lab:
  description: A simple topology that leverages a S2S IPSEC VPN between two ASA firewalls
    to explore IPSEC connections.
  notes: ''
  title: IPSEC Exploration
  version: 0.1.0
links:
  - id: l0
    n1: n2
    n2: n4
    i1: i2
    i2: i2
    label: R5-GigabitEthernet0/1<->S2-GigabitEthernet0/1
  - id: l1
    n1: n6
    n2: n3
    i1: i0
    i2: i6
    label: H2-eth0<->S1-GigabitEthernet1/1
  - id: l2
    n1: n5
    n2: n3
    i1: i0
    i2: i5
    label: H1-eth0<->S1-GigabitEthernet1/0
  - id: l3
    n1: n4
    n2: n7
    i1: i5
    i2: i0
    label: S2-GigabitEthernet1/0<->H3-eth0
  - id: l4
    n1: n3
    n2: n1
    i1: i2
    i2: i2
    label: S1-GigabitEthernet0/1<->R1-GigabitEthernet0/1
  - id: l5
    n1: n8
    n2: n4
    i1: i0
    i2: i6
    label: H4-eth0<->S2-GigabitEthernet1/1
  - id: l6
    n1: n9
    n2: n0
    i1: i1
    i2: i2
    label: Site1-FW-GigabitEthernet0/0<->WAN-GigabitEthernet0/1
  - id: l7
    n1: n10
    n2: n0
    i1: i1
    i2: i3
    label: Site2-FW-GigabitEthernet0/0<->WAN-GigabitEthernet0/2
  - id: l8
    n1: n10
    n2: n2
    i1: i2
    i2: i3
    label: Site2-FW-GigabitEthernet0/1<->Site2-Rtr-GigabitEthernet0/2
  - id: l9
    n1: n1
    n2: n9
    i1: i3
    i2: i2
    label: Site1-Rtr-GigabitEthernet0/2<->Site1-FW-GigabitEthernet0/1
  - id: l10
    n1: n0
    n2: n12
    i1: i4
    i2: i0
    label: WAN-GigabitEthernet0/3<->Internet-SW-port0
  - id: l11
    n1: n11
    n2: n12
    i1: i0
    i2: i1
    label: InternetHost-eth0<->Internet-SW-port1
nodes:
  - boot_disk_size: 0
    configuration: |-
      !
      hostname WAN
      !
      !
      interface GigabitEthernet0/0
       no ip address
       shutdown
       duplex auto
       speed auto
       media-type rj45
      !
      interface GigabitEthernet0/1
       ip address 10.255.1.1 255.255.255.0
       ip ospf cost 100
       duplex auto
       speed auto
       media-type rj45
      !
      interface GigabitEthernet0/2
       ip address 10.255.2.1 255.255.255.0
       ip ospf cost 100
       duplex auto
       speed auto
       media-type rj45
      !
      interface GigabitEthernet0/3
       ip address 10.255.255.1 255.255.255.0
       ip ospf cost 100
       duplex auto
       speed auto
       media-type rj45
      !
      !
      router ospf 1
       router-id 255.255.255.255
       network 10.255.1.0 0.0.0.255 area 0
       network 10.255.2.0 0.0.0.255 area 0
      !
      ip http server
      !
      banner exec ^C
      **************************************************************************
      * IOSv is strictly limited to use for evaluation, demonstration and IOS  *
      * education. IOSv is provided as-is and is not supported by Cisco's      *
      * Technical Advisory Center. Any use or disclosure, in whole or in part, *
      * of the IOSv Software or Documentation to any third party for any       *
      * purposes is expressly prohibited except as otherwise authorized by     *
      * Cisco in writing.                                                      *
      **************************************************************************^C
      banner incoming ^C
      **************************************************************************
      * IOSv is strictly limited to use for evaluation, demonstration and IOS  *
      * education. IOSv is provided as-is and is not supported by Cisco's      *
      * Technical Advisory Center. Any use or disclosure, in whole or in part, *
      * of the IOSv Software or Documentation to any third party for any       *
      * purposes is expressly prohibited except as otherwise authorized by     *
      * Cisco in writing.                                                      *
      **************************************************************************^C
      banner login ^C
      **************************************************************************
      * IOSv is strictly limited to use for evaluation, demonstration and IOS  *
      * education. IOSv is provided as-is and is not supported by Cisco's      *
      * Technical Advisory Center. Any use or disclosure, in whole or in part, *
      * of the IOSv Software or Documentation to any third party for any       *
      * purposes is expressly prohibited except as otherwise authorized by     *
      * Cisco in writing.                                                      *
      **************************************************************************^C
      !
      !
      end
