Добрый день

Есть туннель VPN ipsec между CISCO and Linux. Пинги ходят. Все прекрасно на первый взгляд. Но когда дошло до почты - не проходит. Таймауты выдает. Потом попробовали скачать по ФТП - скорость 234 B/s, и это при канале в 10 мбит. Понятно что что-то не так с каналом ВПН. В первую очередь подозрения упали в сторону MTU, но вот где именно заминка не могу понять.

пробывал
ip tcp adjust-mss 1300
и
crypto ipsec fragmentation before-encryption
на интерфейсе где криптомап - не помогает.

конфиг ВПНа

crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp key SECRETKEY address IP_REMOTE_PEER
crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 60
!
!
crypto ipsec transform-set SITE_TO_SITE esp-3des esp-md5-hmac
mode transport
!
!
crypto map L2TP 1 ipsec-isakmp
set peer IP_REMOTE_PEER
set security-association lifetime seconds 28800
set transform-set SITE_TO_SITE
set pfs group2
match address CRYPTO_ACL_IPSec
crypto map L2TP 20 ipsec-isakmp dynamic L2TP_D
!
interface GigabitEthernet0/0
description Internet interface
ip address IP_LOCAL_EXTERNAL 255.255.255.240
ip access-group 101 in
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip inspect DEFAULT100 out
ip nat outside
ip virtual-reassembly
ip route-cache flow
duplex auto
speed auto
no mop enabled
crypto map L2TP
!
ip access-list extended CRYPTO_ACL_IPSec
remark SDM_ACL Category=20
permit ip 10.1.1.0 0.0.0.255 192.168.0.0 0.0.0.255 log
permit ip 192.168.0.0 0.0.0.255 10.1.1.0 0.0.0.255 log
permit icmp 10.1.1.0 0.0.0.255 192.168.0.0 0.0.0.255 log
permit icmp 192.168.0.0 0.0.0.255 10.1.1.0 0.0.0.255 log

#sh crypto ipsec sa interface GigabitEthernet 0/0
  protected vrf: (none)
   local  ident (addr/mask/prot/port): (10.1.1.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)
   current_peer IP_REMOTE_PEER port 500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 9733, #pkts encrypt: 9733, #pkts digest: 9733
    #pkts decaps: 4740, #pkts decrypt: 4740, #pkts verify: 4740
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 67, #recv errors 0

     local crypto endpt.: IP_LOCAL_EXTERNAL, remote crypto endpt.: IP_REMOTE_PEER
     path mtu 1500, ip mtu 1500
     current outbound spi: 0x4C27431(79852593)

     inbound esp sas:
      spi: 0x44D789B4(1154976180)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Tunnel, }
        conn id: 3007, flow_id: NETGX:7, crypto map: L2TP
        sa timing: remaining key lifetime (k/sec): (4524549/8401)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0x4C27431(79852593)
        transform: esp-3des esp-md5-hmac ,
        in use settings ={Tunnel, }
        conn id: 3011, flow_id: NETGX:11, crypto map: L2TP
        sa timing: remaining key lifetime (k/sec): (4524392/8401)
        IV size: 8 bytes
        replay detection support: Y
        Status: ACTIVE

     outbound ah sas:

     outbound pcp sas:

Если с локальной машины пинговать комп с другой сети:

[root@test]# ping -s 1900 192.168.0.X
PING 192.168.0.X (192.168.0.Х) 1900(1928) bytes of data.
1908 bytes from 192.168.0.X: icmp_seq=1 ttl=63 time=28.3 ms
1908 bytes from 192.168.0.X: icmp_seq=2 ttl=63 time=28.6 ms
1908 bytes from 192.168.0.X: icmp_seq=3 ttl=63 time=29.0 ms

--- 192.168.0.X ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 28.378/28.678/29.003/0.255 ms

[root@test]# ping -M do -s 1416 192.168.0.X
PING 192.168.0.X (192.168.0.X) 1416(1444) bytes of data.
--- 192.168.0.X ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 2999ms

[root@test]# ping -M do -s 1415 192.168.0.X
PING 192.168.0.x (192.168.0.X) 1415(1443) bytes of data.
1423 bytes from 192.168.0.X: icmp_seq=1 ttl=63 time=27.4 ms
1423 bytes from 192.168.0.X: icmp_seq=2 ttl=63 time=26.9 ms

--- 192.168.0.X ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 26.936/27.186/27.437/0.299 ms

Что не так с туннелем?