I am trying to setup Dynamic VPN site-to-site tunnels to our ASA with a static ip using the correct method from Cisco. We have been doing it for a few years but apparently its not the recommended way. We have been advised to use the DefaultL2LGroup method.
We have the standard template, but I cannot see how this will work without the access-lists we previously used.
.
---------
Template
---------
crypto ipsec transform-set myset esp-des esp-md5-hmac
!
crypto dynamic-map mymap 1 set transform-set myset
crypto dynamic-map mymap 1 set reverse-route
crypto map dyn-map 10 IPSec-isakmp dynamic mymap
crypto map dyn-map interface outside
!
crypto isakmp policy 10
authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
!
tunnel-group DefaultL2LGroup IPSec-attributes
pre-shared-key *
.
---------
Previous config for access list
---------
crypto dynamic-map Site1 72 match address WAN_cryptomap_59
access-list WAN_cryptomap_59 extended permit ip object HQ object Site1
