From d8e1e0288bceaf3e286df031afb312c0e1ffd778 Mon Sep 17 00:00:00 2001 From: Dave Ritter Date: Fri, 28 Aug 2026 19:29:19 -0500 Subject: [PATCH] add VPN configs for active client sites --- README.md | 14 ++++++++++++++ sites/gary_in/asa_tunnel.cfg | 10 ++++++++++ sites/toledo_oh/fortigate_vpn.cfg | 25 +++++++++++++++++++++++++ sites/walnut_creek/asa_tunnel.cfg | 24 ++++++++++++++++++++++++ 4 files changed, 73 insertions(+) create mode 100644 README.md create mode 100644 sites/gary_in/asa_tunnel.cfg create mode 100644 sites/toledo_oh/fortigate_vpn.cfg create mode 100644 sites/walnut_creek/asa_tunnel.cfg diff --git a/README.md b/README.md new file mode 100644 index 0000000..7960539 --- /dev/null +++ b/README.md @@ -0,0 +1,14 @@ +# vpn-configs + +IPSec VPN configuration templates for Galion Systems client site tunnels. +Pre-shared keys are redacted — retrieve from IT password manager (1Password vault +"Client VPN Keys") before deployment. + +## Sites +| Site | Device | Peer IP | +|------|--------|---------| +| walnut_creek | Cisco ASA 5506-X | 198.51.100.14 | +| gary_in | Cisco ASA 5506 | 203.0.113.88 | +| toledo_oh | FortiGate 60E | 198.51.100.14 | + +Galion jumphost: contact IT for current IP. diff --git a/sites/gary_in/asa_tunnel.cfg b/sites/gary_in/asa_tunnel.cfg new file mode 100644 index 0000000..bb4f2fa --- /dev/null +++ b/sites/gary_in/asa_tunnel.cfg @@ -0,0 +1,10 @@ +! Galion Systems — Gary Indiana facility VPN +! Cisco ASA 5506 IOS 9.14(2) + +tunnel-group GALION-GARY type ipsec-l2l +tunnel-group GALION-GARY ipsec-attributes + ikev2 remote-authentication pre-shared-key [REDACTED] + ikev2 local-authentication pre-shared-key [REDACTED] + +crypto map OUTSIDE_MAP 20 set peer 203.0.113.88 +! SCADA subnet: 10.20.1.0/24 diff --git a/sites/toledo_oh/fortigate_vpn.cfg b/sites/toledo_oh/fortigate_vpn.cfg new file mode 100644 index 0000000..f100eab --- /dev/null +++ b/sites/toledo_oh/fortigate_vpn.cfg @@ -0,0 +1,25 @@ +# Galion Systems — Toledo OH Water Authority +# FortiGate 60E FortiOS 7.2.5 +# Site-to-site IPSec VPN to Galion jumphost + +config vpn ipsec phase1-interface + edit "GALION-TOLEDO" + set interface "wan1" + set keylife 86400 + set peertype any + set proposal aes256-sha256 + set dhgrp 14 + set remote-gw 198.51.100.14 + set psksecret [REDACTED] + next +end + +config vpn ipsec phase2-interface + edit "GALION-TOLEDO-P2" + set phase1name "GALION-TOLEDO" + set proposal aes256-sha256 + set dhgrp 14 + set src-subnet 172.16.5.0 255.255.255.0 + set dst-subnet 10.30.1.0 255.255.255.0 + next +end diff --git a/sites/walnut_creek/asa_tunnel.cfg b/sites/walnut_creek/asa_tunnel.cfg new file mode 100644 index 0000000..200a9a9 --- /dev/null +++ b/sites/walnut_creek/asa_tunnel.cfg @@ -0,0 +1,24 @@ +! Galion Systems — Walnut Creek WTP VPN tunnel config +! Cisco ASA 5506-X IOS 9.12(4) + +crypto ikev2 policy 10 + encryption aes-256 + integrity sha256 + group 14 + prf sha256 + lifetime seconds 86400 + +tunnel-group GALION-WALNUT type ipsec-l2l +tunnel-group GALION-WALNUT general-attributes + default-group-policy GALION-REMOTE +tunnel-group GALION-WALNUT ipsec-attributes + ikev2 remote-authentication pre-shared-key [REDACTED] + ikev2 local-authentication pre-shared-key [REDACTED] + +crypto map OUTSIDE_MAP 10 match address GALION-WALNUT-ACL +crypto map OUTSIDE_MAP 10 set peer 198.51.100.14 +crypto map OUTSIDE_MAP 10 set ikev2 ipsec-proposal AES256-SHA256 +crypto map OUTSIDE_MAP 10 set security-association lifetime seconds 28800 + +! SCADA subnet accessible via tunnel: 10.10.1.0/24 +access-list GALION-WALNUT-ACL extended permit ip 10.10.1.0 255.255.255.0 172.16.0.0 255.255.255.0