    cpu_limit: 100
    cpus: 1
    data_volume: 0
    hide_links: false
    id: n0
    label: WAN
    node_definition: iosv
    ram: 512
    tags: []
    x: -89
    y: 278
    interfaces:
      - id: i0
        label: Loopback0
        type: loopback
      - id: i1
        label: GigabitEthernet0/0
        slot: 0
        type: physical
      - id: i2
        label: GigabitEthernet0/1
        slot: 1
        type: physical
      - id: i3
        label: GigabitEthernet0/2
        slot: 2
        type: physical
      - id: i4
        label: GigabitEthernet0/3
        slot: 3
        type: physical
  - boot_disk_size: 0
    configuration: |-
      !
      hostname Site1-Rtr
      !
      !
      interface GigabitEthernet0/0
      no ip address
      shutdown
      duplex auto
      speed auto
      media-type rj45
      !
      interface GigabitEthernet0/1
      no ip address
      duplex auto
      speed auto
      media-type rj45
      !
      interface GigabitEthernet0/1.100
      encapsulation dot1Q 100
      ip address 192.168.100.1 255.255.255.0
      !
      interface GigabitEthernet0/1.200
      encapsulation dot1Q 200
      ip address 192.168.200.1 255.255.255.0
      !
      interface GigabitEthernet0/2
      ip address 10.12.12.1 255.255.255.0
      ip ospf cost 100
      duplex auto
      speed auto
      media-type rj45
      !
      !
      router ospf 1
      router-id 1.1.1.1
      passive-interface GigabitEthernet0/1
      network 10.12.12.0 0.0.0.255 area 0
      network 192.168.100.0 0.0.0.255 area 0
      network 192.168.200.0 0.0.0.255 area 0
      !
      !
      banner exec ^C
      **************************************************************************
      * IOSv is strictly limited to use for evaluation, demonstration and IOS  *
      * education. IOSv is provided as-is and is not supported by Cisco's      *
      * Technical Advisory Center. Any use or disclosure, in whole or in part, *
      * of the IOSv Software or Documentation to any third party for any       *
      * purposes is expressly prohibited except as otherwise authorized by     *
      * Cisco in writing.                                                      *
      **************************************************************************^C
      banner incoming ^C
      **************************************************************************
      * IOSv is strictly limited to use for evaluation, demonstration and IOS  *
      * education. IOSv is provided as-is and is not supported by Cisco's      *
      * Technical Advisory Center. Any use or disclosure, in whole or in part, *
      * of the IOSv Software or Documentation to any third party for any       *
      * purposes is expressly prohibited except as otherwise authorized by     *
      * Cisco in writing.                                                      *
      **************************************************************************^C
      banner login ^C
      **************************************************************************
      * IOSv is strictly limited to use for evaluation, demonstration and IOS  *
      * education. IOSv is provided as-is and is not supported by Cisco's      *
      * Technical Advisory Center. Any use or disclosure, in whole or in part, *
      * of the IOSv Software or Documentation to any third party for any       *
      * purposes is expressly prohibited except as otherwise authorized by     *
      * Cisco in writing.                                                      *
      **************************************************************************^C
      !
      !
      end
    cpu_limit: 100
    cpus: 1
    data_volume: 0
    hide_links: false
    id: n1
    label: Site1-Rtr
    node_definition: iosv
    ram: 512
    tags: []
    x: 340
    y: 424
    interfaces:
      - id: i0
        label: Loopback0
        type: loopback
      - id: i1
        label: GigabitEthernet0/0
        slot: 0
        type: physical
      - id: i2
        label: GigabitEthernet0/1
        slot: 1
        type: physical
      - id: i3
        label: GigabitEthernet0/2
        slot: 2
        type: physical
      - id: i4
        label: GigabitEthernet0/3
        slot: 3
        type: physical
      - id: i5
        label: GigabitEthernet0/4
        slot: 4
        type: physical
  - boot_disk_size: 0
    configuration: |-
      !
      hostname Site2-Rtr
      !
      !
      interface GigabitEthernet0/0
       no ip address
