Completed PIX Configurations 201
Completed PIX Configurations
It is a good idea to use a common naming convention when creating access lists, transforms, and crypto maps to reduce confusion. Example 10-13 shows the completed configuration for the Los Angeles headquarters.
Example 10-13 Completed Configuration for Los Angeles
1.: Saved
2.:
3.PIX Version 6.2(2)
4.nameif ethernet0 outside security0
5.nameif ethernet1 inside security100
6.nameif ethernet2 DMZ security70
7.enable password HtmvK15kjhtlyfvcl encrypted
8.passwd Kkjhlkf1568Hke encrypted
9.hostname LosAngeles
10.domain-name www.Chapter10.com
11.fixup protocol ftp 21
12.fixup protocol http 80
13.fixup protocol h323 1720
14.fixup protocol rsh 514
15.fixup protocol smtp 25
16.fixup protocol sqlnet 1521
17.fixup protocol sip 5060
18.fixup protocol skinny 2000
19.names
20.access-list inbound permit icmp any host 192.168.1.10
21.access-list inbound permit tcp any host 192.168.1.10 eq www
22.access-list inbound permit tcp any host 192.168.1.10 eq 443
23.access-list inbound permit tcp any host 192.168.1.11 eq www
24.access-list inbound permit tcp any host 192.168.1.11 eq 443
25.access-list inbound permit tcp any host 192.168.1.12 eq www
26.access-list inbound permit tcp any host 192.168.1.12 eq 443
27.access-list inbound permit tcp any host 192.168.1.13 eq ftp
28.access-list inbound permit tcp any host 192.168.1.10 eq 443
29.access-list DMZ permit udp 172.16.1.0 255.255.255.0 host 10.10.10.240 eq ntp
30.access-list VPN permit ip 10.10.10.0 255.255.255.0 10.10.2.0 255.255.255.0
31.access-list VPN permit ip 10.10.10.0 255.255.255.0 10.10.3.0 255.255.255.0
32.access-list Boston permit ip 10.10.10.0 255.255.255.0 10.10.2.0 255.255.255.0
33.access-list Atlanta permit ip 10.10.10.0 255.255.255.0 10.10.3.0 255.255.255.0
34.pager lines 24
35.logging on
36.logging timestamp
37.interface ethernet0 auto
38.interface ethernet1 auto
39.interface ethernet2 auto
40.mtu outside 1500
41.mtu inside 1500
42.ip address outside 192.168.1.1 255.255.255.0
43.ip address inside 10.10.10.1 255.255.255.0
44.ip address DMZ 172.16.1.1 255.255.255.0
continues
202 Chapter 10: Virtual Private Networks
Example 10-13 Completed Configuration for Los Angeles (Continued)
45.failover
46.failover timeout 0:00:00
47.failover poll 15
48.failover ip address outside 192.168.1.2
49.failover ip address inside 10.10.10.2
50.failover ip address DMZ 172.16.1.2
51.arp timeout 14400
52.global (outside) 1 192.168.1.20-250
53.nat (inside) 1 0.0.0.0 0.0.0.0 0 0
54.nat (inside) 0 access-list VPN
55.static (DMZ,outside) 192.168.1.10 172.16.1.10 netmask 255.255.255.255 0 0
56.static (DMZ,outside) 192.168.1.11 172.16.1.11 netmask 255.255.255.255 0 0
57.static (DMZ,outside) 192.168.1.12 172.16.1.12 netmask 255.255.255.255 0 0
58.static (DMZ,outside) 192.168.1.13 172.16.1.13 netmask 255.255.255.255 0 0
59.access-group inbound in interface outside
60.access-group DMZ out interface DMZ
61.route outside 0.0.0.0 0.0.0.0 192.168.1.254 1
62.timeout xlate 3:00:00
63.timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
64.timeout uauth 0:05:00 absolute
65.aaa-server TACACS+ protocol tacacs+
66.aaa-server RADIUS protocol radius
67.no snmp-server location
68.no snmp-server contact
69.snmp-server community public
70.no snmp-server enable traps
71.floodguard enable
72.sysopt connection permit-ipsec
73.no sysopt route dnat
74.crypto ipsec transform-set Chapter10 esp-3des esp-md5-hmac
75.crypto ipsec transform-set NothingNew esp-3des esp-sha-hmac
76.crypto map Chapter10 10 ipsec-isakmp
77.crypto map Chapter10 10 match address Boston
78.crypto map Chapter10 10 set peer 192.168.2.1
79.crypto map Chapter10 10 set transform-set Chapter10
80.crypto map Chapter10 20 ipsec-isakmp
81.crypto map Chapter10 20 match address Atlanta
82.crypto map Chapter10 20 set peer 192.168.3.1
83.crypto map Chapter10 20 set transform-set Chapter10
84.crypto map Chapter10 interface outside
85.isakmp enable outside
86.isakmp key ******** address 192.168.2.1 netmask 255.255.255.255
87.isakmp key ******** address 192.168.3.1 netmask 255.255.255.255
88.isakmp identity address
89.isakmp policy 20 authentication pre-share
90.isakmp policy 20 encryption 3des
91.isakmp policy 20 hash md5
92.isakmp policy 20 group 2
93.isakmp policy 20 lifetime 86400
94.terminal width 80
95.Cryptochecksum:e0clmj3546549637cbsFds54132d5
Completed PIX Configurations 203
Example 10-14 shows the completed configuration for the Boston branch office.
Example 10-14 Completed Configuration for Boston
1.: Saved
2.:
3.PIX Version 6.2(2)
4.nameif ethernet0 outside security0
5.nameif ethernet1 inside security100
6.nameif ethernet2 DMZ security70
7.enable password ksjfglkasglc encrypted
8.passwd kjngczftglkacytiur encrypted
9.hostname Boston
10.domain-name www.Chapter10.com
11.fixup protocol ftp 21
12.fixup protocol http 80
13.fixup protocol smtp 25
14.fixup protocol skinny 2000
15.names
16.access-list inbound permit icmp any host 192.168.2.10
17.access-list inbound permit tcp any host 192.168.2.10 eq www
18.access-list inbound permit tcp any host 192.168.2.10 eq 443
19.access-list DMZ permit udp 172.16.2.0 255.255.255.0 host 10.10.2.240 eq ntp
20.access-list VPN permit ip 10.10.2.0 255.255.255.0 10.10.10.0 255.255.255.0
21.access-list VPN permit ip 10.10.2.0 255.255.255.0 10.10.3.0 255.255.255.0
22.access-list LosAngeles permit ip 10.10.2.0 255.255.255.0 10.10.10.0 255.255.255.0
23.access-list Atlanta permit ip 10.10.2.0 255.255.255.0 10.10.3.0 255.255.255.0
24.pager lines 24
25.logging on
26.logging timestamp
27.interface ethernet0 auto
28.interface ethernet1 auto
29.interface ethernet2 auto
30.mtu outside 1500
31.mtu inside 1500
32 ip address outside 192.168.2.1 255.255.255.0
33.ip address inside 10.10.2.1 255.255.255.0
34.ip address DMZ 172.16.2.1 255.255.255.0
35.arp timeout 14400
36.global (outside) 1 192.168.2.20-200
37.nat (inside) 1 0.0.0.0 0.0.0.0 0 0
38.nat (inside) 0 access-list VPN
39.static (DMZ,outside) 192.168.2.10 172.16.2.10 netmask 255.255.255.255 0 0
40.access-group inbound in interface outside
41.access-group DMZ in interface DMZ
42.route outside 0.0.0.0 0.0.0.0 192.168.2.254 1
43.timeout xlate 3:00:00
44.timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00
45.timeout uauth 0:05:00 absolute
46.aaa-server TACACS+ protocol tacacs+
47.aaa-server RADIUS protocol radius
48.no snmp-server location
49.no snmp-server contact
50.snmp-server community public
continues
204 Chapter 10: Virtual Private Networks
Example 10-14 Completed Configuration for Boston (Continued)
51.no snmp-server enable traps
52.floodguard enable
53.sysopt connection permit-ipsec
54.crypto ipsec transform-set Chapter10 esp-3des esp-md5-hmac
55.crypto ipsec transform-set NothingNew esp-3des esp-sha-hmac
56.crypto map Chapter10 10 ipsec-isakmp
57.crypto map Chapter10 10 match address LosAngeles
58.crypto map Chapter10 10 set peer 192.168.1.1
59.crypto map Chapter10 10 set transform-set Chapter10
60.crypto map Chapter10 20 ipsec-isakmp
61.crypto map Chapter10 20 match address Atlanta
62.crypto map Chapter10 20 set peer 192.168.3.1
63.crypto map Chapter10 20 set transform-set Chapter10
64.crypto map Chapter10 interface outside
65.isakmp enable outside
66.isakmp key ******** address 192.168.1.1 netmask 255.255.255.255
67.isakmp key ******** address 192.168.3.1 netmask 255.255.255.255
68.isakmp identity address
69.isakmp policy 20 authentication pre-share
70.isakmp policy 20 encryption 3des
71.isakmp policy 20 hash md5
72.isakmp policy 20 group 2
73.isakmp policy 20 lifetime 86400
74.terminal width 80
75.Cryptochecksum:e0c04954fcabd239ae291d58fc618dd5
Example 10-15 shows the completed configuration for the Atlanta branch office.
