! Generated by Network Security Policy Compiler, version 2.170

! [ BEGIN router:to_branch ]
! [ Model = IOS ]
! [ Routing ]
! route network:branch -> interface:branch.trans
ip route 10.1.1.0 255.255.255.0	172.17.1.1
! route network:management -> interface:mngt.service_lan
ip route 10.1.11.0 255.255.255.0	10.10.1.6
! route network:web_servers -> interface:protect_web.service_lan
ip route 10.20.1.0 255.255.255.0	10.10.1.5
! [ ACL ]
! interface:to_branch.trans
ip access-list extended Serial0_in
! permit src=network:0/0; dst=interface:to_branch.trans; srv=service:ping;
 permit icmp any  host 172.17.1.2 8
! permit src=network:0/0; dst=interface:to_branch.trans; srv=service:pong;
 permit icmp any  host 172.17.1.2 0
! deny src=network:0/0; dst=interface:to_branch.trans; srv=auto_srv:ip;
 deny ip any  host 172.17.1.2 
! deny src=network:0/0; dst=interface:to_branch.service_lan; srv=auto_srv:ip;
 deny ip any  host 10.10.1.1 
! permit src=interface:branch.trans; dst=host:netspoc; srv=service:pong;
 permit icmp host 172.17.1.1  host 10.1.11.111 0
! permit src=interface:branch.trans; dst=host:logger; srv=service:syslog;
 permit udp host 172.17.1.1  host 10.1.11.20 eq 514
! permit src=interface:branch.trans; dst=interface:mngt.service_lan; srv=auto_srv:IPSec_AH;
 permit 51 host 172.17.1.1  host 10.10.1.6 
! permit src=interface:branch.trans; dst=interface:mngt.service_lan; srv=auto_srv:IPSec_ESP;
 permit 50 host 172.17.1.1  host 10.10.1.6 
! permit src=interface:branch.trans; dst=interface:mngt.service_lan; srv=auto_srv:IPSec_IKE;
 permit udp host 172.17.1.1 eq 500 host 10.10.1.6 eq 500
! permit src=interface:branch.trans; dst=interface:protect_web.service_lan; srv=auto_srv:IPSec_AH;
 permit 51 host 172.17.1.1  host 10.10.1.5 
! permit src=interface:branch.trans; dst=interface:protect_web.service_lan; srv=auto_srv:IPSec_ESP;
 permit 50 host 172.17.1.1  host 10.10.1.5 
! permit src=interface:branch.trans; dst=interface:protect_web.service_lan; srv=auto_srv:IPSec_IKE;
 permit udp host 172.17.1.1 eq 500 host 10.10.1.5 eq 500
! permit src=interface:branch.trans; dst=host:netspoc; srv=reverse:TCP_ANY; stateless
 permit tcp host 172.17.1.1  host 10.1.11.111  established
! deny src=network:0/0; dst=network:0/0; srv=auto_srv:ip;
 deny ip any  any 
interface Serial0
 ip access-group Serial0_in in

! interface:to_branch.service_lan
ip access-list extended FastEthernet0_in
! permit src=network:0/0; dst=interface:to_branch.service_lan; srv=service:ping;
 permit icmp any  host 10.10.1.1 8
! permit src=network:0/0; dst=interface:to_branch.service_lan; srv=service:pong;
 permit icmp any  host 10.10.1.1 0
! deny src=network:0/0; dst=interface:to_branch.trans; srv=auto_srv:ip;
 deny ip any  host 172.17.1.2 
! deny src=network:0/0; dst=interface:to_branch.service_lan; srv=auto_srv:ip;
 deny ip any  host 10.10.1.1 
! permit src=host:netspoc; dst=interface:branch.trans; srv=service:telnet;
 permit tcp host 10.1.11.111  host 172.17.1.1 eq 23
! permit src=host:netspoc; dst=interface:branch.trans; srv=service:ping;
 permit icmp host 10.1.11.111  host 172.17.1.1 8
! permit src=interface:mngt.service_lan; dst=interface:branch.trans; srv=auto_srv:IPSec_AH;
 permit 51 host 10.10.1.6  host 172.17.1.1 
! permit src=interface:mngt.service_lan; dst=interface:branch.trans; srv=auto_srv:IPSec_ESP;
 permit 50 host 10.10.1.6  host 172.17.1.1 
! permit src=interface:mngt.service_lan; dst=interface:branch.trans; srv=auto_srv:IPSec_IKE;
 permit udp host 10.10.1.6 eq 500 host 172.17.1.1 eq 500
! permit src=interface:protect_web.service_lan; dst=interface:branch.trans; srv=auto_srv:IPSec_AH;
 permit 51 host 10.10.1.5  host 172.17.1.1 
! permit src=interface:protect_web.service_lan; dst=interface:branch.trans; srv=auto_srv:IPSec_ESP;
 permit 50 host 10.10.1.5  host 172.17.1.1 
! permit src=interface:protect_web.service_lan; dst=interface:branch.trans; srv=auto_srv:IPSec_IKE;
 permit udp host 10.10.1.5 eq 500 host 172.17.1.1 eq 500
! permit src=host:logger; dst=interface:branch.trans; srv=auto_srv:udp; stateless
 permit udp host 10.1.11.20 eq 514 host 172.17.1.1 
! deny src=network:0/0; dst=network:0/0; srv=auto_srv:ip;
 deny ip any  any 
interface FastEthernet0
 ip access-group FastEthernet0_in in

! [ END router:to_branch ]