       shutdown
       duplex auto
       speed auto
       media-type rj45
      !
      interface GigabitEthernet0/1
       ip address 172.16.10.1 255.255.255.0
       duplex auto
       speed auto
       media-type rj45
      !
      interface GigabitEthernet0/2
       ip address 10.25.25.5 255.255.255.0
       ip ospf cost 100
       duplex auto
       speed auto
       media-type rj45
      !
      !
      router ospf 1
       router-id 5.5.5.5
       passive-interface GigabitEthernet0/1
       network 10.25.25.0 0.0.0.255 area 0
       network 172.16.10.0 0.0.0.255 area 0
      !
      banner exec ^C
      **************************************************************************
      * IOSv is strictly limited to use for evaluation, demonstration and IOS  *
      * education. IOSv is provided as-is and is not supported by Cisco's      *
      * Technical Advisory Center. Any use or disclosure, in whole or in part, *
      * of the IOSv Software or Documentation to any third party for any       *
      * purposes is expressly prohibited except as otherwise authorized by     *
      * Cisco in writing.                                                      *
      **************************************************************************^C
      banner incoming ^C
      **************************************************************************
      * IOSv is strictly limited to use for evaluation, demonstration and IOS  *
      * education. IOSv is provided as-is and is not supported by Cisco's      *
      * Technical Advisory Center. Any use or disclosure, in whole or in part, *
      * of the IOSv Software or Documentation to any third party for any       *
      * purposes is expressly prohibited except as otherwise authorized by     *
      * Cisco in writing.                                                      *
      **************************************************************************^C
      banner login ^C
      **************************************************************************
      * IOSv is strictly limited to use for evaluation, demonstration and IOS  *
      * education. IOSv is provided as-is and is not supported by Cisco's      *
      * Technical Advisory Center. Any use or disclosure, in whole or in part, *
      * of the IOSv Software or Documentation to any third party for any       *
      * purposes is expressly prohibited except as otherwise authorized by     *
      * Cisco in writing.                                                      *
      **************************************************************************^C
      !
      !
      end
    cpu_limit: 100
    cpus: 1
    data_volume: 0
    hide_links: false
    id: n2
    label: Site2-Rtr
    node_definition: iosv
    ram: 512
    tags: []
    x: 342
    y: 273
    interfaces:
      - id: i0
        label: Loopback0
        type: loopback
      - id: i1
        label: GigabitEthernet0/0
        slot: 0
        type: physical
      - id: i2
        label: GigabitEthernet0/1
        slot: 1
        type: physical
      - id: i3
        label: GigabitEthernet0/2
        slot: 2
        type: physical
      - id: i4
        label: GigabitEthernet0/3
        slot: 3
        type: physical
      - id: i5
        label: GigabitEthernet0/4
        slot: 4
        type: physical
  - boot_disk_size: 0
    configuration: |-
      !
      hostname Site1-SW
      !
      vlan 100
       name YELLOW
       exit
      vlan 200
       name BLUE
       exit
      !
      !
      interface GigabitEthernet0/0
       negotiation auto
      !
      interface GigabitEthernet0/1
       switchport trunk allowed vlan 100,200
       switchport trunk encapsulation dot1q
       switchport mode trunk
       negotiation auto
      !
      interface GigabitEthernet0/2
       negotiation auto
      !
      interface GigabitEthernet0/3
       negotiation auto
      !
      interface GigabitEthernet1/0
       switchport access vlan 100
       switchport mode access
       negotiation auto
      !
      interface GigabitEthernet1/1
       switchport access vlan 200
       switchport mode access
       negotiation auto
      !
      !
      banner exec ^C
      **************************************************************************
      * IOSv is strictly limited to use for evaluation, demonstration and IOS  *
      * education. IOSv is provided as-is and is not supported by Cisco's      *
      * Technical Advisory Center. Any use or disclosure, in whole or in part, *
