! Galion Systems — Walnut Creek WTP VPN tunnel config
! Cisco ASA 5506-X  IOS 9.12(4)

crypto ikev2 policy 10
 encryption aes-256
 integrity sha256
 group 14
 prf sha256
 lifetime seconds 86400

tunnel-group GALION-WALNUT type ipsec-l2l
tunnel-group GALION-WALNUT general-attributes
 default-group-policy GALION-REMOTE
tunnel-group GALION-WALNUT ipsec-attributes
 ikev2 remote-authentication pre-shared-key [REDACTED]
 ikev2 local-authentication pre-shared-key [REDACTED]

crypto map OUTSIDE_MAP 10 match address GALION-WALNUT-ACL
crypto map OUTSIDE_MAP 10 set peer 198.51.100.14
crypto map OUTSIDE_MAP 10 set ikev2 ipsec-proposal AES256-SHA256
crypto map OUTSIDE_MAP 10 set security-association lifetime seconds 28800

! SCADA subnet accessible via tunnel: 10.10.1.0/24
access-list GALION-WALNUT-ACL extended permit ip 10.10.1.0 255.255.255.0 172.16.0.0 255.255.255.0