Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

PIX site to site tunnel, new IP

Hello all,

Have a NY PIX with outside IP 20.1.1.35

Have a SF PIX with outside IP 20.2.2.163

Have an existing tunnel with this:

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto map outside_map 20 ipsec-isakmp

crypto map outside_map 20 match address outside_cryptomap_20

crypto map outside_map 20 set peer 20.2.2.163

crypto map outside_map 20 set transform-set ESP-3DES-MD5

crypto map outside_map interface outside

isakmp enable outside

isakmp key ******** address 20.2.2.163 netmask 255.255.255.255 no-xauth no-config-mode

isakmp policy 20 authentication pre-share

isakmp policy 20 encryption 3des

isakmp policy 20 hash md5

isakmp policy 20 group 2

isakmp policy 20 lifetime 86400

I am getting a new static IP for the NY PIX, let's say 30.1.1.98

To have the tunnel still function, all I need to do is change the crypto map peer and change the isakmp key on the SF PIX?

If so, when I do "no isakmp key", do I just create a new one by "isakmp key 12345 address 30.1.1.98 netmask 255.255.255.255 no-xauth" ?

Thanks for any help!

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Blue

Re: PIX site to site tunnel, new IP

"To have the tunnel still function, all I need to do is change the crypto map peer and change the isakmp key on the SF PIX?"

Depends on what your access-list is doing ie. outside_crypto_20. if you are natting the private IP addresses to the public IP these would need updating as well.

If not you are correct that should be enough.

To remove the key

no isakmp key ******** address 20.2.2.163

isakmp key 12345 address 30.1.1.98

Jon

3 REPLIES
Hall of Fame Super Blue

Re: PIX site to site tunnel, new IP

"To have the tunnel still function, all I need to do is change the crypto map peer and change the isakmp key on the SF PIX?"

Depends on what your access-list is doing ie. outside_crypto_20. if you are natting the private IP addresses to the public IP these would need updating as well.

If not you are correct that should be enough.

To remove the key

no isakmp key ******** address 20.2.2.163

isakmp key 12345 address 30.1.1.98

Jon

New Member

Re: PIX site to site tunnel, new IP

access-list outside_cryptomap_20 permit ip 192.168.1.0 255.255.255.0 192.168.16.0 255.255.255.0

That is the ACL. The LAN IP scheme isn't changing, so I'm not seeing a reason to change this up. Is this a correct assumption?

All that is changing is the outside IP address.

If so, thanks so much for your help!

Hall of Fame Super Blue

Re: PIX site to site tunnel, new IP

Scott

Yes your assumption is correct.

Hope it goes well.

Jon

107
Views
0
Helpful
3
Replies