! Generated by Network Security Policy Compiler, version 2.170

! [ BEGIN router:protect_web ]
! [ Model = PIX ]
! [ Routing ]
! route network:management -> interface:mngt.service_lan
route outside 10.1.11.0 255.255.255.0	10.10.1.6
! route network:0/0 -> interface:to_branch.service_lan
route outside 0.0.0.0 0.0.0.0	10.10.1.1
! [ ACL ]

! interface:protect_web.service_lan
! permit src=network:0/0; dst=interface:protect_web.service_lan; srv=service:ping;
icmp permit 0.0.0.0 0.0.0.0 8 outside
! permit src=network:0/0; dst=interface:protect_web.service_lan; srv=service:pong;
icmp permit 0.0.0.0 0.0.0.0 0 outside
! permit src=network:management; dst=interface:protect_web.service_lan; srv=auto_srv:ip;
! permit src=interface:mngt.service_lan; dst=interface:protect_web.service_lan; srv=auto_srv:IPSec_AH;
! permit src=interface:mngt.service_lan; dst=interface:protect_web.service_lan; srv=auto_srv:IPSec_ESP;
! permit src=interface:mngt.service_lan; dst=interface:protect_web.service_lan; srv=auto_srv:IPSec_IKE;
! permit src=network:trans; dst=interface:protect_web.service_lan; srv=auto_srv:ip;
! permit src=network:branch; dst=network:web_servers; srv=auto_srv:ip;
access-list outside_in permit ip 10.1.1.0 255.255.255.0  10.20.1.0 255.255.255.0 
! deny src=network:0/0; dst=network:0/0; srv=auto_srv:ip;
access-list outside_in deny ip any  any 
access-group outside_in in interface outside

! interface:protect_web.web_servers
! permit src=network:0/0; dst=interface:protect_web.web_servers; srv=service:ping;
icmp permit 0.0.0.0 0.0.0.0 8 inside
! permit src=network:0/0; dst=interface:protect_web.web_servers; srv=service:pong;
icmp permit 0.0.0.0 0.0.0.0 0 inside
! deny src=network:0/0; dst=network:0/0; srv=auto_srv:ip;
access-list inside_in deny ip any  any 
access-group inside_in in interface inside

! [ Crypto ]
isakmp identity address
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption aes192
isakmp policy 1 hash md5
isakmp policy 1 group 2
isakmp policy 1 lifetime 43200
crypto ipsec transform-set Trans ah-sha-hmac esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 3600
! permit src=interface:protect_web.service_lan; dst=network:management; srv=auto_srv:tcp;
access-list crypto-outside-1 permit tcp host 10.10.1.5 eq 23 10.1.11.0 255.255.255.0 
crypto map crypto-outside 1 ipsec-isakmp
crypto map crypto-outside 1 match address crypto-outside-1
crypto map crypto-outside 1 set peer 10.10.1.6
crypto map crypto-outside 1 set transform-set Trans
crypto map crypto-outside 1 set pfs group1
! permit src=network:web_servers; dst=network:branch; srv=auto_srv:ip;
access-list crypto-outside-2 permit ip 10.20.1.0 255.255.255.0  10.1.1.0 255.255.255.0 
crypto map crypto-outside 2 ipsec-isakmp
crypto map crypto-outside 2 match address crypto-outside-2
crypto map crypto-outside 2 set peer 172.17.1.1
crypto map crypto-outside 2 set transform-set Trans
crypto map crypto-outside 2 set pfs group1
crypto map crypto-outside interface outside
isakmp enable outside
crypto map crypto-inside interface inside
isakmp enable inside
! [ Static ]
! Security levels: outside < inside
static (inside,outside) 10.20.1.0 10.20.1.0 netmask 255.255.255.0
nat (inside) 0 0.0.0.0 0.0.0.0
! [ END router:protect_web ]