----------------------------RSC--------------------crypto isakmp enable

crypto isakmp policy 10

encryption aes 256
hash sha
authentication pre-share
group 5
lifetime 3600
crypto isakmp key sistemasuni address 2.2.2.9
---------------------------------------------------------crypto ipsec transform-set 50 esp-aes 256 esp-sha-hmac
---------------------------------------------------------crypto ipsec security-association lifetime seconds 1800
----------------------------------------------------------access-list 100 permit ip 172.16.10.0 0.0.0.255 192.168.0.0 0.0.0.255
-------------------------------------------------------------------crypto map CMAP 10 ipsec-isakmp
match address 100
set peer 2.2.2.9
set pfs group5
set transform-set 50
set security-association lifetime seconds 900
---------------------------------------------------------interface s0/0
crypto map CMAP
-----------------------------------------------------------------------RS1---------------------crypto isakmp enable
crypto isakmp policy 10
encryption aes 256
hash sha
authentication pre-share
group 5
lifetime 3600
crypto isakmp key sistemasuni address 2.2.2.1
---------------------------------------------------------crypto ipsec transform-set 50 esp-aes 256 esp-sha-hmac
---------------------------------------------------------crypto ipsec security-association lifetime seconds 1800
----------------------------------------------------------access-list 100 permit ip 192.168.0.0 0.0.0.255 172.16.10.0 0.0.0.255
-------------------------------------------------------------------crypto map CMAP 10 ipsec-isakmp
match address 100
set peer 2.2.2.1
set pfs group5
set transform-set 50
set security-association lifetime seconds 900
---------------------------------------------------------interface s0/2
crypto map CMAP

----------------------------------------------------------------------------------------------RSC#show running-config

!
interface FastEthernet0/0
ip address 172.16.10.1 255.255.255.0
ip nat inside
!
interface Serial0/0
ip address 2.2.2.1 255.255.255.252
ip nat outside
ip route 0.0.0.0 0.0.0.0 Serial0/0 2.2.2.2
!
ip nat inside source list 111 interface Serial0/0 overload
!
access-list 111 deny ip 172.16.10.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 111 permit ip 172.16.10.0 0.0.0.255 any
!
!
end