Sophos-cisco2800

cisco phase1

crypto isakmp policy 10
encryption aes 256
hash md5
lifetime 7800

authentication pre-share

access-list 120 permit ip 10.20.88.0 0.0.0.255 10.20.60.0 0.0.0.255
crypto isakmp key 0 sehr-geheim address 192.168.244.123

cisco phase 2

crypto ipsec transform-set AES256-MD5 esp-aes-256 esp-md5-hmac

phase2 1 & 2 verbinden

crypto map cis-2800-sophos 10 ipsec-isakmp
set peer 192.168.244.123
set transform-set AES256-MD5
match address 120

interface wählen

interface GigabitEthernet 0/0
crypto map cis-2800-sophos

vpn nat ausnahme

ip nat pool dpool 192.168.241.97 192.168.241.97 prefix-length 24
ip nat inside source list local-net-nat interface GigabitEthernet0/0 overload
ip access-list extended local-net-nat
 deny   ip 10.20.88.0 0.0.0.255 10.20.88.0 0.0.255.255
 permit ip 10.20.88.0 0.0.0.255 any
exit