Lab 14.6.6 Configure a Secure VPN gateway Using IPSec between ...

access-list ACLIN permit tcp any object-group ALLSERVERS eq wwwaccess-list ACLIN permit tcp any host 192.168.P.11 eq www (hitcnt=0)access-list ACLIN permit tcp any host 192.168.P.10 eq www (hitcnt=2)access-list ACLIN permit tcp any host 192.168.P.6 eq www (hitcnt=0)access-list ACLIN permit tcp any host 192.168.P.7 eq www (hitcnt=0)access-list ACLIN permit icmp any any object-group PINGaccess-list ACLIN permit icmp any any echo (hitcnt=12)access-list ACLIN permit icmp any any echo-reply (hitcnt=4)access-list ACLIN permit icmp any any unreachable (hitcnt=0)access-list ACLIN deny ip any any (hitcnt=3)access-list ACLDMZ; 3 elementsaccess-list ACLDMZ permit icmp any any object-group PINGaccess-list ACLDMZ permit icmp any any echo (hitcnt=0)access-list ACLDMZ permit icmp any any echo-reply (hitcnt=8)access-list ACLDMZ permit icmp any any unreachable (hitcnt=0)access-list 101; 1 elementsaccess-list 101 permit ip host 192.168.P.10 host 192.168.Q.10(hitcnt=0)(where P = pod number, and Q = peer pod number)c. Configure an IPSec transform set (IKE phase two parameters) to use ESP and DES. Use atransform-set-name of pixQ.PixP(config)# crypto ipsec transform-set pixQ esp-des(where Q = peer pod number)1. What are some other IPSec security protocol combinations that can be used?_____________________________________________________________________________d. Create a crypto map by completing the following sub-steps:i. Create a crypto map entry. Use a map-name of peer Q.PixP(config)# crypto map peerQ 10 ipsec-isakmp(where Q = peer pod number)ii. Look at the crypto map and observe the defaults:PixP(config)# show crypto mapCrypto Map “peerQ” 10 ipsec-isakmpNo matching address list set.Current peer: 0.0.0.0Security association lifetime: 4608000 kilobytes/28800 secondsPFS (Y/N): NTransform sets={ }6 - 11 Fundamentals of Network Security v 1.0 - Lab 14.6.6 Copyright © 2003, Cisco Systems, Inc.