unset key protection enable set clock timezone 6 set clock dst recurring start-weekday 2 0 3 02:00 end-weekday 1 0 11 02:00

set vrouter trust-vr sharable set vrouter "untrust-vr" exit set vrouter "trust-vr" unset auto-route-export exit set service "Viettelimex Conference" protocol tcp src-port 0-65535 dst-port 1720 -1720 set service "Viettelimex Conference" + tcp src-port 0-65535 dst-port 1503-1503 set service "Viettelimex Conference" + tcp src-port 0-65535 dst-port 389-389 set service "Viettelimex Conference" + tcp src-port 0-65535 dst-port 3603-3603 set service "Viettelimex Conference" + tcp src-port 0-65535 dst-port 1731-1731 set service "Viettelimex Conference" + udp src-port 0-65535 dst-port 1718-1719 set service "Viettelimex Conference" + tcp src-port 0-65535 dst-port 3230-3235 set service "Viettelimex Conference" + udp src-port 0-65535 dst-port 3230-3235 set service "MSSQL" protocol tcp src-port 0-65535 dst-port 1433-1433 set service "RemoteDesktop" protocol tcp src-port 0-65535 dst-port 3389-3389 set service "RemoteDesktop" + udp src-port 0-65535 dst-port 3389-3389 set service "SM" protocol tcp src-port 0-65535 dst-port 8000-9000 set alg appleichat enable unset alg appleichat re-assembly enable set alg sctp enable set auth-server "Local" id 0 set auth-server "Local" server-name "Local" set auth default auth server "Local" set auth radius accounting port 1646 set admin name "netscreen" set admin password "nJ58B9rzGTtEcT5G1sbG/+PtfuB/1n" set admin port 6789 set admin auth web timeout 10 set admin auth dial-in timeout 3 set admin auth server "Local" set admin format dos set zone "Trust" vrouter "trust-vr" set zone "Untrust" vrouter "trust-vr" set zone "DMZ" vrouter "trust-vr" set zone "VLAN" vrouter "trust-vr" set zone id 100 "Conference" set zone id 101 "TaiChinh" set zone id 102 "BANKT" set zone id 103 "P.TCLD" set zone id 104 "P.KH" set zone "Untrust-Tun" vrouter "trust-vr" set zone "Trust" tcp-rst set zone "Untrust" block unset zone "Untrust" tcp-rst set zone "MGT" block unset zone "V1-Trust" tcp-rst unset zone "V1-Untrust" tcp-rst set zone "DMZ" tcp-rst unset zone "V1-DMZ" tcp-rst set zone "VLAN" block unset zone "VLAN" tcp-rst unset zone "Conference" tcp-rst unset zone "TaiChinh" tcp-rst unset zone "BANKT" tcp-rst unset zone "P.TCLD" tcp-rst

unset zone "P.KH" tcp-rst set zone "Untrust" screen tear-drop set zone "Untrust" screen syn-flood set zone "Untrust" screen ping-death set zone "Untrust" screen ip-filter-src set zone "Untrust" screen land set zone "V1-Untrust" screen tear-drop set zone "V1-Untrust" screen syn-flood set zone "V1-Untrust" screen ping-death set zone "V1-Untrust" screen ip-filter-src set zone "V1-Untrust" screen land set interface "ethernet0/0" zone "Untrust" set interface "ethernet0/1" zone "Trust" set interface "ethernet0/2" zone "BANKT" set interface "ethernet0/3" zone "TaiChinh" set interface "ethernet0/4" zone "P.TCLD" set interface "ethernet0/5" zone "P.KH" set interface "ethernet0/6" zone "DMZ" set interface "bgroup0" zone "Trust" set interface "tunnel.1" zone "Trust" unset interface vlan1 ip set interface ethernet0/0 ip 10.30.17.2/32 set interface ethernet0/0 route set interface ethernet0/1 ip 192.168.1.1/24 set interface ethernet0/1 nat set interface ethernet0/2 ip 192.168.2.1/24 set interface ethernet0/2 nat set interface ethernet0/3 ip 192.168.3.1/24 set interface ethernet0/3 nat set interface ethernet0/4 ip 192.168.4.1/24 set interface ethernet0/4 nat set interface ethernet0/5 ip 192.168.5.1/24 set interface ethernet0/5 nat set interface ethernet0/6 ip 192.168.6.1/24 set interface ethernet0/6 route set interface tunnel.1 mtu 1500 set interface "ethernet0/2" pmtu ipv4 unset interface vlan1 bypass-others-ipsec unset interface vlan1 bypass-non-ip set interface ethernet0/0 ip manageable set interface ethernet0/1 ip manageable set interface ethernet0/2 ip manageable set interface ethernet0/3 ip manageable set interface ethernet0/4 ip manageable set interface ethernet0/5 ip manageable set interface ethernet0/6 ip manageable set interface ethernet0/0 manage ping set interface ethernet0/0 manage ssh set interface ethernet0/0 manage telnet set interface ethernet0/0 manage ssl set interface ethernet0/0 manage web set interface ethernet0/2 manage ping set interface ethernet0/2 manage ssh set interface ethernet0/2 manage telnet set interface ethernet0/2 manage snmp set interface ethernet0/2 manage ssl set interface ethernet0/2 manage web set interface ethernet0/3 manage ping set interface ethernet0/3 manage ssh set interface ethernet0/3 manage telnet

