PIX site to site tunnel, new IP

[scott.bridges]

Hello all,

Have a NY PIX with outside IP 20.1.1.35

Have a SF PIX with outside IP 20.2.2.163

Have an existing tunnel with this:

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto map outside_map 20 ipsec-isakmp

crypto map outside_map 20 match address outside_cryptomap_20

crypto map outside_map 20 set peer 20.2.2.163

crypto map outside_map 20 set transform-set ESP-3DES-MD5

crypto map outside_map interface outside

isakmp enable outside

isakmp key ******** address 20.2.2.163 netmask 255.255.255.255 no-xauth no-config-mode

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption 3des

isakmp policy 20 hash md5

isakmp policy 20 group 2

isakmp policy 20 lifetime 86400

I am getting a new static IP for the NY PIX, let's say 30.1.1.98

To have the tunnel still function, all I need to do is change the crypto map peer and change the isakmp key on the SF PIX?

If so, when I do "no isakmp key", do I just create a new one by "isakmp key 12345 address 30.1.1.98 netmask 255.255.255.255 no-xauth" ?

Thanks for any help!

[Jon Marshall · Accepted solution]

"To have the tunnel still function, all I need to do is change the crypto map peer and change the isakmp key on the SF PIX?"

Depends on what your access-list is doing ie. outside_crypto_20. if you are natting the private IP addresses to the public IP these would need updating as well.

If not you are correct that should be enough.

To remove the key

no isakmp key ******** address 20.2.2.163

isakmp key 12345 address 30.1.1.98

Jon

[scott.bridges]

access-list outside_cryptomap_20 permit ip 192.168.1.0 255.255.255.0 192.168.16.0 255.255.255.0

That is the ACL. The LAN IP scheme isn't changing, so I'm not seeing a reason to change this up. Is this a correct assumption?

All that is changing is the outside IP address.

If so, thanks so much for your help!

[Jon Marshall]

Scott

Yes your assumption is correct.

Hope it goes well.

Jon