Example 10-15 Completed Configuration for Atlanta
1.: Saved
2.:
3.PIX Version 6.2(2)
4.nameif ethernet0 outside security0
5.nameif ethernet1 inside security100
6.nameif ethernet2 DMZ security70
7.enable password ksjfglkasglc encrypted
8.passwd kjngczftglkacytiur encrypted
9.hostname Atlanta
10.domain-name www.Chapter10.com
11.fixup protocol ftp 21
12.fixup protocol http 80
13.fixup protocol smtp 25
14.fixup protocol skinny 2000
15.names
16.access-list inbound permit icmp any host 192.168.3.10
17.access-list inbound permit tcp any host 192.168.3.10 eq www
18.access-list inbound permit tcp any host 192.168.3.10 eq 443
19.access-list DMZ permit udp 172.16.3.0 255.255.255.0 host 10.10.3.240 eq ntp
20.access-list VPN permit ip 10.10.3.0 255.255.255.0 10.10.2.0 255.255.255.0
21.access-list VPN permit ip 10.10.3.0 255.255.255.0 10.10.10.0 255.255.255.0
22.access-list LosAngeles permit ip 10.10.3.0 255.255.255.0 10.10.10.0 255.255.255.0
Completed PIX Configurations 205
Example 10-15 Completed Configuration for Atlanta (Continued)
23.access-list Boston permit ip 10.10.3.0 255.255.255.0 10.10.2.0 255.255.255.0
24.pager lines 24
25.logging on
26.logging timestamp
27.interface ethernet0 auto
28.interface ethernet1 auto
29.interface ethernet2 auto
30.mtu outside 1500
31.mtu inside 1500
32.ip address outside 192.168.3.1 255.255.255.0
33.ip address inside 10.10.3.1 255.255.255.0
34.ip address DMZ 172.16.3.1 255.255.255.0
35.arp timeout 14400
36.global (outside) 1 192.168.3.20-200
37.nat (inside) 1 0.0.0.0 0.0.0.0 0 0
38.nat (inside) 0 access-list VPN
39.static (DMZ,outside) 192.168.3.10 172.16.3.10 netmask 255.255.255.255 0 0
40.access-group inbound in interface outside
41.access-group DMZ in interface DMZ
42.route outside 0.0.0.0 0.0.0.0 192.168.3.254 1
43.timeout xlate 3:00:00
44.timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00
45.timeout uauth 0:05:00 absolute
46.aaa-server TACACS+ protocol tacacs+
47.aaa-server RADIUS protocol radius
48.no snmp-server location
49.no snmp-server contact
50.snmp-server community public
51.no snmp-server enable traps
52.floodguard enable
53.sysopt connection permit-ipsec
54.crypto ipsec transform-set Chapter10 esp-3des esp-md5-hmac
55.crypto ipsec transform-set NothingNew esp-3des esp-sha-hmac
56.crypto map Chapter10 10 ipsec-isakmp
57.crypto map Chapter10 10 match address LosAngeles
58.crypto map Chapter10 10 set peer 192.168.1.1
59.crypto map Chapter10 10 set transform-set Chapter10
60.crypto map Chapter10 20 ipsec-isakmp
61.crypto map Chapter10 20 match address Boston
62.crypto map Chapter10 20 set peer 192.168.2.1
63.crypto map Chapter10 20 set transform-set Chapter10
64.crypto map Chapter10 interface outside
65.isakmp enable outside
66.isakmp key ******** address 192.168.1.1 netmask 255.255.255.255
67.isakmp key ******** address 192.168.2.1 netmask 255.255.255.255
68.isakmp identity address
69.isakmp policy 20 authentication pre-share
70.isakmp policy 20 encryption 3des
71.isakmp policy 20 hash md5
72.isakmp policy 20 group 2
73.isakmp policy 20 lifetime 86400
74.terminal width 80
75.Cryptochecksum:e0c04954fcabd239ae291d58fc618dd5
206 Chapter 10: Virtual Private Networks
How the Configuration Lines Interact
Figure 10-7 shows the completed configuration for Los Angeles, with a brief explanation for each entry. Note that each entry is connected to one or more other entries on the right. This diagram depicts how the lines of the configuration are dependent on each other. Keep this in mind when trying to troubleshoot a VPN configuration. It might help you to find which line is missing or incorrectly configured.
