Исходное сообщение
"два ISP (L2TP, PPPoE) cisco 871, не работает dial on demand" Отправлено blank, 20-Мрт-08 21:49
Добрый всем день! имеется cisco 871 W (Cisco IOS Software, C870 Software (C870-ADVIPSERVICESK9-M), Version 12.4(15)T1) в fa 4 подключена сеть провайдера 1 (основного L2TP), в fa 3 подключен ADSL модем (резервный провайдер PPPoE). настроено автоматическое переключение между провайдерами, перекидывание трафика при падении основного прова работает но имеется одна проблема: интерфейс  Dialer0 не переходит в состояние down когда нет интересного трафика (в access-list 130 попаданий нет, не могу понять в чем проблема. version 12.4 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! aaa new-model ! ! aaa authentication login default local aaa authentication login VPN-login local aaa authentication ppp default local aaa authorization exec default local aaa authorization network default none aaa authorization network VPN local ! ! aaa session-id common clock timezone MSK 3 clock summer-time MSD recurring last Sun Mar 2:00 last Sun Oct 3:00 ! ! ! crypto isakmp keepalive 60 10 periodic crypto isakmp nat keepalive 20 crypto isakmp xauth timeout 60 ! ip cef ! ! no ip dhcp use vrf connected ip dhcp excluded-address 192.168.2.105 192.168.2.255 ip dhcp excluded-address 192.168.2.1 192.168.2.99 ! ip dhcp pool home    import all    network 192.168.2.0 255.255.255.0    default-router 192.168.2.1    dns-server 213.234.192.7 85.21.192.3    lease 15 ! ip domain name corbina.net ip name-server 213.234.192.7 ip inspect name fw http java-list 10 timeout 900 ip inspect name fw https timeout 900 ip inspect name fw realaudio timeout 300 ip inspect name fw streamworks timeout 300 ip inspect name fw vdolive timeout 300 ip inspect name fw cuseeme timeout 300 ip inspect name fw rtsp timeout 300 ip inspect name fw h323 timeout 900 ip inspect name fw sip timeout 900 ip inspect name fw tcp timeout 900 ip inspect name fw udp ip inspect name fw fragment maximum 256 timeout 10 ip inspect name fw-in http java-list 10 timeout 900 ip inspect name fw-in https timeout 900 ip inspect name fw-in esmtp timeout 900 ip inspect name fw-in imap timeout 900 ip inspect name fw-in ftp timeout 900 ip inspect name fw-in nntp timeout 900 ip inspect name fw-in tcp timeout 900 ip inspect name fw-in udp ip inspect name fw-in fragment maximum 256 timeout 10 l2tp-class corbina receive-window 128 ! ! ! track 111 rtr 1 reachability delay down 15 up 10 pseudowire-class class1 encapsulation l2tpv2 protocol l2tpv2 corbina ip local interface FastEthernet4 ! ! ! ! interface FastEthernet0 no cdp enable spanning-tree portfast ! interface FastEthernet1 no cdp enable spanning-tree portfast ! interface FastEthernet2 no cdp enable spanning-tree portfast ! interface FastEthernet3 switchport access vlan 3 no cdp enable spanning-tree portfast ! interface FastEthernet4 ip address dhcp ip access-group 110 in ip nat outside ip inspect fw out ip virtual-reassembly duplex auto speed auto no cdp enable ! interface Dot11Radio0 ip address 192.168.3.1 255.255.255.0 ip nat inside ip virtual-reassembly ip route-cache flow ip tcp adjust-mss 1300 ! encryption mode ciphers tkip ! ssid home ! speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0 station-role root ! interface Virtual-PPP1 ip address negotiated ip access-group 110 in ip mtu 1072 ip nat outside ip inspect fw out ip virtual-reassembly ip tcp adjust-mss 1000 no cdp enable ppp authentication chap callin ppp chap hostname <name> ppp chap password 7 <passwords> pseudowire 85.21.17.249 10 pw-class class1 ! interface Vlan1 ip address 192.168.2.1 255.255.255.0 ip nat inside ip virtual-reassembly ! interface