      * of the IOSv Software or Documentation to any third party for any       *
      * purposes is expressly prohibited except as otherwise authorized by     *
      * Cisco in writing.                                                      *
      **************************************************************************^C
      banner incoming ^C
      **************************************************************************
      * IOSv is strictly limited to use for evaluation, demonstration and IOS  *
      * education. IOSv is provided as-is and is not supported by Cisco's      *
      * Technical Advisory Center. Any use or disclosure, in whole or in part, *
      * of the IOSv Software or Documentation to any third party for any       *
      * purposes is expressly prohibited except as otherwise authorized by     *
      * Cisco in writing.                                                      *
      **************************************************************************^C
      banner login ^C
      **************************************************************************
      * IOSv is strictly limited to use for evaluation, demonstration and IOS  *
      * education. IOSv is provided as-is and is not supported by Cisco's      *
      * Technical Advisory Center. Any use or disclosure, in whole or in part, *
      * of the IOSv Software or Documentation to any third party for any       *
      * purposes is expressly prohibited except as otherwise authorized by     *
      * Cisco in writing.                                                      *
      **************************************************************************^C
      !
      !
      end
    cpu_limit: 100
    cpus: 1
    data_volume: 0
    hide_links: false
    id: n3
    label: Site1-SW
    node_definition: iosvl2
    ram: 768
    tags: []
    x: 548
    y: 421
    interfaces:
      - id: i0
        label: Loopback0
        type: loopback
      - id: i1
        label: GigabitEthernet0/0
        slot: 0
        type: physical
      - id: i2
        label: GigabitEthernet0/1
        slot: 1
        type: physical
      - id: i3
        label: GigabitEthernet0/2
        slot: 2
        type: physical
      - id: i4
        label: GigabitEthernet0/3
        slot: 3
        type: physical
      - id: i5
        label: GigabitEthernet1/0
        slot: 4
        type: physical
      - id: i6
        label: GigabitEthernet1/1
        slot: 5
        type: physical
  - boot_disk_size: 0
    configuration: |-
      !
      hostname Site2-SW
      !
      vlan 10
       name PURPLE
       exit
      !
      !
      interface GigabitEthernet0/0
       negotiation auto
      !
      interface GigabitEthernet0/1
       switchport access vlan 10
       switchport mode access
       negotiation auto
       no shutdown
      !
      interface GigabitEthernet0/2
       switchport access vlan 10
       switchport mode access
       negotiation auto
       no shutdown
      !
      interface GigabitEthernet0/3
       switchport access vlan 10
       switchport mode access
       negotiation auto
       no shutdown
      !
      interface GigabitEthernet1/0
       switchport access vlan 10
       switchport mode access
       negotiation auto
       no shutdown
      !
      interface GigabitEthernet1/1
       switchport access vlan 10
       switchport mode access
       negotiation auto
       no shutdown
      !
      !
      banner exec ^C
      **************************************************************************
      * IOSv is strictly limited to use for evaluation, demonstration and IOS  *
      * education. IOSv is provided as-is and is not supported by Cisco's      *
      * Technical Advisory Center. Any use or disclosure, in whole or in part, *
      * of the IOSv Software or Documentation to any third party for any       *
      * purposes is expressly prohibited except as otherwise authorized by     *
      * Cisco in writing.                                                      *
      **************************************************************************^C
      banner incoming ^C
      **************************************************************************
      * IOSv is strictly limited to use for evaluation, demonstration and IOS  *
      * education. IOSv is provided as-is and is not supported by Cisco's      *
      * Technical Advisory Center. Any use or disclosure, in whole or in part, *