set interface ethernet0/3 manage snmp set interface ethernet0/3 manage ssl set interface ethernet0/3 manage web set interface ethernet0/4 manage ping set interface ethernet0/4 manage ssh set interface ethernet0/4 manage telnet set interface ethernet0/4 manage snmp set interface ethernet0/4 manage ssl set interface ethernet0/4 manage web set interface ethernet0/5 manage ping set interface ethernet0/5 manage telnet set interface ethernet0/6 manage ssh set interface ethernet0/6 manage telnet set interface ethernet0/6 manage snmp set interface ethernet0/6 manage ssl set interface ethernet0/6 manage web set interface ethernet0/6 manage ident-reset set interface ethernet0/0 vip interface-ip set interface ethernet0/1 dhcp server service set interface ethernet0/2 dhcp server service set interface ethernet0/3 dhcp server service set interface ethernet0/4 dhcp server service set interface ethernet0/5 dhcp server service set interface ethernet0/1 dhcp server enable set interface ethernet0/2 dhcp server enable set interface ethernet0/3 dhcp server enable set interface ethernet0/4 dhcp server enable set interface ethernet0/5 dhcp server enable set interface ethernet0/1 dhcp server option lease 1440000 set interface ethernet0/1 dhcp server option gateway 192.168.1.1 set interface ethernet0/1 dhcp server option netmask 255.255.255.0 set interface ethernet0/1 dhcp server option dns1 192.168.6.2 set interface ethernet0/1 dhcp server option dns2 203.113.131.1 set interface ethernet0/2 dhcp server option lease 1440000 set interface ethernet0/2 dhcp server option gateway 192.168.2.1 set interface ethernet0/2 dhcp server option netmask 255.255.255.0 set interface ethernet0/3 dhcp server option lease 1440000 set interface ethernet0/3 dhcp server option gateway 192.168.3.1 set interface ethernet0/3 dhcp server option netmask 255.255.255.0 set interface ethernet0/3 dhcp server option dns1 192.168.6.2 set interface ethernet0/3 dhcp server option dns2 203.113.131.1 set interface ethernet0/4 dhcp server option lease 1440000 set interface ethernet0/4 dhcp server option gateway 192.168.4.1 set interface ethernet0/4 dhcp server option netmask 255.255.255.0 set interface ethernet0/4 dhcp server option dns1 203.113.131.1 set interface ethernet0/4 dhcp server option dns2 8.8.8.8 set interface ethernet0/5 dhcp server option lease 1440000 set interface ethernet0/5 dhcp server option gateway 192.168.5.1 set interface ethernet0/5 dhcp server option netmask 255.255.255.0 set interface ethernet0/5 dhcp server option dns1 203.113.131.1 set interface ethernet0/1 dhcp server ip 192.168.1.20 to 192.168.1.250 set interface ethernet0/3 dhcp server ip 192.168.3.2 to 192.168.3.100 set interface ethernet0/4 dhcp server ip 192.168.4.2 to 192.168.4.100 set interface ethernet0/5 dhcp server ip 192.168.5.2 to 192.168.5.100 unset interface ethernet0/1 dhcp server config next-server-ip unset interface ethernet0/2 dhcp server config next-server-ip unset interface ethernet0/3 dhcp server config next-server-ip unset interface ethernet0/4 dhcp server config next-server-ip unset interface ethernet0/5 dhcp server config next-server-ip set interface ethernet0/0 dip interface-ip incoming

