! Generated by Network Security Policy Compiler, version 2.170

! [ BEGIN router:mngt ]
! [ Model = PIX ]
! [ Routing ]
! route network:trans -> interface:to_branch.service_lan
route outside 172.17.1.0 255.255.255.252	10.10.1.1
! [ ACL ]
object-group network g1
 network-object host 10.10.1.5
 network-object host 172.17.1.1

! interface:mngt.service_lan
! permit src=network:0/0; dst=interface:mngt.service_lan; srv=service:ping;
icmp permit 0.0.0.0 0.0.0.0 8 outside
! permit src=network:0/0; dst=interface:mngt.service_lan; srv=service:pong;
icmp permit 0.0.0.0 0.0.0.0 0 outside
! permit src=interface:branch.trans; dst=interface:mngt.service_lan; srv=auto_srv:IPSec_AH;
! permit src=interface:branch.trans; dst=interface:mngt.service_lan; srv=auto_srv:IPSec_ESP;
! permit src=interface:branch.trans; dst=interface:mngt.service_lan; srv=auto_srv:IPSec_IKE;
! permit src=interface:protect_web.service_lan; dst=interface:mngt.service_lan; srv=auto_srv:IPSec_AH;
! permit src=interface:protect_web.service_lan; dst=interface:mngt.service_lan; srv=auto_srv:IPSec_ESP;
! permit src=interface:protect_web.service_lan; dst=interface:mngt.service_lan; srv=auto_srv:IPSec_IKE;
! permit src=g1; dst=host:netspoc; srv=service:pong;
access-list outside_in permit icmp object-group g1  host 10.1.11.111 0
! permit src=g1; dst=host:logger; srv=service:syslog;
access-list outside_in permit udp object-group g1  host 10.1.11.20 eq 514
! deny src=network:0/0; dst=network:0/0; srv=auto_srv:ip;
access-list outside_in deny ip any  any 
access-group outside_in in interface outside

! interface:mngt.management
! permit src=network:0/0; dst=interface:mngt.management; srv=service:ping;
icmp permit 0.0.0.0 0.0.0.0 8 inside
! permit src=network:0/0; dst=interface:mngt.management; srv=service:pong;
icmp permit 0.0.0.0 0.0.0.0 0 inside
! permit src=host:netspoc; dst=interface:mngt.management; srv=service:telnet;
telnet 10.1.11.111 255.255.255.255 inside
! permit src=host:netspoc; dst=g1; srv=service:telnet;
access-list inside_in permit tcp host 10.1.11.111  object-group g1 eq 23
! permit src=host:netspoc; dst=g1; srv=service:ping;
access-list inside_in permit icmp host 10.1.11.111  object-group g1 8
! deny src=network:0/0; dst=network:0/0; srv=auto_srv:ip;
access-list inside_in deny ip any  any 
access-group inside_in in interface inside

! [ Crypto ]
isakmp identity address
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption aes192
isakmp policy 1 hash md5
isakmp policy 1 group 2
isakmp policy 1 lifetime 43200
crypto ipsec transform-set Trans ah-sha-hmac esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 3600
! permit src=network:management; dst=interface:branch.trans; srv=service:telnet;
access-list crypto-outside-1 permit tcp 10.1.11.0 255.255.255.0  host 172.17.1.1 eq 23
crypto map crypto-outside 1 ipsec-isakmp
crypto map crypto-outside 1 match address crypto-outside-1
crypto map crypto-outside 1 set peer 172.17.1.1
crypto map crypto-outside 1 set transform-set Trans
crypto map crypto-outside 1 set pfs group1
! permit src=network:management; dst=interface:protect_web.service_lan; srv=service:telnet;
access-list crypto-outside-2 permit tcp 10.1.11.0 255.255.255.0  host 10.10.1.5 eq 23
crypto map crypto-outside 2 ipsec-isakmp
crypto map crypto-outside 2 match address crypto-outside-2
crypto map crypto-outside 2 set peer 10.10.1.5
crypto map crypto-outside 2 set transform-set Trans
crypto map crypto-outside 2 set pfs group1
crypto map crypto-outside interface outside
isakmp enable outside
crypto map crypto-inside interface inside
isakmp enable inside
! [ Static ]
! Security levels: outside < inside
static (inside,outside) 10.1.11.0 10.1.11.0 netmask 255.255.255.0
nat (inside) 0 0.0.0.0 0.0.0.0
! [ END router:mngt ]