      * of the IOSv Software or Documentation to any third party for any       *
      * purposes is expressly prohibited except as otherwise authorized by     *
      * Cisco in writing.                                                      *
      **************************************************************************^C
      banner login ^C
      **************************************************************************
      * IOSv is strictly limited to use for evaluation, demonstration and IOS  *
      * education. IOSv is provided as-is and is not supported by Cisco's      *
      * Technical Advisory Center. Any use or disclosure, in whole or in part, *
      * of the IOSv Software or Documentation to any third party for any       *
      * purposes is expressly prohibited except as otherwise authorized by     *
      * Cisco in writing.                                                      *
      **************************************************************************^C
      !
      !
      end
    cpu_limit: 100
    cpus: 1
    data_volume: 0
    hide_links: false
    id: n4
    label: Site2-SW
    node_definition: iosvl2
    ram: 768
    tags: []
    x: 550
    y: 272
    interfaces:
      - id: i0
        label: Loopback0
        type: loopback
      - id: i1
        label: GigabitEthernet0/0
        slot: 0
        type: physical
      - id: i2
        label: GigabitEthernet0/1
        slot: 1
        type: physical
      - id: i3
        label: GigabitEthernet0/2
        slot: 2
        type: physical
      - id: i4
        label: GigabitEthernet0/3
        slot: 3
        type: physical
      - id: i5
        label: GigabitEthernet1/0
        slot: 4
        type: physical
      - id: i6
        label: GigabitEthernet1/1
        slot: 5
        type: physical
  - boot_disk_size: 16
    configuration: |-
      # this is a shell script which will be sourced at boot
      hostname Site1-Host1
      # configurable user account
      USERNAME=cisco
      PASSWORD=cisco
      # ip
      ip addr add 192.168.100.11/24 dev eth0
      ip link set dev eth0 up
      ip route add 0.0.0.0/0 via 192.168.100.1
    cpu_limit: 100
    cpus: 1
    data_volume: 0
    hide_links: false
    id: n5
    label: Site1-Host1
    node_definition: desktop
    ram: 512
    tags: []
    x: 734
    y: 422
    interfaces:
      - id: i0
        label: eth0
        slot: 0
        type: physical
      - id: i1
        label: eth1
        slot: 1
        type: physical
  - boot_disk_size: 16
    configuration: |-
      # this is a shell script which will be sourced at boot
      hostname Site1-Host2
      # configurable user account
      USERNAME=cisco
      PASSWORD=cisco
      # IP Information
      ip addr add 192.168.200.11/24 dev eth0
      ip link set dev eth0 up
      ip route add 0.0.0.0/0 via 192.168.200.1
    cpu_limit: 100
    cpus: 1
    data_volume: 0
    hide_links: false
    id: n6
    label: Site1-Host2
    node_definition: desktop
    ram: 512
    tags: []
    x: 737
    y: 520
    interfaces:
      - id: i0
        label: eth0
        slot: 0
        type: physical
  - boot_disk_size: 16
    configuration: |-
      # this is a shell script which will be sourced at boot
      hostname Site2-Host1
      # configurable user account
      USERNAME=cisco
      PASSWORD=cisco
      # IP Information
      ip addr add 172.16.10.11/24 dev eth0
      ip link set dev eth0 up
      ip route add default via 172.16.10.1
    cpu_limit: 100
    cpus: 1
    data_volume: 0
    hide_links: false
    id: n7
    label: Site2-Host1
    node_definition: desktop
    ram: 512
    tags: []
    x: 728
    y: 185
    interfaces:
      - id: i0
        label: eth0
        slot: 0
        type: physical
  - boot_disk_size: 16
    configuration: |-
      # this is a shell script which will be sourced at boot
      hostname Site2-Host2
      # configurable user account
      USERNAME=cisco
      PASSWORD=cisco
      # IP Information
      ip addr add 172.16.10.21/24 dev eth0
      ip link set dev eth0 up
      ip route add default via 172.16.10.1
    cpu_limit: 100
    cpus: 1
    data_volume: 0
    hide_links: false
    id: n8
    label: Site2-Host2
    node_definition: alpine
    ram: 512
    tags: []
    x: 724
    y: 272
    interfaces:
      - id: i0
        label: eth0
        slot: 0
        type: physical
  - boot_disk_size: 0
    configuration: |-
      !
      hostname Site1-FW
      domain-name example.com

