UP. Коллеги, задача так и не решена. Кто-нибудь в состоянии помочь? Задача подключить несколько розничных точек с помощью crypto map.Пробовал и с динамическими и со статическими, и со статическим маршрутом и с reverse-route, crypto map вешал и на interface GigabitEthernet0/1.1 и на interface GigabitEthernet0/0, и с DLink DSR-150 и с Mikrotik 750. Всё одно туннель ставится, траффик не идёт. Где грабли-то?
Ещё раз конфиг: актуальный
a.a.a.a - внешний IP филиала 1
b.b.b.b - внешний IP филиала 2
c.c.c.c - внешний IP выделеной ISP подсети маршрутизируемой вовне (является шлюзом для этой подсети)
z.z.z.z - внешний IP к ISP
y.y.y.y - шлюз ISP
!
crypto keyring Branch1Key
pre-shared-key address a.a.a.a key Superkey1
crypto keyring Branch2Key
pre-shared-key address b.b.b.b key Superkey2
crypto keyring ShopsKey
pre-shared-key address 0.0.0.0 0.0.0.0 key MegaSuperKey
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
!
crypto isakmp policy 20
encr 3des
hash md5
authentication pre-share
group 2
lifetime 28800
!
crypto isakmp profile Branch1
keyring Branch1Key
match identity address a.a.a.a 255.255.255.255
crypto isakmp profile Branch2
keyring Branch2Key
match identity address b.b.b.b 255.255.255.255
crypto isakmp profile Shops
keyring ShopsKey
match identity address 0.0.0.0
!
!
crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac
mode transport
crypto ipsec transform-set 3DES-MD5 esp-3des esp-md5-hmac
!
crypto ipsec profile Branch1IPSec
set transform-set 3DES-SHA
set isakmp-profile Branch1
!
crypto ipsec profile Branch2IPSec
set transform-set 3DES-SHA
set isakmp-profile Branch2
!
!
crypto dynamic-map VPNShop 10
set transform-set 3DES-MD5
set pfs group2
set isakmp-profile Shops
match address VPN-Shop1
!
!
crypto map VPNShops 1 ipsec-isakmp dynamic VPNShop
!
!
interface Tunnel0
description ===== Branch1 =====
ip address 192.168.100.1 255.255.255.252
ip mtu 1400
ip tcp adjust-mss 1360
tunnel source c.c.c.c
tunnel mode ipsec ipv4
tunnel destination a.a.a.a
tunnel protection ipsec profile Branch1IPSec
!
interface Tunnel1
description ===== Branch2 =====
ip address 192.168.101.1 255.255.255.252
ip mtu 1400
ip tcp adjust-mss 1360
tunnel source c.c.c.c
tunnel mode ipsec ipv4
tunnel destination b.b.b.b
tunnel protection ipsec profile Branch2IPSec
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
description ===== Internet Comstar =====
ip address z.z.z.z 255.255.255.252
duplex auto
speed auto
!
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/1.1
description ===== DMZ White IPs =====
encapsulation dot1Q 6
ip address c.c.c.c 255.255.255.240
crypto map VPNShops
!
interface GigabitEthernet0/1.2
description ===== Management =====
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
!
!
interface GigabitEthernet0/2
no ip address
duplex auto
speed auto
shut
!
ip forward-protocol nd
!
router eigrp 999
network 192.168.10.0
network 192.168.100.0
network 192.168.101.0
!
ip route 0.0.0.0 0.0.0.0 y.y.y.y
ip route 10.0.0.16 255.255.255.240 GigabitEthernet0/1.1
!
access list extended VPN-Shop1
permit 192.168.10.0 0.0.0.255 10.0.0.16 0.0.0.15
