>>Поднят GRE тоннель между двумя цисками. Закрыт IPSec-ом. Периодически проявляются повисшие translations
>>из за которых перестает пинговаться дальний конец туннеля.
>
>О как!!!
>
>Ээээ...
>Конфиг показывайте....
>
>Пока не понимаю связь НАТа с source-destination у тунелей. прошу прощения за отсутствие - не было на месте... вот конфиг в части касающейся организации туннелей и маршрутизации. ACL не привожу - там они толстые, но по ним затыков нет, что надо разрешено.
crypto isakmp policy 2
encr 3des
authentication pre-share
group 2
lifetime 7200
crypto isakmp policy 3
encr 3des
hash md5
authentication pre-share
crypto isakmp key ***key1*** address 61.140.107.247 no-xauth
crypto isakmp key ***key2*** address 212.86.1.164 no-xauth
crypto ipsec security-association idle-time 3600
crypto ipsec transform-set transform1 esp-3des esp-sha-hmac
crypto ipsec transform-set transform2 esp-3des esp-md5-hmac
crypto ipsec profile profile1
set transform-set transform1
crypto ipsec profile profile2
set transform-set transform2
interface Tunnel0
ip address 10.3.2.9 255.255.255.192
no ip redirects
ip accounting output-packets
ip mtu 1416
ip nat outside
ip nhrp authentication ocsic
ip nhrp map 10.3.2.1 61.140.107.247
ip nhrp map multicast 61.140.107.247
ip nhrp network-id 24
ip nhrp nhs 10.3.2.1
tunnel source 61.116.86.5
tunnel destination 61.140.107.247
tunnel key 54321
tunnel protection ipsec profile profile1 shared
interface Tunnel1
bandwidth 2000
ip address 10.11.0.2 255.255.255.252
ip access-group lvsin in
ip accounting output-packets
ip mtu 1500
ip nat inside
no ip mroute-cache
ip policy route-map prov-map
tunnel source 61.116.86.5
tunnel destination 212.86.1.164
tunnel protection ipsec profile profile2 shared
interface FastEthernet0/0
description LAN
ip address 192.168.0.1 255.255.255.0 secondary
ip address 192.168.3.1 255.255.255.0
ip access-group lvsin in
ip accounting output-packets
ip nat inside
no ip mroute-cache
ip policy route-map prov-map
duplex auto
speed 100
interface FastEthernet0/1
description DMZ
ip address 86.244.130.17 255.255.255.240 secondary
ip address 76.107.89.129 255.255.255.192 secondary
ip address 76.107.71.1 255.255.255.240
ip access-group dmzin in
ip accounting output-packets
ip nat inside
no ip mroute-cache
ip policy route-map prov-map
duplex auto
speed 100
interface FastEthernet2/0
description PROV
ip address 61.116.86.5 255.255.255.252
ip access-group 118 in
ip access-group provout out
ip verify unicast reverse-path
ip nat outside
duplex auto
speed auto
ip nat log translations syslog
ip nat pool prov-space 61.116.86.5 61.116.86.5 netmask 255.255.255.252
ip nat inside source list client1 interface Tunnel0 overload
ip nat inside source route-map prov-map pool prov-space overload
ip route 0.0.0.0 0.0.0.0 61.116.86.6
ip route 10.10.0.0 255.255.240.0 Tunnel1
ip route 76.107.71.0 255.255.255.240 FastEthernet0/1
ip route 76.107.89.128 255.255.255.192 FastEthernet0/1
ip route 86.244.130.16 255.255.255.240 FastEthernet0/1
ip route 172.16.0.0 255.255.0.0 Tunnel0
ip route 192.168.0.0 255.255.255.0 FastEthernet0/0
ip route 192.168.3.0 255.255.255.0 FastEthernet0/0
route-map prov-map permit 20
match ip address permitinternet
match interface FastEthernet2/0
set default interface FastEthernet2/0
Вариант для распечатки
Маршрутизаторы CISCO и др. оборудование. (Public)
(ok) on 04-Дек-09, 18:18 