      enable password cisco
      passwd cisco

      logging enable
      logging buffered debugging
      !
      interface GigabitEthernet0/0
       nameif outside
       security-level 0
       ip address 10.255.1.2 255.255.255.0
      !
      interface GigabitEthernet0/1
       nameif inside
       security-level 100
       ip address 10.12.12.2 255.255.255.0
      !
      !
      interface Management0/0
       management-only
       shutdown
       nameif management
       security-level 100
       no ip address
      !
      same-security-traffic permit inter-interface
      same-security-traffic permit intra-interface

      route outside 0.0.0.0 0.0.0.0 10.255.1.1 1

      router ospf 1
       router-id 1.1.1.255
       network 10.12.12.0 255.255.255.0 area 0
       default-information originate
       log-adj-changes

      object network SITE1-YELLOW
       subnet 192.168.100.0 255.255.255.0
      object network SITE1-BLUE
       subnet 192.168.200.0 255.255.255.0

      object network Site1-Host1
       host 192.168.100.11
      object network Site1-Host2
       host 192.168.200.11

      object-group network SITE1
       network-object object SITE1-YELLOW
       network-object object SITE1-BLUE


      object network SITE2-PURPLE
       subnet 172.16.10.0 255.255.255.0

      object network Site2-Host1
       host 172.16.10.11
      object network Site2-Host2
       host 172.16.10.21

      object-group network SITE2
       network-object object SITE2-PURPLE


      access-list inside_access_in line 10 extended permit tcp object-group SITE1 any4 eq www log default
      access-list inside_access_in line 20 extended permit icmp object-group SITE1 any4 log default
      access-list inside_access_in line 1000 extended deny ip any any log default

      access-list outside_access_in line 1000 extended deny ip any any log default

      access-group inside_access_in in interface inside
      access-group outside_access_in in interface outside

      nat (inside,outside) source dynamic SITE1 interface destination any

      http server enable 443
      http 192.168.100.0 255.255.255.0 inside
      no ssh stricthostkeycheck
      ssh timeout 30
      ssh version 2
      ssh key-exchange group dh-group14-sha1
      ssh 192.168.100.0 255.255.255.0 inside
      management-access inside


      policy-map global_policy
       class inspection_default
        inspect icmp



      no sysopt connection permit-vpn


      crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
      crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
      crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
      crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
      crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
      crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac


      crypto ipsec ikev2 ipsec-proposal ESP-AES-256-SHA
       protocol esp encryption aes-256
       protocol esp integrity sha-1
      crypto ipsec ikev2 ipsec-proposal ESP-AES-192-SHA
       protocol esp encryption aes-192
       protocol esp integrity sha-1
      crypto ipsec ikev2 ipsec-proposal ESP-AES-128-SHA
       protocol esp encryption aes
       protocol esp integrity sha-1


      nat (inside,outside) 1 source static SITE1 SITE1 destination static SITE2 SITE2
      access-list s2svpn_to_site2 line 10 extended permit ip object-group SITE1 object-group SITE2 log default

      access-list inside_access_in line 1 extended permit tcp object-group SITE1 object-group SITE2 eq ssh log default

      access-list outside_access_in line 1 extended permit tcp object-group SITE2 object-group SITE1 eq ssh log default
      access-list outside_access_in line 2 extended permit icmp object-group SITE2 object-group SITE1 log default


      crypto map outside_map 1 match address s2svpn_to_site2
      crypto map outside_map 1 set pfs group14
      crypto map outside_map 1 set peer 10.255.2.2
      crypto map outside_map 1 set ikev1 transform-set ESP-AES-256-SHA
      crypto map outside_map 1 set ikev2 ipsec-proposal ESP-AES-256-SHA
      crypto map outside_map 1 set reverse-route

      crypto map outside_map interface outside



      crypto ikev2 policy 10
       encryption aes-256
       integrity sha256
       group 14
       prf sha256
       lifetime seconds 86400

      crypto ikev2 policy 20
       encryption aes-192
       integrity sha
       group 14
       prf sha
       lifetime seconds 86400

      crypto ikev2 policy 30
       encryption aes
       integrity sha
       group 5
       prf sha
       lifetime seconds 86400

      crypto ikev1 policy 10
       authentication pre-share
       encryption aes-256
       hash sha
       group 14
       lifetime none

      crypto ikev1 policy 20
       authentication pre-share
       encryption aes-192
       hash sha
       group 14
       lifetime none

      crypto ikev1 policy 30
       authentication pre-share
       encryption aes
       hash sha
       group 5
       lifetime none

      crypto ikev2 enable outside
      crypto ikev1 enable outside



      group-policy S2S-VPN-IKEV1 internal
      group-policy S2S-VPN-IKEV1 attributes
       vpn-tunnel-protocol ikev1

      group-policy S2S-VPN-IKEV2 internal
      group-policy S2S-VPN-IKEV2 attributes
       vpn-tunnel-protocol ikev2