set interface "ethernet0/0" mip 10.30.17.2 host 192.168.6.5 netmask 255.255.255. 255 vr "trust-vr" set interface "serial0/0" modem settings "USR" init "AT&F" set interface "serial0/0" modem settings "USR" active set interface "serial0/0" modem speed 115200 set interface "serial0/0" modem retry 3 set interface "serial0/0" modem interval 10 set interface "serial0/0" modem idle-time 10 set flow tcp-mss unset flow no-tcp-seq-check set flow tcp-syn-check unset flow tcp-syn-bit-check set flow reverse-route clear-text prefer set flow reverse-route tunnel always set pki authority default scep mode "auto" set pki x509 default cert-path partial set address "Untrust" "10.31.4.0/25" 10.31.4.0 255.255.255.128 set address "Untrust" "10.31.4.57/32" 10.31.4.57 255.255.255.255 set address "Untrust" "CNNam-FTTH(10.30.220.6)" 10.30.220.6 255.255.255.255 "DSS (CNNam)" set address "Untrust" "TT OEM (10.30.189.99)" 10.30.189.99 255.255.255.255 "DSS" set address "Untrust" "TTBL (10.30.188.12)" 10.30.188.12 255.255.255.255 "DSS" set address "Untrust" "TTBL - FTTH(10.30.189.123)" 10.30.189.123 255.255.255.255 "DSS(TTBL)" set address "Untrust" "TTPP DANG (10.30.255.155)" 10.30.255.155 255.255.255.255 "VIDEO" set address "Untrust" "TTPP(10.30.191.136)" 10.30.191.136 255.255.255.255 "DSS ( TTPP)" set address "Untrust" "TTTM(10.30.191.68)" 10.30.191.68 255.255.255.255 "DSS TTT M" set address "Untrust" "TTXNK(10.31.179.138)" 10.31.179.138 255.255.255.255 "DSS TTXNK" set address "DMZ" "192.168.6.0/24" 192.168.6.0 255.255.255.0 set address "DMZ" "192.168.6.1/24" 192.168.6.1 255.255.255.0 set address "DMZ" "192.168.6.10/32" 192.168.6.10 255.255.255.255 set address "DMZ" "192.168.6.11/32" 192.168.6.11 255.255.255.255 set address "DMZ" "192.168.6.4/32" 192.168.6.4 255.255.255.255 set address "DMZ" "192.168.6.5/32" 192.168.6.5 255.255.255.255 set address "DMZ" "P.TCLD" 192.168.4.1 255.255.255.255 set address "BANKT" "192.168.2.0/24" 192.168.2.0 255.255.255.0 set address "BANKT" "server bkt(192.168.2.89)" 192.168.2.89 255.255.255.255 "tho ng du lieu" set address "P.TCLD" "192.168.4.0/24" 192.168.4.0 255.255.255.0 set address "P.TCLD" "192.168.4.1/32" 192.168.4.1 255.255.255.255 set address "P.TCLD" "P.TCLD (192.168.4.0)" 192.168.4.0 255.255.255.0 set address "P.KH" "P.KH(192.168.5.0)" 192.168.5.0 255.255.255.0 set group address "Untrust" "DSS" comment "Financial Server" set group address "Untrust" "DSS" add "CNNam-FTTH(10.30.220.6)" set group address "Untrust" "DSS" add "TT OEM (10.30.189.99)" set group address "Untrust" "DSS" add "TTBL (10.30.188.12)" set group address "Untrust" "DSS" add "TTBL - FTTH(10.30.189.123)" set group address "Untrust" "DSS" add "TTPP DANG (10.30.255.155)" set group address "Untrust" "DSS" add "TTPP(10.30.191.136)" set group address "Untrust" "DSS" add "TTTM(10.30.191.68)" set group address "Untrust" "DSS" add "TTXNK(10.31.179.138)" set group address "Untrust" "VanTay" comment "Vn tay" set group address "Untrust" "VanTay" add "TTPP(10.30.191.136)" set group address "Untrust" "Video" comment "Conferences" set group address "Untrust" "Video" add "CNNam-FTTH(10.30.220.6)" set group address "Untrust" "Video" add "TTPP DANG (10.30.255.155)"

