10-09-2008 02:31 PM - edited 03-03-2019 11:52 PM
Hello all,
Have a NY PIX with outside IP 20.1.1.35
Have a SF PIX with outside IP 20.2.2.163
Have an existing tunnel with this:
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer 20.2.2.163
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map interface outside
isakmp enable outside
isakmp key ******** address 20.2.2.163 netmask 255.255.255.255 no-xauth no-config-mode
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400
I am getting a new static IP for the NY PIX, let's say 30.1.1.98
To have the tunnel still function, all I need to do is change the crypto map peer and change the isakmp key on the SF PIX?
If so, when I do "no isakmp key", do I just create a new one by "isakmp key 12345 address 30.1.1.98 netmask 255.255.255.255 no-xauth" ?
Thanks for any help!
Solved! Go to Solution.
10-09-2008 05:56 PM
"To have the tunnel still function, all I need to do is change the crypto map peer and change the isakmp key on the SF PIX?"
Depends on what your access-list is doing ie. outside_crypto_20. if you are natting the private IP addresses to the public IP these would need updating as well.
If not you are correct that should be enough.
To remove the key
no isakmp key ******** address 20.2.2.163
isakmp key 12345 address 30.1.1.98
Jon
10-09-2008 05:56 PM
"To have the tunnel still function, all I need to do is change the crypto map peer and change the isakmp key on the SF PIX?"
Depends on what your access-list is doing ie. outside_crypto_20. if you are natting the private IP addresses to the public IP these would need updating as well.
If not you are correct that should be enough.
To remove the key
no isakmp key ******** address 20.2.2.163
isakmp key 12345 address 30.1.1.98
Jon
10-09-2008 06:08 PM
access-list outside_cryptomap_20 permit ip 192.168.1.0 255.255.255.0 192.168.16.0 255.255.255.0
That is the ACL. The LAN IP scheme isn't changing, so I'm not seeing a reason to change this up. Is this a correct assumption?
All that is changing is the outside IP address.
If so, thanks so much for your help!
10-09-2008 06:14 PM
Scott
Yes your assumption is correct.
Hope it goes well.
Jon
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide