Уважаемые, прошу помощи. Соединяю два Cisco 2921 и 880
Туннель поднимается, но траффик не идёт. В чём затык? Никак не могу разобраться, понять и взять в толк. Если запустить пинг с Точки, то соответствие появляется в обоих access list'ах (с двух сторон) описывающих "интересный" траффик, но пинга нет. Если запустить пинг из ЦО, то ни пинга ни соответствий.

Конфиг ЦО:

crypto keyring Br1
  pre-shared-key address 1.1.1.1 key Megapass
crypto keyring Br2
  pre-shared-key address 2.2.2.2 key Megapass
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
!
crypto isakmp policy 20
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key Superpass address 0.0.0.0 0.0.0.0
crypto isakmp profile Br1
   keyring Br1
   match identity address 1.1.1.1 255.255.255.255
crypto isakmp profile Br2
   keyring Br2
   match identity address 2.2.2.2 255.255.255.2555
!
!
crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac
mode transport
crypto ipsec transform-set 3DES-MD5 esp-3des esp-md5-hmac
!
crypto ipsec profile HQ-Br1
set transform-set 3DES-SHA
set isakmp-profile Br1
!
crypto ipsec profile HQ-Br2
set transform-set 3DES-SHA
set isakmp-profile Br2
!
!
crypto map VPNRetail 101 ipsec-isakmp
set peer 3.3.3.3
set transform-set 3DES-MD5
match address Shop1
!
!
!
interface Tunnel0
ip address 192.168.100.1 255.255.255.252
ip mtu 1400
ip tcp adjust-mss 1360
tunnel source x.x.x.1
tunnel mode ipsec ipv4
tunnel destination 1.1.1.1
tunnel protection ipsec profile HQ-Br1
!
interface Tunnel1
ip address 192.168.101.1 255.255.255.252
ip mtu 1400
ip tcp adjust-mss 1360
tunnel source x.x.x.1
tunnel mode ipsec ipv4
tunnel destination 2.2.2.2
tunnel protection ipsec profile HQ-Br2
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
---Сеть провайдера---
ip address y.y.y.2 255.255.255.252
duplex auto
speed auto
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/1.1
---Внутренняя сеть---
encapsulation dot1Q 10
ip address 10.10.1.1 255.255.255.0
!
interface GigabitEthernet0/1.2
---Белая сеть выданная провайдером---
encapsulation dot1Q 2
ip address x.x.x.1 255.255.255.224
ip access-group Global_External in
crypto map VPNRetail
!
interface GigabitEthernet0/2
no ip address
duplex auto
speed auto
!
interface Vlan1
no ip address
!
!
router eigrp 1
---Для филиалов---
network 10.10.1.0
network 192.168.100.0
network 192.168.101.0
!
ip forward-protocol nd
!
!
ip route 0.0.0.0 0.0.0.0 y.y.y.1
!
ip access-list extended Global_External
---тут разные правила для хостов сети x.x.x.x 255.255.255.224---
ip access-list extended Shop1
permit ip 10.10.1.0 0.0.0.255 192.168.1.32 0.0.0.31

Конфиг Точки:

crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key Superpass address x.x.x.1
!
!
crypto ipsec transform-set 3DES-MD5 esp-3des esp-md5-hmac
mode tunnel
!
!
!
crypto map VPNHQ 10 ipsec-isakmp
set peer x.x.x.1
set transform-set 3DES-MD5
match address VPN-HQ
!
!
!
!
!
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface FastEthernet4
---Внешняя сеть---
ip address z.z.z.5 255.255.255.0
ip access-group Outbound out
no ip redirects
no ip proxy-arp
ip nat outside
ip inspect INSPECT_OUT out
ip virtual-reassembly in
ip verify unicast reverse-path
duplex auto
speed auto
no cdp enable
crypto map VPNHQ
!
!
!
interface Vlan1
---Внутренняя сеть---
ip address 192.168.1.33 255.255.255.224
ip accounting output-packets
ip nat inside
ip virtual-reassembly in
!
ip forward-protocol nd
!
!
ip nat inside source list NAT_out interface FastEthernet4 overload
ip route 0.0.0.0 0.0.0.0 z.z.z.1
!
ip access-list extended NAT_out
deny   ip 192.168.1.32 0.0.0.31 10.10.1.0 0.0.0.255
permit ip 192.168.1.32 0.0.0.31 any
ip access-list extended Outbound
permit ip any any
ip access-list extended VPN-HQ
permit ip 192.168.1.32 0.0.0.31 10.10.1.0 0.0.0.255