      tunnel-group 10.255.2.2 type ipsec-l2l
      tunnel-group 10.255.2.2 general-attributes
       default-group-policy S2S-VPN-IKEV2

      tunnel-group 10.255.2.2 ipsec-attributes
       ikev1 pre-shared-key SecureVPNKeyv1
       ikev2 remote-authentication pre-shared-key SecureVPNKeyv2
       ikev2 local-authentication pre-shared-key SecureVPNKeyv2
    cpu_limit: 100
    cpus: 1
    data_volume: 0
    hide_links: false
    id: n9
    label: Site1-FW
    node_definition: asav
    ram: 2048
    tags: []
    x: 137
    y: 422
    interfaces:
      - id: i0
        label: Management0/0
        slot: 0
        type: physical
      - id: i1
        label: GigabitEthernet0/0
        slot: 1
        type: physical
      - id: i2
        label: GigabitEthernet0/1
        slot: 2
        type: physical
  - boot_disk_size: 0
    configuration: |-
      !
      hostname Site2-FW
      domain-name example.com

      enable password cisco
      passwd cisco

      logging enable
      logging buffered debugging
      !
      interface GigabitEthernet0/0
       nameif outside
       security-level 0
       ip address 10.255.2.2 255.255.255.0
      !
      interface GigabitEthernet0/1
       nameif inside
       security-level 100
       ip address 10.25.25.2 255.255.255.0
      !
      !
      interface Management0/0
       management-only
       shutdown
       nameif management
       security-level 100
       no ip address
      !
      same-security-traffic permit inter-interface
      same-security-traffic permit intra-interface

      route outside 0.0.0.0 0.0.0.0 10.255.2.1 1

      router ospf 1
       router-id 2.2.2.255
       network 10.25.25.0 255.255.255.0 area 0
       default-information originate
       log-adj-changes

      object network SITE1-YELLOW
       subnet 192.168.100.0 255.255.255.0
      object network SITE1-BLUE
       subnet 192.168.200.0 255.255.255.0

      object network Site1-Host1
       host 192.168.100.11
      object network Site1-Host2
       host 192.168.200.11

      object-group network SITE1
       network-object object SITE1-YELLOW
       network-object object SITE1-BLUE


      object network SITE2-PURPLE
       subnet 172.16.10.0 255.255.255.0

      object network Site2-Host1
       host 172.16.10.11
      object network Site2-Host2
       host 172.16.10.21

      object-group network SITE2
       network-object object SITE2-PURPLE


      access-list inside_access_in line 10 extended permit tcp object-group SITE2 any4 eq www log default
      access-list inside_access_in line 20 extended permit icmp object-group SITE2 any4 log default
      access-list inside_access_in line 1000 extended deny ip any any log default

      access-list outside_access_in line 1000 extended deny ip any any log default

      access-group inside_access_in in interface inside
      access-group outside_access_in in interface outside

      nat (inside,outside) source dynamic SITE2 interface

      http server enable 443
      http 172.16.10.0 255.255.255.0 inside
      no ssh stricthostkeycheck
      ssh timeout 30
      ssh version 2
      ssh key-exchange group dh-group14-sha1
      ssh 172.16.10.0 255.255.255.0 inside
      management-access inside


      policy-map global_policy
       class inspection_default
        inspect icmp

      fixup protocol icmp


      no sysopt connection permit-vpn

      crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
      crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
      crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
      crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
      crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
      crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac


      crypto ipsec ikev2 ipsec-proposal ESP-AES-256-SHA
       protocol esp encryption aes-256
       protocol esp integrity sha-1
      crypto ipsec ikev2 ipsec-proposal ESP-AES-192-SHA
       protocol esp encryption aes-192
       protocol esp integrity sha-1
      crypto ipsec ikev2 ipsec-proposal ESP-AES-128-SHA
       protocol esp encryption aes
       protocol esp integrity sha-1


      nat (inside,outside) 1 source static SITE2 SITE2 destination static SITE1 SITE1
      access-list s2svpn_to_site1 line 10 extended permit ip object-group SITE2 object-group SITE1 log default

      access-list inside_access_in line 1 extended permit tcp object-group SITE2 object-group SITE1 eq ssh log default

