! Generated by Network Security Policy Compiler, version 2.170

! [ BEGIN router:branch ]
! [ Model = IOS_FW ]
! [ Routing ]
! route network:0/0 -> interface:to_branch.trans
ip route 0.0.0.0 0.0.0.0	172.17.1.2
! [ ACL ]
! interface:branch.branch
ip access-list extended FastEthernet0_in
! permit src=network:0/0; dst=interface:branch.branch; srv=service:ping;
 permit icmp any  host 10.1.1.2 8
! permit src=network:0/0; dst=interface:branch.branch; srv=service:pong;
 permit icmp any  host 10.1.1.2 0
! deny src=network:0/0; dst=interface:branch.branch; srv=auto_srv:ip;
 deny ip any  host 10.1.1.2 
! deny src=network:0/0; dst=interface:branch.trans; srv=auto_srv:ip;
 deny ip any  host 172.17.1.1 
! permit src=host:joe; dst=host:extranet; srv=service:http;
 permit tcp host 10.1.1.21  10.20.1.12 0.0.0.3 eq 80
! permit src=host:joe; dst=host:extranet; srv=service:http;
 permit tcp host 10.1.1.21  10.20.1.16 0.0.0.3 eq 80
! permit src=host:joe; dst=host:extranet; srv=service:http;
 permit tcp host 10.1.1.21  10.20.1.10 0.0.0.1 eq 80
! permit src=host:bill; dst=host:extranet; srv=service:http;
 permit tcp host 10.1.1.23  10.20.1.12 0.0.0.3 eq 80
! permit src=host:bill; dst=host:extranet; srv=service:http;
 permit tcp host 10.1.1.23  10.20.1.16 0.0.0.3 eq 80
! permit src=host:bill; dst=host:extranet; srv=service:http;
 permit tcp host 10.1.1.23  10.20.1.10 0.0.0.1 eq 80
! permit src=host:rick; dst=host:extranet; srv=service:http;
 permit tcp host 10.1.1.25  10.20.1.12 0.0.0.3 eq 80
! permit src=host:rick; dst=host:extranet; srv=service:http;
 permit tcp host 10.1.1.25  10.20.1.16 0.0.0.3 eq 80
! permit src=host:rick; dst=host:extranet; srv=service:http;
 permit tcp host 10.1.1.25  10.20.1.10 0.0.0.1 eq 80
! deny src=network:0/0; dst=network:0/0; srv=auto_srv:ip;
 deny ip any  any 
interface FastEthernet0
 ip access-group FastEthernet0_in in

! interface:branch.trans
ip access-list extended Serial0_in
! permit src=network:0/0; dst=interface:branch.trans; srv=service:ping;
 permit icmp any  host 172.17.1.1 8
! permit src=network:0/0; dst=interface:branch.trans; srv=service:pong;
 permit icmp any  host 172.17.1.1 0
! permit src=host:netspoc; dst=interface:branch.trans; srv=service:telnet;
 permit tcp host 10.1.11.111  host 172.17.1.1 eq 23
! permit src=interface:mngt.service_lan; dst=interface:branch.trans; srv=auto_srv:IPSec_AH;
 permit 51 host 10.10.1.6  host 172.17.1.1 
! permit src=interface:mngt.service_lan; dst=interface:branch.trans; srv=auto_srv:IPSec_ESP;
 permit 50 host 10.10.1.6  host 172.17.1.1 
! permit src=interface:mngt.service_lan; dst=interface:branch.trans; srv=auto_srv:IPSec_IKE;
 permit udp host 10.10.1.6 eq 500 host 172.17.1.1 eq 500
! permit src=interface:protect_web.service_lan; dst=interface:branch.trans; srv=auto_srv:IPSec_AH;
 permit 51 host 10.10.1.5  host 172.17.1.1 
! permit src=interface:protect_web.service_lan; dst=interface:branch.trans; srv=auto_srv:IPSec_ESP;
 permit 50 host 10.10.1.5  host 172.17.1.1 
! permit src=interface:protect_web.service_lan; dst=interface:branch.trans; srv=auto_srv:IPSec_IKE;
 permit udp host 10.10.1.5 eq 500 host 172.17.1.1 eq 500
! permit src=host:logger; dst=interface:branch.trans; srv=auto_srv:udp; stateless
 permit udp host 10.1.11.20 eq 514 host 172.17.1.1 
! deny src=network:0/0; dst=network:0/0; srv=auto_srv:ip;
 deny ip any  any 
interface Serial0
 ip access-group Serial0_in in

! [ Crypto ]
crypto isakmp identity address
crypto isakmp policy 1
 authentication pre-share
 encryption aes192
 hash md5
 group 2
 lifetime 43200
crypto ipsec transform-set Trans ah-sha-hmac esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 3600
interface FastEthernet0
 crypto map crypto-FastEthernet0
ip access-list extended crypto-Serial0-1
! permit src=interface:branch.trans; dst=network:management; srv=auto_srv:tcp;
 permit tcp host 172.17.1.1 eq 23 10.1.11.0 0.0.0.255 
ip access-list extended crypto-filter-Serial0-1
! permit src=host:netspoc; dst=interface:branch.trans; srv=service:telnet;
 permit tcp host 10.1.11.111  host 172.17.1.1 eq 23
crypto map crypto-Serial0 1 ipsec-isakmp
 match address crypto-Serial0-1
 set ip access-group crypto-filter-Serial0-1 in
 set peer 10.10.1.6
 set transform-set Trans
 set pfs group1
ip access-list extended crypto-Serial0-2
! permit src=network:branch; dst=network:web_servers; srv=service:ip;
 permit ip 10.1.1.0 0.0.0.255  10.20.1.0 0.0.0.255 
crypto map crypto-Serial0 2 ipsec-isakmp
 match address crypto-Serial0-2
 set peer 10.10.1.5
 set transform-set Trans
 set pfs group1
interface Serial0
 crypto map crypto-Serial0
! [ END router:branch ]