<?xml version="1.0" encoding="ISO-8859-1" ?>

<NetML xmlns="http://www.xmlnetwork.org" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.xmlnetwork.org                                           netml.xsd">

	<Networks>
		<n id="n-A">
			<networkAddress>195.11.14.0/24</networkAddress>
			<CollisionDomains>
				<c id="A">
					<iface if="eth0" r_id="r_pc1"></iface>
					<iface if="eth0" r_id="r_pc2"></iface>
					<iface if="eth0" r_id="r_1"></iface>
				</c>
			</CollisionDomains>
		</n>
		<n id="n-B">
			<networkAddress>100.0.0.8/30</networkAddress>
			<CollisionDomains>
				<c id="B">
					<iface if="eth1" r_id="r_1"></iface>
					<iface if="eth1" r_id="r_2"></iface>
				</c>
			</CollisionDomains>
		</n>
		<n id="n-C">
			<networkAddress>200.1.1.0/24</networkAddress>
			<CollisionDomains>
				<c id="C">
					<iface if="eth0" r_id="r_pc3"></iface>
					<iface if="eth0" r_id="r_2"></iface>
				</c>
			</CollisionDomains>
		</n>
		<!-- Scommentare per aggiungere un'interfaccia collegata ad internet sul router r2 -->
		<!--n id="n-D">
			<networkAddress>200.1.2.0/24</networkAddress>
			<CollisionDomains>
				<c id="D">
					<iface r_id="r_2" if="eth2"/>
				</c>
			</CollisionDomains>
		</n-->
	</Networks>

	<Routers>

		<RouterConf Hostname="pc1" id="r_pc1">
			<Interface name="eth0">
				<ipAddress>195.11.14.5/24</ipAddress>
			</Interface>
			<StaticRoutes>
				<route>
					<destination>default</destination>
					<nexthop>195.11.14.1</nexthop>
				</route>
			</StaticRoutes>
		</RouterConf>

		<RouterConf Hostname="pc2" id="r_pc2">
			<Interface name="eth0">
				<ipAddress>195.11.14.8/24</ipAddress>
			</Interface>
			<StaticRoutes>
				<route>
					<destination>default</destination>
					<nexthop>195.11.14.1</nexthop>
				</route>
			</StaticRoutes>
		</RouterConf>

		<RouterConf Hostname="pc3" id="r_pc3">
			<Interface name="eth0">
				<ipAddress>200.1.1.7/24</ipAddress>
			</Interface>
			<StaticRoutes>
				<route>
					<destination>default</destination>
					<nexthop>200.1.1.1</nexthop>
				</route>
			</StaticRoutes>
		</RouterConf>

		<RouterConf Hostname="r1" id="r_1">
			<Interface name="eth0">
				<ipAddress>195.11.14.1/24</ipAddress>
			</Interface>
			<Interface name="eth1">
				<ipAddress>100.0.0.9/30</ipAddress>
			</Interface>
			<StaticRoutes>
				<route>
					<destination>200.1.1.0/24</destination>
					<nexthop>100.0.0.10</nexthop>
				</route>
			</StaticRoutes>
		</RouterConf>

		<RouterConf Hostname="r2" id="r_2">
			<Interface name="eth0">
				<ipAddress>200.1.1.1/24</ipAddress>
			</Interface>
			<Interface name="eth1">
				<ipAddress>100.0.0.10/30</ipAddress>
			</Interface>
			<StaticRoutes>
				<route>
					<destination>195.11.14.0/24</destination>
					<nexthop>100.0.0.9</nexthop>
				</route>
			</StaticRoutes>
		</RouterConf>
	</Routers>

	<Firewalls>
		<FwallConf>
			<fw_id>fwall1</fw_id>
			<link>r_1</link>
			<acl>
				<name>static_demo</name>
				<effect>demonstration of firewall rules and Nat</effect>

				<policy>deny</policy>


				<construct description="Block echo-request from pc3.Allow ping, ping reply, time-exceeded messages" name="icmp">

					<rule id="block_echo_pc3">
						<action>deny</action>
						<protocol>icmp</protocol>
						<source>200.1.1.7</source>
						<destination>any</destination>
						<options>
							<IcmpType>echo-request</IcmpType>
						</options>
					</rule>

					<rule id="icmp_in">
						<action>permit</action>
						<protocol>icmp</protocol>
						<source>any</source>
						<destination>any</destination>
						<options>
							<IcmpType>echo-request</IcmpType>
						</options>
					</rule>
					<rule id="icmp_in2">
						<action>permit</action>
						<protocol>icmp</protocol>
						<source>any</source>
						<destination>any</destination>
						<options>
							<IcmpType>echo-reply</IcmpType>
						</options>
					</rule>
					<rule id="icmp_in3">
						<action>permit</action>
						<protocol>icmp</protocol>
						<source>any</source>
						<destination>any</destination>
						<options>
							<IcmpType>ttl-exceed</IcmpType>
						</options>
					</rule>
				</construct>
			</acl>

			<nat>
				<translate interface="eth1"></translate>
			</nat>
		</FwallConf>
	</Firewalls>
</NetML>

