server
   　　no access-list 102
   　　!
   　　access-list 102 permit tcp any any eq 22 ! SSH
   　　access-list 102 permit tcp any any eq 113 ! Ident
   　　access-list 102 permit tcp any any eq 487 ! SAFT
   　　!
   　　permit tcp any gt 1023 host 193.196.5.107 eq 21 ! FTP-Commands (fuer PASV FTP)
   　　permit tcp any gt 1023 host 193.196.5.105 eq 21 ! FTP-Commands (fuer PASV FTP)
   　　!
   　　access-list 102 permit tcp any host 193.196.5.107 eq 25 ! SMTP zulassen
   　　access-list 102 permit tcp any host 193.196.5.105 eq 25 ! SMTP zulassen
   　　!
   　　access-list 102 permit tcp host 129.143.2.1 host 193.196.5.107 eq 53 ! DNS Zone-Transfer
   　　access-list 102 permit tcp host 129.206.100.126 host 193.196.5.107 eq 53 ! DNS Zone-Transfer
   　　access-list 102 permit tcp host 129.206.100.127 host 193.196.5.107 eq 53 ! DNS Zone-Transfer
   　　access-list 102 permit tcp host 129.143.2.1 host 193.196.5.105 eq 53 ! DNS Zone-Transfer
   　　access-list 102 permit tcp host 129.206.100.126 host 193.196.5.105 eq 53 ! DNS Zone-Transfer
   　　access-list 102 permit tcp host 129.206.100.127 host 193.196.5.105 eq 53 ! DNS Zone-Transfer
   　　
   　　access-list 102 permit permit tcp any host 193.196.5.107 eq 80 ! WWW
   　　access-list 102 permit permit tcp any host 193.196.5.105 eq 80 ! WWW
   　　!
   　　access-list 102 permit tcp any host 193.196.5.107 eq 119 ! nntp
   　　access-list 102 permit tcp any host 193.196.5.105 eq 119 ! nntp
   　　!
   　　access-list 102 permit udp any host 193.196.5.107 eq 123 ! ntp
   　　access-list 102 permit udp any host 193.196.5.105 eq 123 ! ntp
   　　!
   　　access-list 102 permit tcp any host 193.196.5.107 eq 389 ! ldap
   　　access-list 102 permit tcp any host 193.196.5.105 eq 389 ! ldap
   　　!
   　　access-list 102 permit tcp any host 193.196.5.107 eq 443 ! https
   　　access-list 102 permit tcp any host 193.196.5.105 eq 443 ! https
   　　!
   　　access-list 102 permit tcp any host 193.196.5.107 eq 993 ! Secure-IMAP
   　　access-list 102 permit tcp any host 193.196.5.105 eq 993 ! Secure-IMAP
   　　!
   　　access-list 102 permit tcp any host 193.196.5.107 eq 995 ! Secure-POP3
   　　access-list 102 permit tcp any host 193.196.5.105 eq 995 ! Secure-POP3
   　　!
   　　! bei geringeren Sicherheitsanforderungen:
   　　!
   　　access-list 102 permit tcp any host 193.196.5.107 eq 110 ! POP3 zulassen
   　　access-list 102 permit tcp any host 193.196.5.105 eq 110 ! POP3 zulassen
   　　access-list 102 permit udp any host 193.196.5.105 eq 53 ! DNS-Anfragen
   　　access-list 102 permit udp any host 193.196.5.107 eq 53 ! DNS-Anfragen
   　　!
   　　!
   　　access-list 102 permit icmp any host 193.196.5.107 administratively-prohibited
   　　access-list 102 permit icmp any host 193.196.5.107 echo
   　　access-list 102 permit icmp any host 193.196.5.107 echo-reply
   　　access-list 102 permit icmp any host 193.196.5.107 packet-too-big
   　　access-list 102 permit icmp any host 193.196.5.107 time-exceeded
   　　access-list 102 permit icmp any host 193.196.5.107 traceroute
   　　access-list 102 permit icmp any host 193.196.5.107 unreachable
   　　access-list 102 deny ip any any
   　　!
   　　ip inspect name FIWA http java-list 50 ! JavaScript ablehnen nach ACL 50
   　　ip inspect name FIWA realaudio timeout 3600
   　　ip inspect name FIWA smtp timeout 3600
   　　ip inspect name FIWA tftp timeout 30
   　　ip inspect name FIWA ftp timeout 3600
   　　ip inspect name FIWA udp timeout 15
   　　ip inspect name FIWA tcp timeout 3600
   　　!
   　　no access-list 50
   　　access-list 50 permit any log
   　　
   　　评:虽然是很好.但是访问列表过多,一旦被DOS一攻可能路由器马上瘫痪…重启…所以我认为要在前面加多一台Router来做个TCP Intercept 来拦截DOS攻击.如下:
   　　假如管理到个服务器群网络上192.168.111.0 & 192.168.112.0 内的目标主机的TCP连接请求.使用拦截模式,随机丢弃连接:
   　　access-list 123 permit tcp any 192.168.111.0 0.0.0.255
   　　access-liat 123 permit tcp any 192.168.112..0 0.0.0.255
   　　ip tcp intercept list 123
   　　ip tcp intercept mode intercept
   　　ip tcp intercept drop-mode random
   　　
   　　做好以后.两个Router在做个HSRP ……..