! Projet : segmentation et securisation d'un reseau de PME
! Equipement : routeur Cisco IOS compatible 802.1Q

enable
configure terminal

hostname R1-PME
no ip domain-lookup
service password-encryption
enable secret A_REMPLACER

! Administration securisee en SSH
ip domain-name pme.local
username administrateur privilege 15 secret A_REMPLACER
crypto key generate rsa modulus 2048
ip ssh version 2

line vty 0 4
 login local
 transport input ssh
 exec-timeout 5 0
exit

! Lien physique vers le commutateur
interface GigabitEthernet0/0
 no shutdown
exit

! Une sous-interface et une passerelle par VLAN
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.10.1 255.255.255.0
 ip nat inside
exit

interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.20.1 255.255.255.0
 ip nat inside
exit

interface GigabitEthernet0/0.30
 encapsulation dot1Q 30
 ip address 192.168.30.1 255.255.255.0
 ip access-group ACL_INVITES in
 ip nat inside
exit

interface GigabitEthernet0/0.99
 encapsulation dot1Q 99
 ip address 192.168.99.1 255.255.255.0
 ip nat inside
exit

! Les vingt premieres adresses restent disponibles pour les equipements fixes
ip dhcp excluded-address 192.168.10.1 192.168.10.20
ip dhcp excluded-address 192.168.20.1 192.168.20.20
ip dhcp excluded-address 192.168.30.1 192.168.30.20

ip dhcp pool VLAN10-ADMINISTRATION
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 1.1.1.1
exit

ip dhcp pool VLAN20-EMPLOYES
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1
 dns-server 1.1.1.1
exit

ip dhcp pool VLAN30-INVITES
 network 192.168.30.0 255.255.255.0
 default-router 192.168.30.1
 dns-server 1.1.1.1
exit

! Le reseau invite est isole des trois reseaux internes
ip access-list extended ACL_INVITES
 deny ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255
 deny ip 192.168.30.0 0.0.0.255 192.168.20.0 0.0.0.255
 deny ip 192.168.30.0 0.0.0.255 192.168.99.0 0.0.0.255
 permit ip 192.168.30.0 0.0.0.255 any
exit

! Liaison Internet de demonstration - adresses reservees a la documentation
interface GigabitEthernet0/1
 description VERS_FAI
 ip address 203.0.113.2 255.255.255.252
 ip nat outside
 no shutdown
exit

access-list 1 permit 192.168.0.0 0.0.255.255
ip nat inside source list 1 interface GigabitEthernet0/1 overload
ip route 0.0.0.0 0.0.0.0 203.0.113.1

end
write memory

