Добрый вечер Коллеги!
Столкнулся с следующей проблемой (самостоятельно решить не получается):
Центральный офис: 10.0.4.0/24 - Cisco 871
Удаленный Офис: 10.0.5.0/24 - Cisco 881
В центральном офисе был настроен Remote VPN Access для Cisco VPN Клиентов.
Добавляю впн лан-2-лан статический, соответственно, удаляю старую криптомапу создаю 2 новые, объединяю, вешаю на внешний интерфейс, указываю пиры, убираю НАТ с внутренних подсетей. (конфиги приведены ниже).
Результат - LAN-2-LAN - не работает,
sh crypto session detail (с терминирующей циски в центральном офисе) говорит следующее:
Interface: FastEthernet4
Session status: DOWN
Peer: 172.19.124.199 port 500 fvrf: (none) ivrf: (none)
Desc: (none)
Phase1_id: (none)
IPSEC FLOW: permit ip 10.0.4.0/255.255.255.0 10.0.5.0/255.255.255.0
Active SAs: 0, origin: crypto map
Inbound: #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0sh crypto ipsec sa (с нее же)
#sh crypto ipsec sa
interface: FastEthernet4
Crypto map tag: clientmap, local addr 172.18.124.159
protected vrf: (none)
local ident (addr/mask/prot/port): (10.0.4.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.0.5.0/255.255.255.0/0/0)
current_peer 85.21.181.194 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 172.18.124.159, remote crypto endpt.: 172.19.124.199
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet4
current outbound spi: 0x0(0)
Конфиг Циски с ЦО (принимающая подключение):
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime localtime
no service password-encryption
hostname rtr01
boot-start-marker
boot-end-marker
no logging console
enable secret 5 *хэш*
aaa new-model
aaa authentication login userlist local
aaa authorization network vpn-clients local
aaa session-id common
clock timezone MSK 3
clock summer-time MSD recurring last Sun Mar 2:00 last Sun Oct 2:00
dot11 syslog
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 10.0.16.1 10.0.16.50
ip dhcp pool WiFi
network 10.0.16.0 255.255.255.0
default-router 10.0.16.1
dns-server 10.0.4.6
no ip domain lookup
ip name-server 10.0.4.6
username (список юзаков с паролями)
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp policy 10
hash md5
authentication pre-share
crypto isakmp key *ключ* address 172.19.124.199 no-xauth
crypto isakmp client configuration address-pool local dynpool
crypto isakmp xauth timeout 60
crypto isakmp client configuration group vpn-clients
key *ключ*
dns 10.0.4.6
domain *мойдомен*.com
pool dynpool
acl 150
netmask 255.255.255.0
crypto ipsec transform-set transform-2 esp-3des esp-md5-hmac
crypto dynamic-map dynmap 10
set transform-set transform-2
reverse-route
crypto map clientmap client authentication list userlist
crypto map clientmap isakmp authorization list vpn-clients
crypto map clientmap client configuration address respond
crypto map clientmap 1 ipsec-isakmp
set peer 172.19.124.199
set transform-set transform-2
match address 100
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
archive
log config
hidekeys
interface FastEthernet0
interface FastEthernet1
interface FastEthernet2
switchport access vlan 2
interface FastEthernet3
switchport access vlan 2
interface FastEthernet4
description -=Internet=-
ip address 172.18.124.159 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
no cdp enable
crypto map clientmap
interface Vlan1
description -=Internal Network=-
ip address 10.0.4.1 255.255.255.0
ip nat inside
ip virtual-reassembly
interface Vlan2
description -=WiFi=-
ip address 10.0.16.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip local pool dynpool 10.0.18.20 10.0.18.40
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 172.18.124.158
no ip http server
no ip http secure-server
ip nat inside source list nat1 interface FastEthernet4 overload
ip nat inside source list nat10 interface FastEthernet4 overload
ip nat inside source list nat15 interface FastEthernet4 overload
ip access-list extended nat1
deny ip 10.0.4.0 0.0.0.255 10.0.18.0 0.0.0.255
permit ip 10.0.4.0 0.0.0.255 any
ip access-list extended nat10
deny ip 10.0.16.0 0.0.0.255 10.0.18.0 0.0.0.255
permit ip 10.0.16.0 0.0.0.255 any
ip access-list extended nat15
deny ip 10.0.4.0 0.0.0.255 10.0.5.0 0.0.0.255
permit ip 10.0.4.0 0.0.0.255 any
access-list 100 permit ip 10.0.4.0 0.0.0.255 10.0.5.0 0.0.0.255
access-list 150 permit ip 10.0.4.0 0.0.0.255 any
access-list 150 permit ip 10.0.16.0 0.0.0.255 any
snmp-server community public RO
end
rtr01#
Конфиг циски Доп Офиса (подключающаяся):
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname rtr02
boot-start-marker
boot system flash c880data-universalk9-mz.124-24.T.bin
boot-end-marker
logging message-counter syslog
aaa new-model
aaa session-id common
memory-size iomem 10
ip source-route
ip dhcp excluded-address 10.0.5.1 10.0.5.70
ip dhcp pool dop
network 10.0.5.0 255.255.255.0
dns-server 10.0.4.6
default-router 10.0.5.1
ip cef
ip domain name *мойдомен*.com
no ipv6 cef
crypto isakmp policy 10
hash md5
authentication pre-share
crypto isakmp key *ключ* address 172.18.124.159
crypto ipsec transform-set transform-2 esp-3des esp-md5-hmac
crypto map statmap 10 ipsec-isakmp
set peer 172.18.124.159
set transform-set transform-2
match address 100
archive
log config
hidekeys
interface FastEthernet0
interface FastEthernet1
interface FastEthernet2
interface FastEthernet3
interface FastEthernet4
ip address 172.19.124.199 255.255.255.252
ip broadcast-address 0.0.0.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map statmap
!
interface Vlan1
description -=internal LAN=-
ip address 10.0.5.1 255.255.255.0
ip broadcast-address 10.0.5.255
ip nat inside
ip virtual-reassembly
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 172.19.124.198
no ip http server
no ip http secure-server
ip nat inside source list nat15 interface FastEthernet4 overload
ip access-list extended nat15
deny ip 10.0.5.0 0.0.0.255 10.0.4.0 0.0.0.255
permit ip 10.0.5.0 0.0.0.255 any
access-list 100 permit ip 10.0.5.0 0.0.0.255 10.0.4.0 0.0.0.255
control-plane
exception data-corruption buffer truncate
scheduler max-task-time 5000
end
Собственно говоря вооот. Коллеги, помогите, пожалйуста разобраться в ситуации.
PS: Удаленные VPN Clients (динамическая криптомапа) - нормально подключаются.
Вариант для распечатки
(ok) on 22-Ноя-10, 19:28 
