前提：無加密通道時資料已能正常通訊。以下為雙邊 PIX 配置完整步驟與指令。

Step 1：允許外部介面進入 IPsec 流量

access-list out_in permit 50 any host 222.254.240.193
access-list out_in permit 51 any host 222.254.240.193
access-list out_in permit udp any host 222.254.240.193 eq 500
或簡單用：sysopt connection permit-ipsec

Step 2：外部介面啟用 ISAKMP

isakmp enable outside

Step 3：配置 IKE 策略參數

isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 2400
isakmp policy 10 authentication pre-share
（或 authentication rsa-sig 啟用 RSA 數位簽章）
show isakmp policy  查看策略

Step 4：定義預共享金鑰

pix1(config)# isakmp key mykey address 202.103.96.112 netmask 255.255.255.255
pix2(config)# isakmp key mykey address 222.254.240.193 netmask 255.255.255.255
全通道共用：isakmp key pubkey address 0.0.0.0 netmask 0.0.0.0

Step 5：定義加密流量 ACL（雙向對稱）

pix1: access-list crypto_date permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
pix2: access-list crypto_date permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

Step 6：定義 Transform Set（雙邊相同）

crypto ipsec transform-set myset esp-des esp-sha-hmac
show crypto ipsec transform-set

Step 7：NAT 豁免（0 代表不 NAT）

nat 0 access-list crypto_date

Step 8：配置 Crypto Map 綁定 Policy + Transform Set + Peer

pix1: crypto map pix1map 10 ipsec-isakmp
      crypto map pix1map 10 match address crypto_date
      crypto map pix1map 10 set peer 202.103.96.112
      crypto map pix1map 10 set transform-set myset

pix2: crypto map pix2map 10 ipsec-isakmp
      crypto map pix2map 10 match address crypto_date
      crypto map pix2map 10 set peer 222.254.240.193
      crypto map pix2map 10 set transform-set myset

Step 9：將 Crypto Map 綁定至外部介面

crypto map pix1map interface outside
crypto map pix2map interface outside

驗證指令

show crypto map
show crypto ipsec sa