Vlan3 ip address 192.168.10.2 255.255.255.0 pppoe enable group global pppoe-client dial-pool-number 1 ! interface Dialer0 description Stream_backup ip address negotiated ip mtu 1452 ip nat outside ip virtual-reassembly encapsulation ppp ip route-cache flow dialer pool 1 dialer idle-timeout 10 dialer-group 1 no cdp enable ppp authentication chap callin ppp chap hostname <name> ppp chap password <passwords> ! ip route 0.0.0.0 0.0.0.0 Virtual-PPP1 track 111 ip route 0.0.0.0 0.0.0.0 Dialer0 150 ip route 10.0.0.0 255.0.0.0 10.57.24.1 ip route 10.0.0.0 255.255.0.0 10.57.24.1 ! ! no ip http server no ip http secure-server ip dns server ip nat inside source route-map backup-nat interface Dialer0 overload ip nat inside source route-map internet-nat interface Virtual-PPP1 overload ip nat inside source route-map intranet_isp interface FastEthernet4 overload ! ip sla 1 icmp-echo 10.57.24.1 source-interface FastEthernet4 timeout 1000 threshold 40 frequency 3 ip sla schedule 1 life forever start-time now access-list 10 permit any access-list 100 remark ==select ip for NAT - intranet_corbina access-list 100 permit ip 192.168.0.0 0.0.255.255 10.0.0.0 0.255.255.255 access-list 100 remark --VPN_l2tp-VPN_pptp access-list 100 permit ip 192.168.0.0 0.0.255.255 85.21.17.0 0.0.0.255 access-list 100 remark -- access-list 101 remark ==select ip for NAT - internet access-list 101 deny   ip 192.168.0.0 0.0.255.255 10.0.0.0 0.255.255.255 access-list 101 remark --VPN_l2tp-VPN_pptp access-list 101 deny   ip 192.168.0.0 0.0.255.255 85.21.17.0 0.0.0.255 access-list 101 remark -- access-list 102 remark ==select ip for NAT - bakcup access-list 102 permit ip 192.168.0.0 0.0.255.255 any access-list 110 remark === Firewall ACL access-list 110 deny   ip host 0.0.0.0 any access-list 110 deny   ip host 255.255.255.255 any access-list 110 deny   ip 127.0.0.0 0.255.255.255 any access-list 110 deny   ip 172.16.0.0 0.15.255.255 any access-list 110 remark --- L2TP to corbina access-list 110 permit udp any eq 1701 10.0.0.0 0.255.255.255 access-list 110 remark --- DHSP client access-list 110 permit udp 10.0.0.0 0.255.255.255 eq bootps any access-list 110 remark --- Public Services access-list 110 remark --- VPN Networks Access access-list 110 permit ip 192.168.4.0 0.0.0.255 192.168.0.0 0.0.255.255 access-list 110 permit ip 192.168.4.0 0.0.0.255 10.0.0.0 0.255.255.255 access-list 110 remark --- IPSec VPN Service access-list 110 permit udp any any eq isakmp access-list 110 permit esp any any access-list 110 permit udp any any eq non500-isakmp access-list 110 remark --- Permit ICMP Reply access-list 110 permit icmp any any echo-reply access-list 110 permit icmp any any time-exceeded access-list 110 permit icmp any any unreachable access-list 110 permit icmp any any packet-too-big access-list 110 permit icmp any any administratively-prohibited access-list 110 remark --- Permit DNS access-list 110 permit udp any eq domain any access-list 120 permit ip any any access-list 130 remark === select ip for Dialer === access-list 130 permit ip 192.168.0.0 0.0.255.255 any dialer-list 1 protocol ip list 130 ! ! ! route-map intranet_isp permit 10 match ip address 100 ! route-map internet-nat permit 10 match ip address 101 match interface Virtual-PPP1 ! route-map backup-nat permit 10 match ip address 102 match interface Dialer0 ! ! control-plane ! ! line con 0 no modem enable line aux 0 line vty 0 4

Ваше сообщение
Имя*:
EMail:	Для отправки новых сообщений в текущей нити на email укажите знак ! перед адресом, например, !user@host.ru (!! - не показывать email). Более тонкая настройка отправки ответов производится в профиле зарегистрированного участника форума.
