I hope I did not remove to much, but basicly it should look like that.
- a.b.c = Remote VoIP network on the other Tunnel site with the VoIP Gateway, DNS, DHCP...
- x.y.z = Local VoIP Network
- Everything that starts with a.b... means remote site.
- In this config I used VLAN but just remote it and use physical interfaces..
interface ethernet0 auto
interface ethernet1 auto
interface ethernet1 vlan129 logical
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif vlan129 voip security80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
access-list acs-outside permit udp host REMOTEPIX host THISPIX eq isakmp
access-list acs-outside permit esp host REMOTEPIX host THISPIX
access-list acs-outside permit ah host REMOTEPIX host THISPIX
access-list NONAT permit ip x.y.z.0 255.255.0.0 a.0.0.0 255.0.0.0
access-list VPN permit ip x.y.z.0 255.255.0.0 a.0.0.0 255.0.0.0
ip address outside THISPIX 255.255.255.0
ip address inside 192.168.1.0 255.255.255.0
ip address voip x.y.z.1 255.255.0.0
global (outside) 1 interface
nat (inside) 0 access-list NONAT
nat (voip) 0 access-list NONAT
access-group acs-outside in interface outside
route outside 0.0.0.0 0.0.0.0 DEFAULT-GATEWAY 1
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
crypto ipsec transform-set TRANS esp-3des esp-md5-hmac
crypto map REMOTE 10 ipsec-isakmp
crypto map REMOTE 10 match address VPN
crypto map REMOTE 10 set peer REMOTEPIX
crypto map REMOTE 10 set transform-set TRANS
crypto map REMOTE interface outside
isakmp enable outside
isakmp key *********** address REMOTEPIX netmask 255.255.255.255
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400
dhcpd address x.y.z.11-x.y.z.99 voip
dhcpd dns a.d.d.26
dhcpd wins v.y.a.7
dhcpd lease 3000
dhcpd ping_timeout 750
dhcpd domain yourdomain.net
dhcpd option 150 ip a.b.c.11 a.b.c.10
dhcpd option 66 ascii a.b.c.11
dhcpd enable voip
sincerly
Patrick
