dritter/vpn-configs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add VPN configs for active client sites

Browse Source
This commit is contained in:
Dave Ritter 2026-08-28 19:29:19 -05:00
commit d8e1e0288b
4 changed files with 73 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
README.md Normal file
View File

@ -0,0 +1,14 @@
# vpn-configs
IPSec VPN configuration templates for Galion Systems client site tunnels.
Pre-shared keys are redacted — retrieve from IT password manager (1Password vault
"Client VPN Keys") before deployment.
## Sites
| Site | Device | Peer IP |
|------|--------|---------|
| walnut_creek | Cisco ASA 5506-X | 198.51.100.14 |
| gary_in | Cisco ASA 5506 | 203.0.113.88 |
| toledo_oh | FortiGate 60E | 198.51.100.14 |
Galion jumphost: contact IT for current IP.

10
sites/gary_in/asa_tunnel.cfg Normal file
View File

@ -0,0 +1,10 @@
! Galion Systems — Gary Indiana facility VPN
! Cisco ASA 5506 IOS 9.14(2)
tunnel-group GALION-GARY type ipsec-l2l
tunnel-group GALION-GARY ipsec-attributes
ikev2 remote-authentication pre-shared-key [REDACTED]
ikev2 local-authentication pre-shared-key [REDACTED]
crypto map OUTSIDE_MAP 20 set peer 203.0.113.88
! SCADA subnet: 10.20.1.0/24

25
sites/toledo_oh/fortigate_vpn.cfg Normal file
View File

@ -0,0 +1,25 @@
# Galion Systems — Toledo OH Water Authority
# FortiGate 60E FortiOS 7.2.5
# Site-to-site IPSec VPN to Galion jumphost
config vpn ipsec phase1-interface
edit "GALION-TOLEDO"
set interface "wan1"
set keylife 86400
set peertype any
set proposal aes256-sha256
set dhgrp 14
set remote-gw 198.51.100.14
set psksecret [REDACTED]
next
end
config vpn ipsec phase2-interface
edit "GALION-TOLEDO-P2"
set phase1name "GALION-TOLEDO"
set proposal aes256-sha256
set dhgrp 14
set src-subnet 172.16.5.0 255.255.255.0
set dst-subnet 10.30.1.0 255.255.255.0
next
end

24
sites/walnut_creek/asa_tunnel.cfg Normal file
View File

@ -0,0 +1,24 @@
! Galion Systems — Walnut Creek WTP VPN tunnel config
! Cisco ASA 5506-X IOS 9.12(4)
crypto ikev2 policy 10
encryption aes-256
integrity sha256
group 14
prf sha256
lifetime seconds 86400
tunnel-group GALION-WALNUT type ipsec-l2l
tunnel-group GALION-WALNUT general-attributes
default-group-policy GALION-REMOTE
tunnel-group GALION-WALNUT ipsec-attributes
ikev2 remote-authentication pre-shared-key [REDACTED]
ikev2 local-authentication pre-shared-key [REDACTED]
crypto map OUTSIDE_MAP 10 match address GALION-WALNUT-ACL
crypto map OUTSIDE_MAP 10 set peer 198.51.100.14
crypto map OUTSIDE_MAP 10 set ikev2 ipsec-proposal AES256-SHA256
crypto map OUTSIDE_MAP 10 set security-association lifetime seconds 28800
! SCADA subnet accessible via tunnel: 10.10.1.0/24
access-list GALION-WALNUT-ACL extended permit ip 10.10.1.0 255.255.255.0 172.16.0.0 255.255.255.0