Заголовок*:
Сообщение*:	> Добрый всем день! > имеется cisco 871 W (Cisco IOS Software, C870 Software (C870-ADVIPSERVICESK9-M), Version > 12.4(15)T1) в fa 4 подключена сеть провайдера 1 (основного L2TP), в > fa 3 подключен ADSL модем (резервный провайдер PPPoE). > настроено автоматическое переключение между провайдерами, перекидывание трафика при > падении основного прова работает но имеется одна проблема: интерфейс Dialer0 > не переходит в состояние down когда нет интересного трафика (в access-list > 130 попаданий нет, не могу понять в чем проблема. > version 12.4 > no service pad > service timestamps debug datetime msec > service timestamps log datetime msec > no service password-encryption > ! > aaa new-model > ! > ! > aaa authentication login default local > aaa authentication login VPN-login local > aaa authentication ppp default local > aaa authorization exec default local > aaa authorization network default none > aaa authorization network VPN local > ! > ! > aaa session-id common > clock timezone MSK 3 > clock summer-time MSD recurring last Sun Mar 2:00 last Sun Oct 3:00 > ! > ! > ! > crypto isakmp keepalive 60 10 periodic > crypto isakmp nat keepalive 20 > crypto isakmp xauth timeout 60 > ! > ip cef > ! > ! > no ip dhcp use vrf connected > ip dhcp excluded-address 192.168.2.105 192.168.2.255 > ip dhcp excluded-address 192.168.2.1 192.168.2.99 > ! > ip dhcp pool home > import all > network 192.168.2.0 255.255.255.0 > default-router 192.168.2.1 > dns-server 213.234.192.7 85.21.192.3 > lease 15 > ! > ip domain name corbina.net > ip name-server 213.234.192.7 > ip inspect name fw http java-list 10 timeout 900 > ip inspect name fw https timeout 900 > ip inspect name fw realaudio timeout 300 > ip inspect name fw streamworks timeout 300 > ip inspect name fw vdolive timeout 300 > ip inspect name fw cuseeme timeout 300 > ip inspect name fw rtsp timeout 300 > ip inspect name fw h323 timeout 900 > ip inspect name fw sip timeout 900 > ip inspect name fw tcp timeout 900 > ip inspect name fw udp > ip inspect name fw fragment maximum 256 timeout 10 > ip inspect name fw-in http java-list 10 timeout 900 > ip inspect name fw-in https timeout 900 > ip inspect name fw-in esmtp timeout 900 > ip inspect name fw-in imap timeout 900 > ip inspect name fw-in ftp timeout 900 > ip inspect name fw-in nntp timeout 900 > ip inspect name fw-in tcp timeout 900 > ip inspect name fw-in udp > ip inspect name fw-in fragment maximum 256 timeout 10 > l2tp-class corbina > receive-window 128 > ! > ! > ! > track 111 rtr 1 reachability > delay down 15 up 10 > pseudowire-class class1 > encapsulation l2tpv2 > protocol l2tpv2 corbina > ip local interface FastEthernet4 > ! > ! > ! > ! > interface FastEthernet0 > no cdp enable > spanning-tree portfast > ! > interface FastEthernet1 > no cdp enable > spanning-tree portfast > ! > interface FastEthernet2 > no cdp enable > spanning-tree portfast > ! > interface FastEthernet3 > switchport access vlan 3 > no cdp enable > spanning-tree portfast > ! > interface FastEthernet4 > ip address dhcp > ip access-group 110 in > ip nat outside > ip inspect fw out > ip virtual-reassembly > duplex auto > speed auto > no cdp enable > ! > interface Dot11Radio0 > ip address 192.168.3.1 255.255.255.0 > ip nat inside > ip virtual-reassembly > ip route-cache flow > ip tcp adjust-mss 1300 > ! > encryption mode ciphers tkip > ! > ssid home > ! > speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 > 48.0 > 54.0 > station-role root > ! > interface Virtual-PPP1 > ip address negotiated > ip access-group 110 in > ip mtu 1072 > ip nat outside > ip inspect fw out > ip virtual-reassembly > ip tcp adjust-mss 1000 > no cdp enable > ppp authentication chap callin > ppp chap hostname <name> > ppp chap password 7 <passwords> > pseudowire 