Friday, December 9, 2011

Cisco ASA to Pix site to site VPN template

Here is a sample site to site vpn template for an ASA to a Pix.  Thought someone might be interested in having something like this.  Its been handy for me.  Its good to just modify to your needs and cut and paste in.  All in notepad.

ASA config:
access-list nonat extended permit ip 172.16.0.0 255.255.0.0 192.168.30.0 255.255.255.0
access-list nonat extended permit ip 10.10.0.0 255.255.0.0 192.168.30.0 255.255.255.0
access-list huntsville_remote extended permit ip 172.16.0.0 255.255.0.0 192.168.30.0 255.255.255.0
access-list huntsville_remote extended permit ip 10.10.0.0 255.255.0.0 192.168.30.0 255.255.255.0
nat (inside) 0 access-list nonat
tunnel-group13.X.X.226 type ipsec-l2l
tunnel-group13.X.X.226 ipsec-attributes
 pre-shared-key passkey!
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto map outside_map 10 match address huntsville_remote
crypto map outside_map 10 set peer13.X.X.226
crypto map outside_map 10 set transform-set ESP-AES-256-SHA
crypto isakmp policy 10
 authentication pre-share
 encryption aes-256
 hash sha
 group 2
 lifetime 86400

cryp map outside_map interface outside
crypto isakmp enable outside
crypto isakmp nat-traversal



PIX config:
crypto map vpn_map 10 ipsec-isakmp      
crypto map vpn_map 10 match address bham_main  
crypto map vpn_map 10 set peer 66.X.X.130      
crypto map vpn_map 10 set transform-set bham_main                                                                                                              
crypto ipsec transform-set bham_main esp-aes-256 esp-sha-hmac                                                                                                  
isakmp key passkey! address 66.X.X.130 netmask 255.255.255.255   
isakmp policy 10 authentication pre-share      
isakmp policy 10 encryption aes-256       
isakmp policy 10 hash sha              
isakmp policy 10 group 2               
isakmp policy 10 lifetime 86400       
crypto map vpn_map interface outside                  
isakmp enable outside                  
isakmp nat-traversal 10            
nat (inside) 0 access-list nonat                                
access-list nonat permit ip 192.168.30.0 255.255.255.0 172.16.0.0 255.255.0.0 
access-list nonat permit ip 192.168.30.0 255.255.255.0 10.10.0.0 255.255.0.0                            
access-list bham_main permit ip 192.168.30.0 255.255.255.0 172.16.0.0 255.255.0.0 
access-list bham_main permit ip 192.168.30.0 255.255.255.0 10.10.0.0 255.255.0.0