Исходное сообщение
"Ip default-network" Отправлено momo, 24-Фев-09 14:00
>[оверквотинг удален] >>>>tcp 1.1.1.1:3187 192.168.16.2:3187  194.67.57.126:80   194.67.57.126:80 >> >>но пакеты обратно видимо не возвращаются хотя никаких спсиков досутупа нет ни >>на филиале ни на центре (убрал временно для теста) >> >>кто может навести на мысль где пакеты дропаются и почему обратно в >>туннель не идут? > >Обратный маршрут есть? >Покажите новые конфиги центра и филиала. вот все что есть.... Центр crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key 6 xxxxxxxxxxxx address 10.10.3.254 crypto ipsec transform-set temp esp-3des esp-md5-hmac ! ! crypto map vpn 10 ipsec-isakmp set peer 10.10.3.254 set transform-set temp match address Center_to_Filial interface Tunnel0 ip address 172.17.1.1 255.255.255.0 ip tcp adjust-mss 1460 tunnel source Vlan4 tunnel destination 10.10.3.254 ! interface FastEthernet0/0 description Local ip address 192.168.10.1 255.255.255.0 ip nat inside ip virtual-reassembly duplex auto speed auto ! interface Vlan3 ip address 1.1.1.1 255.255.255.248 ip nat outside ip virtual-reassembly crypto map mode ! interface Vlan4 description VPN ip address 10.10.1.254 255.255.255.0 crypto map vpn router eigrp 10 redistribute static network 172.17.1.0 0.0.0.255 network 172.17.2.0 0.0.0.255 network 172.17.3.0 0.0.0.255 network 172.17.0.0 network 192.168.0.0 network 192.168.10.0 network 192.168.254.0 distribute-list denylist out no auto-summary ! ip local pool local 192.168.30.0 192.168.30.255 ip route 0.0.0.0 0.0.0.0 1.1.1.2 ip route 10.0.0.0 255.0.0.0 10.10.1.1 ip route 192.168.3.0 255.255.255.0 192.168.10.11 ip route 192.168.200.0 255.255.252.0 192.168.254.2 ! ! ip http server no ip http secure-server ip nat pool Comstar_2 1.1.1.1 1.1.1.1 netmask 255.255.255.248 ip nat inside source list new pool Comstar_2 overload ip access-list standard denylist permit 192.168.0.0 0.0.15.255 permit 192.168.254.0 0.0.0.255 ! ip access-list extended Center_to_Filial permit gre host 10.10.1.254 host 10.10.3.254 ip access-list extended new deny ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255 deny ip 192.168.10.0 0.0.0.255 192.168.12.0 0.0.0.255 permit ip 192.168.10.0 0.0.0.255 any permit ip 192.168.0.0 0.0.0.255 any permit ip 192.168.16.0 0.0.1.255 any Таблица маршрутизации на центре Gateway of last resort is 1.1.1.2 to network 0.0.0.0 192.168.30.0/32 is subnetted, 2 subnets S 192.168.30.3 [1/0] via 79.120.43.3 S 192.168.30.0 [1/0] via 79.120.45.134 C 192.168.10.0/24 is directly connected, FastEthernet0/0 1.1.1.0/29 is subnetted, 1 subnets C 212.248.90.48 is directly connected, Vlan3 172.17.0.0/24 is subnetted, 3 subnets C 172.17.1.0 is directly connected, Tunnel0 C 172.17.3.0 is directly connected, Tunnel2 C 172.17.2.0 is directly connected, Tunnel1 D 192.168.11.0/24 [90/297246976] via 172.17.1.2, 00:24:16, Tunnel0 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C 10.10.1.0/24 is directly connected, Vlan4 S 10.0.0.0/8 [1/0] via 10.10.1.1 C 192.168.0.0/24 is directly connected, Vlan2 C 192.168.254.0/24 is directly connected, FastEthernet0/1 S 192.168.3.0/24 [1/0] via 192.168.10.11 S* 0.0.0.0/0 [1/0] via 212.248.90.49 S 192.168.200.0/22 [1/0] via 192.168.254.2 D 192.168.16.0/23 [90/297246976] via 172.17.1.2, 00:24:16, Tunnel0 D 192.168.18.0/23 [90/297246976] via 172.17.2.2, 00:50:33, Tunnel1 Center# Center# На филиале crypto isakmp policy 10 encr 3des hash md5 authentication pre-share group 2 crypto isakmp key 6 xxxxxxxxxx address 10.10.1.254 ! ! crypto ipsec transform-set temp esp-3des esp-md5-hmac ! crypto map vpn 10 ipsec-isakmp set peer 10.10.1.254 set transform-set temp match address Filial_to_Center ! ! ! interface Tunnel0 ip address 172.17.1.2 255.255.255.0 ip tcp adjust-mss 1460 tunnel source FastEthernet0/1 tunnel destination 10.10.1.254 ! interface FastEthernet0/0 ip address 192.168.11.254 255.255.255.0 secondary ip address 192.168.16.1 255.255.254.0 duplex auto speed auto ! interface FastEthernet0/1 description VPN ip address 10.10.3.254 255.255.255.0 duplex auto speed auto crypto map vpn ! router eigrp 10 network 172.17.0.0 network 192.168.11.0 network 192.168.16.0 0.0.1.255 no auto-summary ! ip route 10.0.0.0 255.0.0.0 10.10.3.1 ip route 192.168.200.0 255.255.252.0 192.168.254.2 ! ip http server no ip http secure-server ! ip access-list extended Filial_to_Center permit gre host 10.10.3.254 host 10.10.1.254 Таблица маршрутизации Gateway of last resort is 172.17.1.1 to network 0.0.0.0 D 192.168.10.0/24 [90/297246976] via 172.17.1.1, 00:25:36, Tunnel0 172.17.0.0/24 is subnetted, 3 subnets C 172.17.1.0 is directly connected, Tunnel0 D 172.17.3.0 [90/310044416] via 172.17.1.1, 00:25:36, Tunnel0 D 172.17.2.0 [90/310044416] via 172.17.1.1, 00:25:36, Tunnel0 C 192.168.11.0/24 is directly connected, FastEthernet0/0 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C 10.10.3.0/24 is directly connected, FastEthernet0/1 S 10.0.0.0/8 [1/0] via 10.10.3.1 D 192.168.0.0/24 [90/297246976] via 172.17.1.1, 00:25:36, Tunnel0 D 192.168.254.0/24 [90/297246976] via 172.17.1.1, 00:25:36, Tunnel0 D EX 192.168.3.0/24 [170/297246976] via 172.17.1.1, 00:25:36, Tunnel0 D*EX 0.0.0.0/0 [170/297246976] via 172.17.1.1, 00:25:36, Tunnel0 S 192.168.200.0/22 [1/0] via 192.168.254.2 C 192.168.16.0/23 is directly connected, FastEthernet0/0 D 192.168.18.0/23 [90/310046976] via 172.17.1.1, 00:25:36, Tunnel0 Как вы видите маршрут по умолчанию в туннель есть ...Также видно что списков которые могли бы ограничить траффик нет вообще....