From efc37fd5b3479ef6e74878f74498ad4cb5f26cd4 Mon Sep 17 00:00:00 2001 From: Dave Ritter Date: Tue, 14 Oct 2025 10:05:30 -0500 Subject: [PATCH] add VPN configs for active client sites --- README.md | 3 +++ sites/gary_in/asa_tunnel.cfg | 10 ++++++++++ sites/toledo_oh/fortigate_vpn.cfg | 21 +++++++++++++++++++++ sites/walnut_creek/asa_tunnel.cfg | 11 +++++++++++ 4 files changed, 45 insertions(+) create mode 100644 README.md create mode 100644 sites/gary_in/asa_tunnel.cfg create mode 100644 sites/toledo_oh/fortigate_vpn.cfg create mode 100644 sites/walnut_creek/asa_tunnel.cfg diff --git a/README.md b/README.md new file mode 100644 index 0000000..108ff47 --- /dev/null +++ b/README.md @@ -0,0 +1,3 @@ +# vpn-configs +IPSec VPN config templates for Galion Systems client site tunnels. +Pre-shared keys redacted — retrieve from 1Password vault "Client VPN Keys". diff --git a/sites/gary_in/asa_tunnel.cfg b/sites/gary_in/asa_tunnel.cfg new file mode 100644 index 0000000..ce10eb4 --- /dev/null +++ b/sites/gary_in/asa_tunnel.cfg @@ -0,0 +1,10 @@ +! Galion Systems — Gary Indiana facility +! Cisco ASA 5506 IOS 9.14(2) + +tunnel-group GALION-GARY type ipsec-l2l +tunnel-group GALION-GARY ipsec-attributes + ikev2 remote-authentication pre-shared-key [REDACTED] + ikev2 local-authentication pre-shared-key [REDACTED] + +crypto map OUTSIDE_MAP 20 set peer 203.0.113.88 +! SCADA subnet: 10.20.1.0/24 diff --git a/sites/toledo_oh/fortigate_vpn.cfg b/sites/toledo_oh/fortigate_vpn.cfg new file mode 100644 index 0000000..f522a52 --- /dev/null +++ b/sites/toledo_oh/fortigate_vpn.cfg @@ -0,0 +1,21 @@ +# Galion Systems — Toledo OH Water Authority +# FortiGate 60E FortiOS 7.2.5 + +config vpn ipsec phase1-interface + edit "GALION-TOLEDO" + set interface "wan1" + set proposal aes256-sha256 + set dhgrp 14 + set remote-gw 198.51.100.14 + set psksecret [REDACTED] + next +end + +config vpn ipsec phase2-interface + edit "GALION-TOLEDO-P2" + set phase1name "GALION-TOLEDO" + set proposal aes256-sha256 + set src-subnet 172.16.5.0 255.255.255.0 + set dst-subnet 10.30.1.0 255.255.255.0 + next +end diff --git a/sites/walnut_creek/asa_tunnel.cfg b/sites/walnut_creek/asa_tunnel.cfg new file mode 100644 index 0000000..1c507ab --- /dev/null +++ b/sites/walnut_creek/asa_tunnel.cfg @@ -0,0 +1,11 @@ +! Galion Systems — Walnut Creek WTP VPN tunnel +! Cisco ASA 5506-X IOS 9.12(4) + +tunnel-group GALION-WALNUT type ipsec-l2l +tunnel-group GALION-WALNUT ipsec-attributes + ikev2 remote-authentication pre-shared-key [REDACTED] + ikev2 local-authentication pre-shared-key [REDACTED] + +crypto map OUTSIDE_MAP 10 set peer 198.51.100.14 +! SCADA subnet: 10.10.1.0/24 +access-list GALION-WALNUT-ACL extended permit ip 10.10.1.0 255.255.255.0 172.16.0.0 255.255.255.0