crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key XXXXXXXXXXXXXXXXXXXXXXXXX address 1111111111111111111
crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 10
crypto isakmp aggressive-mode disable
!
!
crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac
mode tunnel
crypto ipsec df-bit clear
!
!
!
crypto map MMMM 10 ipsec-isakmp
description MRV
set peer 11111111111111111111111
set transform-set 3DES-SHA
set pfs group2
match address 2198
reverse-route static
!
!
!
!
!
interface Loopback1
no ip address
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface FastEthernet4
ip address 22222222222222222 255.255.255.252
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
crypto map MMMM
crypto ipsec df-bit clear
!
interface Vlan1
ip address 10.255.98.1 255.255.255.0
ip nat inside
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat inside source list for_pat interface FastEthernet4 overloadip route 0.0.0.0 0.0.0.0 333333333333333333333333333
ip access-list extended for_pat
deny ip 10.250.98.0 0.0.0.255 10.255.0.0 0.0.0.255
permit ip 10.255.98.0 0.0.0.255 any
access-list 2198 remark CCCC
access-list 2198 permit ip 10.255.98.0 0.0.0.255 10.255.0.0 0.0.0.255
!
!
control-plane
!
!
!
line con 0
no modem enable
line aux 0
line vty 0 4
privilege level 15
login local
transport input ssh
!
!
end
ZK#
не могу разобраться с аксес-листами, убираю нат, поднимается туннель, ставлю - пропадает.
подскажите где ошибка???
нужно чтобы работал Nat и поднимался IPsec туннель.
10.255.0.0 0.0.0.255 - сеть на другой стороне тунеля