Have a NY PIX with outside IP 220.127.116.11
Have a SF PIX with outside IP 18.104.22.168
Have an existing tunnel with this:
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer 22.214.171.124
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map interface outside
isakmp enable outside
isakmp key ******** address 126.96.36.199 netmask 255.255.255.255 no-xauth no-config-mode
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
I am getting a new static IP for the NY PIX, let's say 188.8.131.52
To have the tunnel still function, all I need to do is change the crypto map peer and change the isakmp key on the SF PIX?
If so, when I do "no isakmp key", do I just create a new one by "isakmp key 12345 address 184.108.40.206 netmask 255.255.255.255 no-xauth" ?
Thanks for any help!
"To have the tunnel still function, all I need to do is change the crypto map peer and change the isakmp key on the SF PIX?"
Depends on what your access-list is doing ie. outside_crypto_20. if you are natting the private IP addresses to the public IP these would need updating as well.
If not you are correct that should be enough.
To remove the key
no isakmp key ******** address 220.127.116.11
isakmp key 12345 address 18.104.22.168