dritter/vpn-configs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: dritter:0185b088601950b0ffd81db3c6db22b44f5205fc
Branches Tags
dritter:main
..
compare: dritter:d80687ade19c5485bd64a431e29fae3cc9e52cee
Branches Tags
dritter:main

No commits in common. "0185b088601950b0ffd81db3c6db22b44f5205fc" and "d80687ade19c5485bd64a431e29fae3cc9e52cee" have entirely different histories.
0185b08860 ... d80687ade1

4 changed files with 34 additions and 6 deletions
Show Stats Expand all files Collapse all files

15
README.md
View File

@ -1,3 +1,14 @@
# vpn-configs # vpn-configs
IPSec VPN config templates for Galion Systems client site tunnels.
Pre-shared keys redacted — retrieve from 1Password vault "Client VPN Keys". IPSec VPN configuration templates for Galion Systems client site tunnels.
Pre-shared keys are redacted — retrieve from IT password manager (1Password vault
"Client VPN Keys") before deployment.
## Sites
| Site | Device | Peer IP |
|------|--------|---------|
| walnut_creek | Cisco ASA 5506-X | 198.51.100.14 |
| gary_in | Cisco ASA 5506 | 203.0.113.88 |
| toledo_oh | FortiGate 60E | 198.51.100.14 |
Galion jumphost: contact IT for current IP.

2
sites/gary_in/asa_tunnel.cfg
View File

@ -1,4 +1,4 @@
! Galion Systems — Gary Indiana facility ! Galion Systems — Gary Indiana facility VPN
! Cisco ASA 5506 IOS 9.14(2) ! Cisco ASA 5506 IOS 9.14(2)
tunnel-group GALION-GARY type ipsec-l2l tunnel-group GALION-GARY type ipsec-l2l

6
sites/toledo_oh/fortigate_vpn.cfg
View File

@ -1,9 +1,12 @@
# Galion Systems — Toledo OH Water Authority # Galion Systems — Toledo OH Water Authority
# FortiGate 60E FortiOS 7.2.5 # FortiGate 60E FortiOS 7.2.5
# Site-to-site IPSec VPN to Galion jumphost
config vpn ipsec phase1-interface config vpn ipsec phase1-interface
edit "GALION-TOLEDO" edit "GALION-TOLEDO"
set interface "wan1" set interface "wan1"
set keylife 86400
set peertype any
set proposal aes256-sha256 set proposal aes256-sha256
set dhgrp 14 set dhgrp 14
set remote-gw 198.51.100.14 set remote-gw 198.51.100.14
@ -15,8 +18,9 @@ config vpn ipsec phase2-interface
edit "GALION-TOLEDO-P2" edit "GALION-TOLEDO-P2"
set phase1name "GALION-TOLEDO" set phase1name "GALION-TOLEDO"
set proposal aes256-sha256 set proposal aes256-sha256
set dhgrp 14
set src-subnet 172.16.5.0 255.255.255.0 set src-subnet 172.16.5.0 255.255.255.0
set dst-subnet 10.30.1.0 255.255.255.0 set dst-subnet 10.30.1.0 255.255.255.0
next next
end end
# updated after FortiOS upgrade ! updated 2026-01

17
sites/walnut_creek/asa_tunnel.cfg
View File

@ -1,11 +1,24 @@
! Galion Systems — Walnut Creek WTP VPN tunnel ! Galion Systems — Walnut Creek WTP VPN tunnel config
! Cisco ASA 5506-X IOS 9.12(4) ! Cisco ASA 5506-X IOS 9.12(4)
crypto ikev2 policy 10
encryption aes-256
integrity sha256
group 14
prf sha256
lifetime seconds 86400
tunnel-group GALION-WALNUT type ipsec-l2l tunnel-group GALION-WALNUT type ipsec-l2l
tunnel-group GALION-WALNUT general-attributes
default-group-policy GALION-REMOTE
tunnel-group GALION-WALNUT ipsec-attributes tunnel-group GALION-WALNUT ipsec-attributes
ikev2 remote-authentication pre-shared-key [REDACTED] ikev2 remote-authentication pre-shared-key [REDACTED]
ikev2 local-authentication pre-shared-key [REDACTED] ikev2 local-authentication pre-shared-key [REDACTED]
crypto map OUTSIDE_MAP 10 match address GALION-WALNUT-ACL
crypto map OUTSIDE_MAP 10 set peer 198.51.100.14 crypto map OUTSIDE_MAP 10 set peer 198.51.100.14
! SCADA subnet: 10.10.1.0/24 crypto map OUTSIDE_MAP 10 set ikev2 ipsec-proposal AES256-SHA256
crypto map OUTSIDE_MAP 10 set security-association lifetime seconds 28800
! SCADA subnet accessible via tunnel: 10.10.1.0/24
access-list GALION-WALNUT-ACL extended permit ip 10.10.1.0 255.255.255.0 172.16.0.0 255.255.255.0 access-list GALION-WALNUT-ACL extended permit ip 10.10.1.0 255.255.255.0 172.16.0.0 255.255.255.0