85.21.17.249 10 pw-class class1 > ! > interface Vlan1 > ip address 192.168.2.1 255.255.255.0 > ip nat inside > ip virtual-reassembly > ! > interface Vlan3 > ip address 192.168.10.2 255.255.255.0 > pppoe enable group global > pppoe-client dial-pool-number 1 > ! > interface Dialer0 > description Stream_backup > ip address negotiated > ip mtu 1452 > ip nat outside > ip virtual-reassembly > encapsulation ppp > ip route-cache flow > dialer pool 1 > dialer idle-timeout 10 > dialer-group 1 > no cdp enable > ppp authentication chap callin > ppp chap hostname <name> > ppp chap password <passwords> > ! > ip route 0.0.0.0 0.0.0.0 Virtual-PPP1 track 111 > ip route 0.0.0.0 0.0.0.0 Dialer0 150 > ip route 10.0.0.0 255.0.0.0 10.57.24.1 > ip route 10.0.0.0 255.255.0.0 10.57.24.1 > ! > ! > no ip http server > no ip http secure-server > ip dns server > ip nat inside source route-map backup-nat interface Dialer0 overload > ip nat inside source route-map internet-nat interface Virtual-PPP1 overload > ip nat inside source route-map intranet_isp interface FastEthernet4 overload > ! > ip sla 1 > icmp-echo 10.57.24.1 source-interface FastEthernet4 > timeout 1000 > threshold 40 > frequency 3 > ip sla schedule 1 life forever start-time now > access-list 10 permit any > access-list 100 remark ==select ip for NAT - intranet_corbina > access-list 100 permit ip 192.168.0.0 0.0.255.255 10.0.0.0 0.255.255.255 > access-list 100 remark --VPN_l2tp-VPN_pptp > access-list 100 permit ip 192.168.0.0 0.0.255.255 85.21.17.0 0.0.0.255 > access-list 100 remark -- > access-list 101 remark ==select ip for NAT - internet > access-list 101 deny ip 192.168.0.0 0.0.255.255 10.0.0.0 0.255.255.255 > access-list 101 remark --VPN_l2tp-VPN_pptp > access-list 101 deny ip 192.168.0.0 0.0.255.255 85.21.17.0 0.0.0.255 > access-list 101 remark -- > access-list 102 remark ==select ip for NAT - bakcup > access-list 102 permit ip 192.168.0.0 0.0.255.255 any > access-list 110 remark === Firewall ACL > access-list 110 deny ip host 0.0.0.0 any > access-list 110 deny ip host 255.255.255.255 any > access-list 110 deny ip 127.0.0.0 0.255.255.255 any > access-list 110 deny ip 172.16.0.0 0.15.255.255 any > access-list 110 remark --- L2TP to corbina > access-list 110 permit udp any eq 1701 10.0.0.0 0.255.255.255 > access-list 110 remark --- DHSP client > access-list 110 permit udp 10.0.0.0 0.255.255.255 eq bootps any > access-list 110 remark --- Public Services > access-list 110 remark --- VPN Networks Access > access-list 110 permit ip 192.168.4.0 0.0.0.255 192.168.0.0 0.0.255.255 > access-list 110 permit ip 192.168.4.0 0.0.0.255 10.0.0.0 0.255.255.255 > access-list 110 remark --- IPSec VPN Service > access-list 110 permit udp any any eq isakmp > access-list 110 permit esp any any > access-list 110 permit udp any any eq non500-isakmp > access-list 110 remark --- Permit ICMP Reply > access-list 110 permit icmp any any echo-reply > access-list 110 permit icmp any any time-exceeded > access-list 110 permit icmp any any unreachable > access-list 110 permit icmp any any packet-too-big > access-list 110 permit icmp any any administratively-prohibited > access-list 110 remark --- Permit DNS > access-list 110 permit udp any eq domain any > access-list 120 permit ip any any > access-list 130 remark === select ip for Dialer === > access-list 130 permit ip 192.168.0.0 0.0.255.255 any > dialer-list 1 protocol ip list 130 > ! > ! > ! > route-map intranet_isp permit 10 > match ip address 100 > ! > route-map internet-nat permit 10 > match ip address 101 > match interface Virtual-PPP1 > ! > route-map backup-nat permit 10 > match ip address 102 > match interface Dialer0 > ! > ! > control-plane > ! > ! > line con 0 > no modem enable > line aux 0 > line vty 0 4
	Введите код, изображенный на картинке: