Есть 3 циски, использую тунель gre+ipsecПробовал уже и transport mode,, c VTI и без, результат одни. пока с ip address 10.9.0.1 не начнёшь пиноговать 10.9.0.2 тунель не поднимаеться,причём как то с паузой.... ,3 й роутер работает с 1 работает без проблем через VTI.
1 роутер System Bootstrap, Version 12.3(8r)YI4,
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key 4444 address ........218.12
crypto isakmp key 5555 address .........164.11
crypto isakmp keepalive 30 10
!
!
crypto ipsec transform-set VTI esp-aes esp-sha-hmac
!
crypto ipsec profile prof-gre
set transform-set VTI
!
!
archive
log config
hidekeys
!
!
!
!
!
interface Tunnel0
ip address 10.9.0.1 255.255.255.0
keepalive 5 4
tunnel source FastEthernet4
tunnel destination .......164.11
tunnel mode ipsec ipv4
tunnel protection ipsec profile prof-gre
!
interface Tunnel1
ip address 10.10.0.1 255.255.255.0
tunnel source FastEthernet4
tunnel destination .......218.12
tunnel protection ipsec profile prof-gre
!
interface FastEthernet0
switchport access vlan 2
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
ip address ip....... 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface Vlan1
no ip address
ip nat inside
ip virtual-reassembly
!
interface Vlan2
ip address 192.168.0.230 255.255.255.0
ip nat inside
ip virtual-reassembly
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 94.230.115.34
ip route 0.0.0.0 255.255.255.252 .......GATE.....
ip route 192.168.1.0 255.255.255.0 10.9.0.2
ip route 192.168.5.0 255.255.255.0 10.0.0.1
ip route 192.168.10.0 255.255.255.0 10.10.0.2
--------------------------------------
flash:c1841-advipservicesk9-mz.124-3j.bin"
2 роутер
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key 5555 address ......115.34
crypto isakmp keepalive 30 10
!
!
crypto ipsec transform-set VTI esp-aes esp-sha-hmac
!
crypto ipsec profile prof-gre
set transform-set VTI
!
!
!
!
!
interface Tunnel0
ip address 10.9.0.2 255.255.255.0
keepalive 5 4
tunnel source .......164.12
tunnel destination ......115.34
tunnel mode ipsec ipv4
tunnel protection ipsec profile prof-gre
!
interface FastEthernet0/0
ip address .......164.11 255.255.255.248
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
!
interface FastEthernet0/1
ip address 192.168.1.21 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface Virtual-Template1
ip address 172.16.1.1 255.255.255.0
peer default ip address dhcp-pool forvpn
ppp encrypt mppe auto required
ppp authentication ms-chap ms-chap-v2
!
ip classless
ip route 0.0.0.0 0.0.0.0 GATE
ip route 192.168.0.0 255.255.255.0 10.9.0.1
ip route 192.168.10.0 255.255.255.0 10.9.0.1
!
ip dns server
!
no ip http server
no ip http secure-server
ip nat inside source list 1 interface FastEthernet0/0 overload
!
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 102 permit ip 192.168.1.0 0.0.0.255 192.168.10.0 0.0.0.255
access-list 103 permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 104 deny ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255
access-list 104 permit ip 192.168.1.0 0.0.0.255 any
access-list 110 deny ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255
access-list 110 permit ip 192.168.1.0 0.0.0.255 any
!
------------------------------------------------
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
......115.33 ......164.11 QM_IDLE 2001 0 ACTIVE
......115.33 ......142.102 MM_KEY_EXCH 2018 0 ACTIVE.
.....115.33 ......142.102 MM_NO_STATE 2017 0 ACTIVE (deleted)
Удивил .......142.102 это ip linux роутера он маршрутизирует подсеть ,,,,, ......164.11 /29 как вообше этот ip попал в таблицу ??? мож в этом дело ???
IPv6 Crypto ISAKMP SA
163#
163#sh crypto session detail
Crypto session current status
Code: C - IKE Configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal, X - IKE Extended Authentication
F - IKE Fragmentation
Interface: Tunnel0
Uptime: 00:30:53
Session status: UP-ACTIVE
Peer: ..........164.11 port 500 fvrf: (none) ivrf: (none)
Phase1_id: ........164.11
Desc: (none)
IKE SA: local .........115.34/500 remote ........164.11/500 Active
Capabilities:D connid:2001 lifetime:23:29:06
IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 0.0.0.0/0.0.0.0
Active SAs: 2, origin: crypto map
Inbound: #pkts dec'ed 0 drop 0 life (KB/Sec) 4582265/1746
Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 4582265/1746
Interface: Tunnel1
Session status: DOWN
Peer: ........218.12 port 500 fvrf: (none) ivrf: (none)
Desc: (none)
Phase1_id: (none)
IPSEC FLOW: permit 47 host ........115.34 host .........218.12
Active SAs: 0, origin: crypto map
Inbound: #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0
Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0
Interface: FastEthernet4
Session status: DOWN-NEGOTIATING
Peer: .........142.102 port 500 fvrf: (none) ivrf: (none)
Desc: (none)
Phase1_id: (none)
IKE SA: local ...........115.33/500 remote ...........142.102/500 Inactive
Capabilities:DN connid:2018 lifetime:0
163#sh crypto isakmp sa
IPv4 Crypto ISAKMP SA
dst src state conn-id slot status
......115.33 .........164.11 QM_IDLE 2001 0 ACTIVE
........115.33 ...........143.102 MM_NO_STATE 2018 0 ACTIVE (deleted)
IPv6 Crypto ISAKMP SA
