Вобщим ситуация такая на работе стоит Cisco ASA 5510 , взяли железку для тестирования но т.к она одна решил поиграться и реализовать тунель между Cisco ASA 5510 и Cisco IOS 7200 которая находится у меня в GNS3. вообщем на работе между собой они пингуются , а вот решил приехал домой законектился к работе по VPN , и пробую пропинговать c CISCO 7200 на ASупинги не проходят
привожу конфиги
значет ifconfig с моего пк
eth0 Link encap:Ethernet HWaddr e8:11:32:cb:74:df
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:1753535 errors:0 dropped:0 overruns:0 frame:0
TX packets:692055 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1369384659 (1.2 GiB) TX bytes:94257837 (89.8 MiB)
Interrupt:44 Base address:0xa000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:90509 errors:0 dropped:0 overruns:0 frame:0
TX packets:90509 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:8716343 (8.3 MiB) TX bytes:8716343 (8.3 MiB)
ppp0 Link encap:Point-to-Point Protocol
inet addr:192.168.10.133 P-t-P:192.168.10.124 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1400 Metric:1
RX packets:2450 errors:0 dropped:0 overruns:0 frame:0
TX packets:2421 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:137093 (133.8 KiB) TX bytes:101933 (99.5 KiB)
tap0 Link encap:Ethernet HWaddr c2:8c:4c:41:3e:d1
inet addr:192.168.12.2 Bcast:192.168.12.255 Mask:255.255.255.0
inet6 addr: fe80::c08c:4cff:fe41:3ed1/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1949 errors:0 dropped:75 overruns:0 frame:0
TX packets:1722 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:435596 (425.3 KiB) TX bytes:149822 (146.3 KiB)
wlan0 Link encap:Ethernet HWaddr 78:92:9c:4e:05:1c
inet addr:192.168.1.5 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::7a92:9cff:fe4e:51c/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:573846 errors:0 dropped:0 overruns:0 frame:0
TX packets:464975 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:637476323 (607.9 MiB) TX bytes:244281591 (232.9 MiB)
tap0 - это интерфейс который объеденяет виртуальную среду GNS3 с реальностью
ppp0 - это интерфейс поднятный до моего офиса в котором я работаю
root@rtk:/home/nightguide# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.1.1 0.0.0.0 UG 0 0 0 wlan0
80.66.69.2 192.168.1.1 255.255.255.255 UGH 0 0 0 wlan0
80.66.69.2 192.168.1.1 255.255.255.255 UGH 0 0 0 wlan0
link-local * 255.255.0.0 U 1000 0 0 wlan0
192.168.1.0 * 255.255.255.0 U 2 0 0 wlan0
192.168.10.0 gate.sib.r-styl 255.255.255.0 UG 0 0 0 ppp0
gate.sib.r-styl * 255.255.255.255 UH 0 0 0 ppp0
192.168.10.124 * 255.255.255.255 UH 0 0 0 ppp0
192.168.12.0 * 255.255.255.0 U 0 0 0 tap0
конфиг АСЫ
: Saved
: Written by enable_15 at 14:46:43.929 UTC Fri Jul 12 2013
!
ASA Version 8.2(5)
!
hostname virginpussy
domain-name R-style
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
nameif outside
security-level 100
ip address dhcp --получает ip 192.168.10.224
!
interface Ethernet0/1
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
ftp mode passive
dns server-group DefaultDNS
domain-name R-style
same-security-traffic permit inter-interface
access-list IN_ACL extended permit ip any any
pager lines 24
logging asdm informational
mtu outside 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-713.bin
no asdm history enable
arp timeout 14400
nat (outside) 0 0.0.0.0 0.0.0.0
access-group IN_ACL in interface outside
route outside 192.168.12.0 255.255.255.0 192.168.10.133 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set MyTSet esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map CMap 10 set peer 192.168.12.1
crypto map CMap 10 set transform-set MyTSet
crypto map CMap interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption des
hash md5
group 1
lifetime 3600
telnet 192.168.1.0 255.255.255.0 management
telnet timeout 5
ssh 192.168.10.0 255.255.255.0 outside
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username ssh password F.cFJNRQLTkjxzLz encrypted privilege 15
tunnel-group 192.168.12.1 type ipsec-l2l
tunnel-group 192.168.12.1 ipsec-attributes
pre-shared-key SECRETkey
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:99ad51603e21cb49e36fc4661548ab33
: end
конфиг роутера 7200
!
version 12.3
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
ip subnet-zero
!
!
!
ip cef
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
crypto isakmp policy 10
hash md5
authentication pre-share
lifetime 3600
crypto isakmp key SECRETkey address 192.168.10.224
!
!
crypto ipsec transform-set MyTS esp-des esp-md5-hmac
!
!
crypto map CMap 10 ipsec-isakmp
! Incomplete
set peer 192.168.10.224
set transform-set MyTS
match address 101
!
!
!
!
interface FastEthernet0/0
no ip address
shutdown
duplex half
!
interface FastEthernet1/0
ip address 192.168.12.1 255.255.255.0
duplex auto
speed auto
crypto map CMap
!
interface FastEthernet1/1
no ip address
shutdown
duplex auto
speed auto
!
ip default-gateway 192.168.12.2
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.11.2
no ip http server
no ip http secure-server
!
!
!
!
!
!
!
!
!
gatekeeper
shutdown
!
!
line con 0
stopbits 1
line aux 0
stopbits 1
line vty 0 4
login
!
!
end
пинги не ходят ни туда ни обратно , а когда в офисе работаю то все ок , в чем может быть проблема великие гуру