Merging VPN configurations

[prakkdangc]

I want to merge two old PIX501's configurations onto a single ASA5505. Each has an IPSEC VPN, so this is what I thought might work. Can someone please tell me if this looks correct? The peer is a VPN router which will hand off all traffic to our ePoP.

*******

access-list customer-1 extended permit ip 10.10.10.0 255.255.255.248 any

access-list customer-2 extended permit ip 20.20.20.0 255.255.255.248 any

!

crypto ipsec transform-set t-set esp-null esp-md5-hmac

crypto map cal-mic-edmz 10 match address customer-1

crypto map cal-mic-edmz 10 set peer 1.1.1.1

crypto map cal-mic-edmz 10 set transform-set t-set

crypto map cal-mic-edmz 20 match address customer-2

crypto map cal-mic-edmz 20 set peer 1.1.1.1

crypto map cal-mic-edmz 20 set transform-set t-set

crypto map cal-mic-edmz interface outside

crypto isakmp enable inside

crypto isakmp policy 10

authentication pre-share

encryption des

hash md5

group 1

lifetime 86400

crypto isakmp policy 20

authentication pre-share

encryption des

hash md5

group 1

lifetime 86400

!

tunnel-group 1.1.1.1 type ipsec-l2l

tunnel-group 1.1.1.1 ipsec-attributes

pre-shared-key *

Thanks,

Dave

[srue]

you've got two crypto map statements for setting the peer to 1.1.1.1. this won't work.

whatever you configure here, make sure you mirror on the other side also.

if you post your two 501 configs, we can probably help more.

also, make sure you really want the keyword 'any' in your crypto acl's.

offhand, w/o seeing your 501 configs, i think this *might* be what you want:

access-list customer-1 extended permit ip 10.10.10.0 255.255.255.248 any

access-list customer-1 extended permit ip 20.20.20.0 255.255.255.248 any

crypto ipsec transform-set t-set esp-null esp-md5-hmac

crypto map cal-mic-edmz 10 match address customer-1

crypto map cal-mic-edmz 10 set peer 1.1.1.1

crypto map cal-mic-edmz 10 set transform-set t-set

crypto isakmp enable inside

crypto map cal-mic-edmz interface outside

crypto isakmp policy 10

authentication pre-share

encryption des

hash md5

group 1

lifetime 86400

crypto isakmp policy 20

authentication pre-share

encryption des

hash md5

group 1

lifetime 86400

!

tunnel-group 1.1.1.1 type ipsec-l2l

tunnel-group 1.1.1.1 ipsec-attributes

pre-shared-key *

[prakkdangc]

Thanks for your help. Here are the two pix configs:

PIX 1 Configuration

access-list customer-1 permit ip 10.10.10.0 255.255.255.248 any

crypto ipsec transform-set null ah-sha-hmac esp-null esp-sha-hmac

crypto map vpn 20 ipsec-isakmp

crypto map vpn 20 match address customer-1

crypto map vpn 20 set peer 1.1.1.1

crypto map vpn 20 set transform-set null

crypto map vpn interface inside

isakmp enable outside

isakmp key ******** address 1.1.1.1 netmask 255.255.255.255

isakmp identity address

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption des

isakmp policy 20 hash md5

isakmp policy 20 group 2

isakmp policy 20 lifetime 14400

PIX 2 Configuration

access-list customer-2 permit ip 20.20.20.0 255.255.255.248 any

crypto ipsec transform-set null ah-sha-hmac esp-null esp-sha-hmac

crypto map vpn 20 ipsec-isakmp

crypto map vpn 20 match address customer-1

crypto map vpn 20 set peer 1.1.1.1

crypto map vpn 20 set transform-set null

crypto map vpn interface inside

isakmp enable outside

isakmp key ******** address 1.1.1.1 netmask 255.255.255.255

isakmp identity address

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption des

isakmp policy 20 hash md5

isakmp policy 20 group 2

isakmp policy 20 lifetime 14400