Page History

...

1. Create Server Object to Translate (Layer 4 Translation)

   Code Block

   object-group service SERVER_Services tcp port-object eq 3389 port-object range 6100 6199 port-object eq ident object network SERVER-3389 host 172.32.100.5 nat (realinside,mappedoutside) static interface service tcp ident3389 ident3389 object nat (real,mapped) static interface service tcp 3389 3389network SERVER-ident host 172.32.100.5 nat (realinside,mappedoutside) static interface service tcp ident 6103ident 6103

2. Create Access List to allow Services to server (Layer 3 Translation)

   Code Block
   access-list outside_access_in extended permit tcp any host SERVER object-group SERVER_Services

...

1. Define the Networks 

   Code Block
   theme RDark
   object-group network Remote_VPN network-object 10.10.10.0 255.255.255.0 network-object 10.20.20.0 255.255.255.0 object-group network Remote_Internal network-object 172.16.1.0 255.255.255.0 network-object 172.16.2.0 255.255.255.0 network-object 172.16.3.0 255.255.255.0 network-object 172.16.4.0 255.255.255.0 network-object 172.18.0.0 255.255.0.0 object-group network Remote_Combined group-object Remote_VPN group-object Remote_Internal

2. Create the Crypto Map ACL

   Code Block
   theme RDark
   access-list outside_cryptomap_1 extended permit ip INTERNAL_NETWORK 255.255.255.0 object-group Remote_Combined

3. Create the No-Nat ACL (Networks/hosts to which the packets should not be changed)

   Code Block
   theme RDark
   access-list VPNNONAT extended permit ip INTERNAL_NETWORK 255.255.255.0 object-group Remote_Combined

4. Apply the No-NAT

   Code Block
   theme RDark
   nat (inside) 0 access-list VPNNONAT

5. Create a Transform set

   Code Block
   theme RDark
   crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

6. Create the Crypto Map

   Code Block
   theme RDark
   crypto map MELONGCryptoMaps 1 match address outside_cryptomap_1 crypto map MELONGCryptoMaps 1 set peer 1.1.1.1 crypto map MELONGCryptoMaps 1 set transform-set ESP-AES-256-SHA crypto map MELONGCryptoMaps interface outside

7. Enable isakmp on interface

   Code Block
   theme RDark
   crypto isakmp enable outside

8. Create isakmp policies (Note, the policy number is for priority. The highest number first, and then tries lower policies after)

   Code Block
   theme RDark
   crypto isakmp policy 50 authentication pre-share encryption aes-256 hash sha group 2 lifetime 86400

9. Create policy for Tunnel-Group (Site-Site hosts)

   Code Block
   group-policy Site2Site internal group-policy Site2Site attributes vpn-tunnel-protocol IPSec l2tp-ipsec

10. Apply Tunnel-Group and Attributes

    Code Block
    tunnel-group 1.1.1.1 type ipsec-l2l tunnel-group 1.1.1.1 general-attributes default-group-policy Site2Site tunnel-group 1.1.1.1 ipsec-attributes pre-shared-key PASSWORD

...