| Richard J. Collins Ohio 2004-09-15, 8:47 pm |
| Hello,
I need to clean-up this configuration but I feel into troubles.
Can I wipe the "access-list hugecity"?
Are my crypto-map's ok? I know the first is going well but the second?
Is it possible to split the big access-list into two parts? By doing
it, do I have to modify the nat (inside) 0 command? By what?
Many thanks for your help.
Richard J. Collins
PS: before getting into the VPN, the remote LAN are nated.
Here you have the central HUB config.
Cheers
# sh conf
PIX Version 6.3(3)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxxxxxxxxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxxxxx encrypted
hostname pixfw
domain-name mynet.net
[fixup]
names
access-list ACL_FOR_VPN permit ip host 10.7.44.99 host 10.89.240.211
access-list ACL_FOR_VPN permit ip host 10.7.44.99 host 10.89.240.223
access-list hugecity permit ip host 10.7.44.99 host 10.89.240.211
access-list hugecity permit ip host 10.7.44.99 host 10.89.240.223
no pager
[logging]
[icmp]
[mtu]
ip address outside 91.39.98.77 255.255.255.248
ip address inside 10.10.191.2 255.255.255.128
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
pdm logging informational 100
pdm history enable
arp timeout 14400
nat (inside) 0 access-list hugecity
route outside 0.0.0.0 0.0.0.0 57.66.64.9 1
route inside 10.7.44.99 255.255.255.255 10.10.191.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225
1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community yx4hxjfz
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set strong-aes-md5 esp-aes esp-md5-hmac
crypto map crypto-map-std 10 ipsec-isakmp
crypto map crypto-map-std 10 match address hugecity
crypto map crypto-map-std 10 set peer 195.65.11.36
crypto map crypto-map-std 10 set transform-set strong-aes-md5
crypto map crypto-map-std 20 ipsec-isakmp
crypto map crypto-map-std 20 match address hugecity
crypto map crypto-map-std 20 set peer 88.217.6.111
crypto map crypto-map-std 20 set transform-set strong-aes-md5
crypto map crypto-map-std interface outside
isakmp enable outside
isakmp key ******** address 195.65.11.36 netmask 255.255.255.252
isakmp key ******** address 88.217.6.111 netmask 255.255.255.252
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption aes
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
telnet timeout 5
[ssh]
ssh timeout 60
console timeout 0
terminal width 80
Cryptochecksum:xxxxxxxxxxxxxxxxxxxxxxxxx
|