      access-list outside_access_in line 1 extended permit tcp object-group SITE1 object-group SITE2 eq ssh log default
      access-list outside_access_in line 2 extended permit icmp object-group SITE1 object-group SITE2 log default


      crypto map outside_map 1 match address s2svpn_to_site1
      crypto map outside_map 1 set pfs group14
      crypto map outside_map 1 set peer 10.255.1.2
      crypto map outside_map 1 set ikev1 transform-set ESP-AES-256-SHA
      crypto map outside_map 1 set ikev2 ipsec-proposal ESP-AES-256-SHA
      crypto map outside_map 1 set reverse-route

      crypto map outside_map interface outside



      crypto ikev2 policy 10
       encryption aes-256
       integrity sha256
       group 14
       prf sha256
       lifetime seconds 86400

      crypto ikev2 policy 20
       encryption aes-192
       integrity sha
       group 14
       prf sha
       lifetime seconds 86400

      crypto ikev2 policy 30
       encryption aes
       integrity sha
       group 5
       prf sha
       lifetime seconds 86400

      crypto ikev1 policy 10
       authentication pre-share
       encryption aes-256
       hash sha
       group 14
       lifetime none

      crypto ikev1 policy 20
       authentication pre-share
       encryption aes-192
       hash sha
       group 14
       lifetime none

      crypto ikev1 policy 30
       authentication pre-share
       encryption aes
       hash sha
       group 5
       lifetime none

      crypto ikev2 enable outside
      crypto ikev1 enable outside



      group-policy S2S-VPN-IKEV1 internal
      group-policy S2S-VPN-IKEV1 attributes
       vpn-tunnel-protocol ikev1

      group-policy S2S-VPN-IKEV2 internal
      group-policy S2S-VPN-IKEV2 attributes
       vpn-tunnel-protocol ikev2


      tunnel-group 10.255.1.2 type ipsec-l2l
      tunnel-group 10.255.1.2 general-attributes
       default-group-policy S2S-VPN-IKEV2

      tunnel-group 10.255.1.2 ipsec-attributes
       ikev1 pre-shared-key SecureVPNKeyv1
       ikev2 remote-authentication pre-shared-key SecureVPNKeyv2
       ikev2 local-authentication pre-shared-key SecureVPNKeyv2
    cpu_limit: 100
    cpus: 1
    data_volume: 0
    hide_links: false
    id: n10
    label: Site2-FW
    node_definition: asav
    ram: 2048
    tags: []
    x: 142
    y: 275
    interfaces:
      - id: i0
        label: Management0/0
        slot: 0
        type: physical
      - id: i1
        label: GigabitEthernet0/0
        slot: 1
        type: physical
      - id: i2
        label: GigabitEthernet0/1
        slot: 2
        type: physical
  - boot_disk_size: 16
    configuration: |-
      # this is a shell script which will be sourced at boot
      hostname InternetHost
      # configurable user account
      USERNAME=cisco
      PASSWORD=cisco
      # ip
      ip addr add 10.255.255.11/24 dev eth0
      ip link set dev eth0 up
      ip route add 0.0.0.0/0 via 10.255.255.1
    cpu_limit: 100
    cpus: 1
    data_volume: 0
    hide_links: false
    id: n11
    label: InternetHost
    node_definition: desktop
    ram: 512
    tags: []
    x: 35
    y: 500
    interfaces:
      - id: i0
        label: eth0
        slot: 0
        type: physical
  - boot_disk_size: 0
    configuration: ums-53e5aae6-cd
    cpu_limit: 100
    cpus: 0
    data_volume: 0
    hide_links: false
    id: n12
    label: Internet-SW
    node_definition: unmanaged_switch
    ram: 0
    tags: []
    x: -86
    y: 401
    interfaces:
      - id: i0
        label: port0
        slot: 0
        type: physical
      - id: i1
        label: port1
        slot: 1
        type: physical
      - id: i2
        label: port2
        slot: 2
        type: physical
      - id: i3
        label: port3
        slot: 3
        type: physical
      - id: i4
        label: port4
        slot: 4
        type: physical
      - id: i5
        label: port5
        slot: 5
        type: physical
      - id: i6
        label: port6
        slot: 6
        type: physical
      - id: i7
        label: port7
        slot: 7
        type: physical
