Pix Station to site IPSECVPN configuration

Prerequisite: The data can be communicated normally before the channel is encrypted.

STEP1: Allow IPSec data flow to come in from the PIX outer port

Pix (config) #access-list out_in permit any host 222.254.240.193

Pix (config) #access-list out_in permit) any host 222.254.240.193

Pix (config) #access-list out_in permit udp any host 222.254.240.193 EQ 500

Sysopt connection permit-ipsec in a more abbreviated way, with just one

STEP2: Outer opening ISAKMP

Pix1 (config) #isakmp enable outside

Pix2 (config) #isakmp enable outside

STEP3: Configuring IKE Policy parameters

ISAKMP Policy Encryption 3DES

ISAKMP Policy Hash MD5

ISAKMP Policy Group 2

ISAKMP Policy Lifetime 2400

ISAKMP Policy Autentication Pre-share

(ISAKMP policy autentication Rsa-sig) enable RSA Digital signature Authentication (default)

Pix#show ISAKMP Policy View Policy

STEP4: Define preshared key

pix1 (config) #isakmp key MyKey address 202.103.96.112 netmask 255.255.255.255

pix2 (config) #isakmp key MyKey address 222.254.240.193 netmask 255.255.255.255

Pix (config) #isakmp key PubKey address 0.0.0.0 netmask 0.0.0.0 (all channel peer share the same key)

STEP5: Defining encrypted Data Flow ACLs

pix1 (config) #

Access-list crypto_date Permit 192.168.1.1 255.255.255.0 192.168.2.0

pix2 (config) #

Access-list crypto_date Permit 192.168.2.0 255.255.255.0 192.168.1.0

STEP6: Define the conversion set transform set both sides of the same configuration

pix1 (config) # crypto IPSec Transform-set MySet esp-des Esp-sha-hmac

pix2 (config) # crypto IPSec Transform-set MySet esp-des Esp-sha-hmac

pix1 (config) # show crypto IPSec Transform-set

The problem of Step7:nat

pix1 (config) # nat 0 Access-list Cryto_date

pix2 (config) # nat 0 Access-list Cryto_date

STEP8: Configure encryption diagram to connect Policy+transform-set+peer address

pix1 (config) # crypto map Pix1map IPSEC-ISAKMP

pix1 (config) # Crypto map Pix1map match address Crypto_date

pix1 (config) # Crypto map Pix1map set peer 202.103.96.112

pix1 (config) # crypto map Pix1map set Transform-set MySet

pix2 (config) # crypto map Pix2map IPSEC-ISAKMP

pix2 (config) # Crypto map Pix1map match address Crypto_date

pix2 (config) # Crypto map Pix1map set peer 222.240.254.193

pix2 (config) # crypto map Pix1map set Transform-set MySet

Step 9: Binding encryption diagram to interface

pix1 (config) # Crypto map Pix1map interface outside

pix2 (config) # Crypto map Pix2map interface outside

Pix1#show Crypto Map

Pix1#show Crypto IPSec SA