dritter/vpn-configs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: dritter:d80687ade19c5485bd64a431e29fae3cc9e52cee
Branches Tags
dritter:main
..
compare: dritter:0185b088601950b0ffd81db3c6db22b44f5205fc
Branches Tags
dritter:main

No commits in common. "d80687ade19c5485bd64a431e29fae3cc9e52cee" and "0185b088601950b0ffd81db3c6db22b44f5205fc" have entirely different histories.
d80687ade1 ... 0185b08860

4 changed files with 6 additions and 34 deletions
Show Stats Expand all files Collapse all files

15
README.md
View File

@ -1,14 +1,3 @@
# vpn-configs # vpn-configs
IPSec VPN config templates for Galion Systems client site tunnels.
IPSec VPN configuration templates for Galion Systems client site tunnels. Pre-shared keys redacted — retrieve from 1Password vault "Client VPN Keys".
Pre-shared keys are redacted — retrieve from IT password manager (1Password vault
"Client VPN Keys") before deployment.
## Sites
| Site | Device | Peer IP |
|------|--------|---------|
| walnut_creek | Cisco ASA 5506-X | 198.51.100.14 |
| gary_in | Cisco ASA 5506 | 203.0.113.88 |
| toledo_oh | FortiGate 60E | 198.51.100.14 |
Galion jumphost: contact IT for current IP.

2
sites/gary_in/asa_tunnel.cfg
View File

@ -1,4 +1,4 @@
! Galion Systems — Gary Indiana facility VPN ! Galion Systems — Gary Indiana facility
! Cisco ASA 5506 IOS 9.14(2) ! Cisco ASA 5506 IOS 9.14(2)
tunnel-group GALION-GARY type ipsec-l2l tunnel-group GALION-GARY type ipsec-l2l

6
sites/toledo_oh/fortigate_vpn.cfg
View File

@ -1,12 +1,9 @@
# Galion Systems — Toledo OH Water Authority # Galion Systems — Toledo OH Water Authority
# FortiGate 60E FortiOS 7.2.5 # FortiGate 60E FortiOS 7.2.5
# Site-to-site IPSec VPN to Galion jumphost
config vpn ipsec phase1-interface config vpn ipsec phase1-interface
edit "GALION-TOLEDO" edit "GALION-TOLEDO"
set interface "wan1" set interface "wan1"
set keylife 86400
set peertype any
set proposal aes256-sha256 set proposal aes256-sha256
set dhgrp 14 set dhgrp 14
set remote-gw 198.51.100.14 set remote-gw 198.51.100.14
@ -18,9 +15,8 @@ config vpn ipsec phase2-interface
edit "GALION-TOLEDO-P2" edit "GALION-TOLEDO-P2"
set phase1name "GALION-TOLEDO" set phase1name "GALION-TOLEDO"
set proposal aes256-sha256 set proposal aes256-sha256
set dhgrp 14
set src-subnet 172.16.5.0 255.255.255.0 set src-subnet 172.16.5.0 255.255.255.0
set dst-subnet 10.30.1.0 255.255.255.0 set dst-subnet 10.30.1.0 255.255.255.0
next next
end end
! updated 2026-01 # updated after FortiOS upgrade

17
sites/walnut_creek/asa_tunnel.cfg
View File

@ -1,24 +1,11 @@
! Galion Systems — Walnut Creek WTP VPN tunnel config ! Galion Systems — Walnut Creek WTP VPN tunnel
! Cisco ASA 5506-X IOS 9.12(4) ! Cisco ASA 5506-X IOS 9.12(4)
crypto ikev2 policy 10
encryption aes-256
integrity sha256
group 14
prf sha256
lifetime seconds 86400
tunnel-group GALION-WALNUT type ipsec-l2l tunnel-group GALION-WALNUT type ipsec-l2l
tunnel-group GALION-WALNUT general-attributes
default-group-policy GALION-REMOTE
tunnel-group GALION-WALNUT ipsec-attributes tunnel-group GALION-WALNUT ipsec-attributes
ikev2 remote-authentication pre-shared-key [REDACTED] ikev2 remote-authentication pre-shared-key [REDACTED]
ikev2 local-authentication pre-shared-key [REDACTED] ikev2 local-authentication pre-shared-key [REDACTED]
crypto map OUTSIDE_MAP 10 match address GALION-WALNUT-ACL
crypto map OUTSIDE_MAP 10 set peer 198.51.100.14 crypto map OUTSIDE_MAP 10 set peer 198.51.100.14
crypto map OUTSIDE_MAP 10 set ikev2 ipsec-proposal AES256-SHA256 ! SCADA subnet: 10.10.1.0/24
crypto map OUTSIDE_MAP 10 set security-association lifetime seconds 28800
! SCADA subnet accessible via tunnel: 10.10.1.0/24
access-list GALION-WALNUT-ACL extended permit ip 10.10.1.0 255.255.255.0 172.16.0.0 255.255.255.0 access-list GALION-WALNUT-ACL extended permit ip 10.10.1.0 255.255.255.0 172.16.0.0 255.255.255.0