|
|
|
How the Configuration Lines Interact |
207 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Figure 10-7 LA Configuration with Comments |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
: Saved |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
: |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
PIX Version 6.2(2) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
nameif ethernet0 outside security0 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
nameif ethernet1 inside security100 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
nameif ethernet2 DMZ security70 |
|
Configuration of Los Angeles Firewall |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||||||||||||
enable password HtmvK15kjhtlyfvcl encrypted |
|
|
|
|
|
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
|
|
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
passwd Kkjhlkf1568Hke encrypted |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
hostname LosAngeles |
*Each of the lines required for the VPN are in bold print. |
|
|
|
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
domain-name www.Chapter10.com |
|
|
|
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
*There is a correcponding box that explains each line of the configuration. |
|
|
|
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
fixup protocol ftp 21 |
|
|
|
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
fixup protocol http 80 |
*Note the lines on the right side of the page that show how the different portions of |
|
|
|
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
fixup protocol smtp 25 |
|
|
|
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
fixup protocol skinny 2000 |
|
the configuration relate to each other. |
|
|
|
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
names |
|
|
|
|
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
access-list inbound permit icmp any host 192.168.1.10 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
access-list inbound permit tcp any host 192.168.1.10 |
eq www |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
access-list inbound permit tcp any host 192.168.1.10 eq 443 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
access-list inbound permit tcp any host 192.168.1.11 |
eq www |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
access-list inbound permit tcp any host 192.168.1.11 eq 443 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
access-list inbound permit tcp any host 192.168.1.12 |
eq www |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
access-list inbound permit tcp any host 192.168.1.12 eq 443 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
access-list inbound permit tcp any host 192.168.1.13 |
eq ftp |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
access-list inbound permit tcp any host 192.168.1.10 eq 443 |
Access list is referenced to NAT 0 rule so addresses are not translated for |
|
|
|
|
|
|
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
access-list DMZ permit udp 172.16.1.0 255.255.255.0 host 10.10.10.240 eq ntp |
communication between VPN peers |
|
|
|
|
|
|
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
access-list VPN permit ip 10.10.10.0 255.255.255.0 10.10.2.0 255.255.255.0 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
access-list VPN permit ip 10.10.10.0 255.255.255.0 10.10.3.0 255.255.255.0 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
access-list Boston permit ip 10.10.10.0 255.255.255.0 10.10.2.0 255.255.255.0 |
Access list to force encryption between LosAngeles and the other locations |
|
|
|
|
|
|
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
access-list Atlanta permit ip 10.10.10.0 255.255.255.0 10.10.3.0 255.255.255.0 |
|
|
|
|
|
|
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
pager lines 24 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
logging on |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
logging timestamp |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
interface ethernet0 auto |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
interface ethernet1 auto |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
interface ethernet2 auto |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
mtu outside 1500 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
mtu inside 1500 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
ip address outside 192.168.1.1 255.255.255.0 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
ip address inside 10.10.10.1 255.255.255.0 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
ip address DMZ 172.16.1.1 255.255.255.0 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
failover |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
failover timeout 0:00:00 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
failover poll 15 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
failover ip address outside 192.168.1.2 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
failover ip address inside 10.10.10.2 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
failover ip address DMZ 172.16.1.2 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
arp timeout 14400 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
global (outside) 1 192.168.1.20-250 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
nat (inside) 1 0.0.0.0 0.0.0.0 0 0 |
|
|
The VPN access-list is referenced by the NAT0 command |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||||||||||||||||
nat (inside) 0 access-list VPN |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
static (DMZ,outside) 192.168.1.10 172.16.1.10 netmask 255.255.255.255 0 0 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
