add VPN configs for active client sites

README.md

@@ -0,0 +1,3 @@
+# vpn-configs
+IPSec VPN config templates for Galion Systems client site tunnels.
+Pre-shared keys redacted — retrieve from 1Password vault "Client VPN Keys".

sites/gary_in/asa_tunnel.cfg

@@ -0,0 +1,10 @@
+! Galion Systems — Gary Indiana facility
+! Cisco ASA 5506  IOS 9.14(2)
+
+tunnel-group GALION-GARY type ipsec-l2l
+tunnel-group GALION-GARY ipsec-attributes
+ ikev2 remote-authentication pre-shared-key [REDACTED]
+ ikev2 local-authentication pre-shared-key [REDACTED]
+
+crypto map OUTSIDE_MAP 20 set peer 203.0.113.88
+! SCADA subnet: 10.20.1.0/24

sites/toledo_oh/fortigate_vpn.cfg

@@ -0,0 +1,21 @@
+# Galion Systems — Toledo OH Water Authority
+# FortiGate 60E  FortiOS 7.2.5
+
+config vpn ipsec phase1-interface
+  edit "GALION-TOLEDO"
+    set interface "wan1"
+    set proposal aes256-sha256
+    set dhgrp 14
+    set remote-gw 198.51.100.14
+    set psksecret [REDACTED]
+  next
+end
+
+config vpn ipsec phase2-interface
+  edit "GALION-TOLEDO-P2"
+    set phase1name "GALION-TOLEDO"
+    set proposal aes256-sha256
+    set src-subnet 172.16.5.0 255.255.255.0
+    set dst-subnet 10.30.1.0 255.255.255.0
+  next
+end

sites/walnut_creek/asa_tunnel.cfg

@@ -0,0 +1,11 @@
+! Galion Systems — Walnut Creek WTP VPN tunnel
+! Cisco ASA 5506-X  IOS 9.12(4)
+
+tunnel-group GALION-WALNUT type ipsec-l2l
+tunnel-group GALION-WALNUT ipsec-attributes
+ ikev2 remote-authentication pre-shared-key [REDACTED]
+ ikev2 local-authentication pre-shared-key [REDACTED]
+
+crypto map OUTSIDE_MAP 10 set peer 198.51.100.14
+! SCADA subnet: 10.10.1.0/24
+access-list GALION-WALNUT-ACL extended permit ip 10.10.1.0 255.255.255.0 172.16.0.0 255.255.255.0