set group address "Untrust" "Video" add "TTPP(10.30.191.136)" set group address "Untrust" "VoIP" comment "Sip Phone" set group service "Tech-HTTP" set group service "Tech-HTTP" add "HTTP-EXT" set group service "Tech-HTTP" add "HTTPS" set group service "Tech-HTTP" add "SM" set user "2700" uid 1 set user "2700" type l2tp set user "2700" remote ipaddr "192.168.5.0" set user "2700" password "e1x1LfC4NOHR+hsIElChQ+l9n9nUtmeFJw==" unset user "2700" type auth set user "2700" "enable" set crypto-policy exit set ike respond-bad-spi 1 set ike ikev2 ike-sa-soft-lifetime 60 unset ike ikeid-enumeration unset ike dos-protection unset ipsec access-session enable set ipsec access-session maximum 5000 set ipsec access-session upper-threshold 0 set ipsec access-session lower-threshold 0 set ipsec access-session dead-p2-sa-timeout 0 unset ipsec access-session log-error unset ipsec access-session info-exch-connected unset ipsec access-session use-error-log set vrouter "untrust-vr" exit set vrouter "trust-vr" exit set url protocol type sc-cpa set url protocol sc-cpa set deny-message "Your page is blocked due to a security policy that prohibits a ccess to $URL_CATEGORY" exit set policy id 1 name "Trust-Untrust" from "Trust" to "Untrust" "Any" "Any" "ANY " nat src permit set policy id 1 exit set policy id 2 name "Trust - DMZ" from "Trust" to "DMZ" "Any" "192.168.6.0/24" "ANY" permit set policy id 2 exit set policy id 4 name "DMZ-Untrust" from "DMZ" to "Untrust" "Any" "Any" "ANY" na t src permit set policy id 4 exit set policy id 10 from "TaiChinh" to "Untrust" "Any" "Any" "ANY" nat src permit set policy id 10 exit set policy id 12 from "Untrust" to "DMZ" "DSS" "MIP(10.30.17.2)" "MS-SQL" nat s rc permit set policy id 12 exit set policy id 13 from "Untrust" to "DMZ" "TTBL - FTTH(10.30.189.123)" "192.168. 6.5/32" "RemoteDesktop" permit set policy id 13 exit set policy id 14 from "DMZ" to "Trust" "192.168.6.0/24" "Any" "ANY" permit set policy id 14

exit set policy id 15 permit set policy id 15 exit set policy id 16 permit set policy id 16 exit set policy id 18 set policy id 18 exit set policy id 19 set policy id 19 exit set policy id 20 set policy id 20 exit set policy id 22 set policy id 22 exit set policy id 23 permit set policy id 23 exit set policy id 24 "ANY" permit set policy id 24 exit set policy id 25 "ANY" permit set policy id 25 exit set policy id 26 nat src permit set policy id 26 exit set policy id 27 Y" permit set policy id 27 exit set policy id 28 Y" permit set policy id 28 exit set policy id 29 " permit set policy id 29 exit set policy id 30 " permit set policy id 30 exit set policy id 31 rc permit set policy id 31 exit set policy id 32 NY" permit set policy id 32

from "BANKT" to "DMZ" "192.168.2.0/24" "192.168.6.0/24" "ANY"

from "DMZ" to "BANKT" "192.168.6.0/24" "192.168.2.0/24" "ANY"

from "TaiChinh" to "Trust" "Any" "Any" "ANY" nat src permit from "TaiChinh" to "DMZ" "Any" "192.168.6.0/24" "ANY" permit from "DMZ" to "TaiChinh" "192.168.6.0/24" "Any" "ANY" permit from "Trust" to "TaiChinh" "Any" "Any" "ANY" permit from "BANKT" to "Untrust" "192.168.2.0/24" "Any" "ANY" nat src

from "P.TCLD" to "DMZ" "P.TCLD (192.168.4.0)" "192.168.6.0/24"

from "DMZ" to "P.TCLD" "192.168.6.0/24" "P.TCLD (192.168.4.0)"

from "P.TCLD" to "Untrust" "P.TCLD (192.168.4.0)" "Any" "ANY"

from "BANKT" to "P.TCLD" "192.168.2.0/24" "192.168.4.0/24" "AN

from "P.TCLD" to "BANKT" "192.168.4.0/24" "192.168.2.0/24" "AN

from "DMZ" to "P.KH" "192.168.6.0/24" "P.KH(192.168.5.0)" "ANY

from "P.KH" to "DMZ" "P.KH(192.168.5.0)" "192.168.6.0/24" "ANY

from "P.KH" to "Untrust" "P.KH(192.168.5.0)" "Any" "ANY" nat s

from "P.KH" to "BANKT" "P.KH(192.168.5.0)" "192.168.2.0/24" "A

exit set policy id 33 from "BANKT" to "P.KH" "192.168.2.0/24" "P.KH(192.168.5.0)" "A NY" permit set policy id 33 exit set policy id 34 from "Untrust" to "Trust" "Any" "Any" "ANY" permit set policy id 34 exit set nsmgmt bulkcli reboot-timeout 60 set ssh version v2 set ssh enable set config lock timeout 5 unset license-key auto-update set pattern-update proxy http 192.168.2.89:8868 set pattern-update proxy ssl 192.168.2.89:8868 set snmp port listen 161 set snmp port trap 162 set vrouter "untrust-vr" exit set vrouter "trust-vr" unset add-default-route set route 0.0.0.0/0 interface ethernet0/0 gateway 10.30.17.1 exit set vrouter "untrust-vr" exit set vrouter "trust-vr" exit