static (DMZ,outside) 192.168.1.11 172.16.1.11 netmask 255.255.255.255 0 0 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
static (DMZ,outside) 192.168.1.12 172.16.1.12 netmask 255.255.255.255 0 0 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
static (DMZ,outside) 192.168.1.13 172.16.1.13 netmask 255.255.255.255 0 0 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
access-group inbound in interface outside |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
access-group DMZ in interface DMZ |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
route outside 0.0.0.0 0.0.0.0 192.168.1.254 1 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
timeout xlate 3:00:00 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
timeout uauth 0:05:00 absolute |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
aaa-server TACACS+ protocol tacacs+ |
|
|
Encrypted traffic is allowed to bypass the access-lists |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||||||||
aaa-server RADIUS protocol radius |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||||||||||||
no snmp-server location |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
no snmp-server contact |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
snmp-server community public |
|
|
Transforms are defined for both VPN connections |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||||||
no snmp-server enable traps |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
floodguard enable |
|
|
The crypto-map for Boston (sequence number 10) will utilize IPSEC and negotiate the SA using IKE |
|
|
|
|
|
|
|
|
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
sysopt connection permit-ipsec |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
crypto ipsec transform-set Chapter10 esp-3des esp-md5-hmac |
The Crypto-map designates the access-list ’Boston" as the address match for this connection |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
crypto ipsec transform-set NothingNew esp-3des esp-md5-hmac |
The VPN peer in Boston is 192.168.2.1 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
crypto map Chapter10 10 ipsec-isakmp |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
crypto map Chapter10 10 match address Boston |
|
|
Ths IPSEC transform is named Chapter10 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||
crypto map Chapter10 10 set peer 192.168.2.1 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
crypto map Chapter10 10 set transform-set Chapter10 |
The crypto-map for Atlanta (sequence number 20) will utilize IPSEC and negotiate the SA using IKE |
|
|
|
|
|
|
|
|
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
crypto map Chapter10 20 ipsec-isakmp |
|
|
The Crypto-map designates the access-list Atlanta" as the address match for this connection |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||
crypto map Chapter10 20 match address Atlanta |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||
crypto map Chapter10 20 set peer 192.168.3.1 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
crypto map Chapter10 20 set transform-set Chapter10 |
The VPN peer in Atlanta is 192.168.3.1 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
crypto map Chapter10 interface outside |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
isakmp enable outside |
|
|
Ths IPSEC transform is named Chapter10 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
isakmp key ******** address 192.168.2.1 netmask 255.255.255.255 |
The encryption will be completed at the outside interface |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||||||||||||||
isakmp key ******** address 192.168.3.1 netmask 255.255.255.255 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||||||||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
isakmp identity address |
|
|
IKE is enabled on the outside interface |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
isakmp policy 20 authentication pre-share |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
isakmp policy 20 encryption 3des |
|
|
Preshared Keys are listed for each SA peer |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||
isakmp policy 20 hash md5 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
isakmp policy 20 group 2 |
|
|
IKE will identify SA peers by address |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||
isakmp policy 20 lifetime 86400 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
terminal width 80 |
|
|
IKE will authenticate SA peers using pre-shared keys |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||||||||||
Cryptochecksum:e0clmj3546549637cbsFds54132d5 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
IKE will negotiate the message encryption algorithm of 3DES |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||||||||||||||||||
|
|
|
IKE will negotiate the message integrity algorithm of MD5 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||||||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
|
|
|
IKE will use Diffie-hellman group 2 (1024 bit) for the Key Exchange |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||||||||||||||||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||
|
|
|
The lifetime of the SA is 86,400 seconds (24 hours) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
||||||||||
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
This chapter covers the following exam topics for the Secure PIX Firewall Advanced Exam (CSPFA 9E0-111):
47.PDM overview
48.PDM operating requirements
49.Prepare for PDM
50.Using PDM to configure the PIX Firewall
51.Using PDM to create a site-to-site VPN
52.Using PDM to create a remote access VPN