Добрый вечер Коллеги!
Столкнулся с следующей проблемой (самостоятельно решить не получается):
Центральный офис: 10.0.4.0/24 - Cisco 871
Удаленный Офис: 10.0.5.0/24 - Cisco 881
В центральном офисе был настроен Remote VPN Access для Cisco VPN Клиентов.
Добавляю впн лан-2-лан статический, соответственно, удаляю старую криптомапу создаю 2 новые, объединяю, вешаю на внешний интерфейс, указываю пиры, убираю НАТ с внутренних подсетей. (конфиги приведены ниже).
Результат - LAN-2-LAN - не работает,
sh crypto session detail (с терминирующей циски в центральном офисе) говорит следующее:
Interface: FastEthernet4
Session status: DOWN
Peer: 172.19.124.199 port 500 fvrf: (none) ivrf: (none)
      Desc: (none)
      Phase1_id: (none)
  IPSEC FLOW: permit ip 10.0.4.0/255.255.255.0 10.0.5.0/255.255.255.0
        Active SAs: 0, origin: crypto map
        Inbound:  #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
        Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0

sh crypto ipsec sa (с нее же)
#sh crypto ipsec sa

interface: FastEthernet4
    Crypto map tag: clientmap, local addr 172.18.124.159

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.0.4.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (10.0.5.0/255.255.255.0/0/0)
   current_peer 85.21.181.194 port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 172.18.124.159, remote crypto endpt.: 172.19.124.199
     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet4
     current outbound spi: 0x0(0)

Конфиг Циски с ЦО (принимающая подключение):

version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime localtime
no service password-encryption

hostname rtr01

boot-start-marker
boot-end-marker

no logging console
enable secret 5 *хэш*

aaa new-model

aaa authentication login userlist local
aaa authorization network vpn-clients local

aaa session-id common
clock timezone MSK 3
clock summer-time MSD recurring last Sun Mar 2:00 last Sun Oct 2:00

dot11 syslog
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 10.0.16.1 10.0.16.50

ip dhcp pool WiFi
   network 10.0.16.0 255.255.255.0
   default-router 10.0.16.1
   dns-server 10.0.4.6

no ip domain lookup
ip name-server 10.0.4.6

username (список юзаков с паролями)

crypto isakmp policy 1
encr 3des
authentication pre-share
group 2

crypto isakmp policy 10
hash md5
authentication pre-share
crypto isakmp key *ключ* address 172.19.124.199 no-xauth
crypto isakmp client configuration address-pool local dynpool
crypto isakmp xauth timeout 60

crypto isakmp client configuration group vpn-clients
key *ключ*
dns 10.0.4.6
domain *мойдомен*.com
pool dynpool
acl 150
netmask 255.255.255.0

crypto ipsec transform-set transform-2 esp-3des esp-md5-hmac

crypto dynamic-map dynmap 10
set transform-set transform-2
reverse-route

crypto map clientmap client authentication list userlist
crypto map clientmap isakmp authorization list vpn-clients
crypto map clientmap client configuration address respond
crypto map clientmap 1 ipsec-isakmp
set peer 172.19.124.199
set transform-set transform-2
match address 100
crypto map clientmap 10 ipsec-isakmp dynamic dynmap

archive
log config
  hidekeys

interface FastEthernet0

interface FastEthernet1

interface FastEthernet2
switchport access vlan 2

interface FastEthernet3
switchport access vlan 2

interface FastEthernet4
description -=Internet=-
ip address 172.18.124.159 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
no cdp enable
crypto map clientmap

interface Vlan1
description -=Internal Network=-
ip address 10.0.4.1 255.255.255.0
ip nat inside
ip virtual-reassembly

interface Vlan2
description -=WiFi=-
ip address 10.0.16.1 255.255.255.0
ip nat inside
ip virtual-reassembly

ip local pool dynpool 10.0.18.20 10.0.18.40
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 172.18.124.158

no ip http server
no ip http secure-server
ip nat inside source list nat1 interface FastEthernet4 overload
ip nat inside source list nat10 interface FastEthernet4 overload
ip nat inside source list nat15 interface FastEthernet4 overload

ip access-list extended nat1
deny   ip 10.0.4.0 0.0.0.255 10.0.18.0 0.0.0.255
permit ip 10.0.4.0 0.0.0.255 any
ip access-list extended nat10
deny   ip 10.0.16.0 0.0.0.255 10.0.18.0 0.0.0.255
permit ip 10.0.16.0 0.0.0.255 any
ip access-list extended nat15
deny   ip 10.0.4.0 0.0.0.255 10.0.5.0 0.0.0.255
permit ip 10.0.4.0 0.0.0.255 any

access-list 100 permit ip 10.0.4.0 0.0.0.255 10.0.5.0 0.0.0.255
access-list 150 permit ip 10.0.4.0 0.0.0.255 any
access-list 150 permit ip 10.0.16.0 0.0.0.255 any
snmp-server community public RO

end

rtr01#

Конфиг циски Доп Офиса (подключающаяся):

version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption

hostname rtr02

boot-start-marker
boot system flash c880data-universalk9-mz.124-24.T.bin
boot-end-marker

logging message-counter syslog

aaa new-model

aaa session-id common
memory-size iomem 10

ip source-route
ip dhcp excluded-address 10.0.5.1 10.0.5.70

ip dhcp pool dop
   network 10.0.5.0 255.255.255.0
   dns-server 10.0.4.6
   default-router 10.0.5.1

ip cef
ip domain name *мойдомен*.com
no ipv6 cef

crypto isakmp policy 10
hash md5
authentication pre-share
crypto isakmp key *ключ* address 172.18.124.159

crypto ipsec transform-set transform-2 esp-3des esp-md5-hmac

crypto map statmap 10 ipsec-isakmp
set peer 172.18.124.159
set transform-set transform-2
match address 100

archive
log config
  hidekeys

interface FastEthernet0

interface FastEthernet1

interface FastEthernet2

interface FastEthernet3

interface FastEthernet4
ip address 172.19.124.199 255.255.255.252
ip broadcast-address 0.0.0.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map statmap
!
interface Vlan1
description -=internal LAN=-
ip address 10.0.5.1 255.255.255.0
ip broadcast-address 10.0.5.255
ip nat inside
ip virtual-reassembly
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 172.19.124.198
no ip http server
no ip http secure-server

ip nat inside source list nat15 interface FastEthernet4 overload

ip access-list extended nat15
deny   ip 10.0.5.0 0.0.0.255 10.0.4.0 0.0.0.255
permit ip 10.0.5.0 0.0.0.255 any

access-list 100 permit ip 10.0.5.0 0.0.0.255 10.0.4.0 0.0.0.255

control-plane

exception data-corruption buffer truncate
scheduler max-task-time 5000
end

Собственно говоря вооот. Коллеги, помогите, пожалйуста разобраться в ситуации.

PS: Удаленные VPN Clients (динамическая криптомапа) - нормально подключаются.