>>>>> Без конфигов никто не скажет ничего.
>>> Ты издеваешься над нами или как?
>> что не так?
> Это был весь конфиг IPsec?ситуация сейчас такова, что когда поднимаю динамику, некоторое время туннель работает, а затем синхронно падает с основным (crypto map DAVAI 2 ipsec-isakmp) и через некоторое время поднимается (пинги идут\не идут)
crypto keyring spokes
pre-shared-key address 0.0.0.0 0.0.0.0 key xxxxxxxx
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
lifetime 3600
!
crypto isakmp policy 3
encr 3des
authentication pre-share
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
!
crypto isakmp policy 11
hash md5
authentication pre-share
group 2
crypto isakmp keepalive 10 periodic
!
crypto isakmp client configuration group xxxxxx
key xxxxxxxxx
dns 10.10.53.11 192.168.1.11
domain xxxxx
pool ippool
acl vpnuser
save-password
crypto isakmp profile VPN
match identity group xxxxxxxx
client authentication list userauthen
isakmp authorization list groupauthor
client configuration address respond
!
!
crypto ipsec transform-set letsgo esp-3des esp-md5-hmac
mode tunnel
crypto ipsec transform-set filial_des esp-des esp-sha-hmac
mode tunnel
crypto ipsec transform-set filial_3des esp-3des esp-sha-hmac
mode tunnel
!
!
crypto isakmp profile dlink
keyring spokes
match identity address 0.0.0.0
!
crypto dynamic-map dynmap 10
set transform-set letsgo
set isakmp-profile VPN
reverse-route
crypto dynamic-map dynmap 100
set transform-set des
set isakmp-profile dlink
match address qwe
!
!
crypto map DAVAI 2 ipsec-isakmp !!!!!!!!!
set peer x.x.x.x
set transform-set letsgo
match address ipsec
crypto map DAVAI 10 ipsec-isakmp
set peer x.x.x.x
set security-association lifetime seconds 28800
set transform-set filial_3des
set pfs group2
match address filial_3des
crypto map DAVAI 11 ipsec-isakmp
set peer x.x.x.x
set security-association lifetime seconds 28800
set transform-set filial_des
set pfs group2
match address filial_des
crypto map DAVAI 12 ipsec-isakmp
set peer x.x.x.x
set security-association lifetime seconds 28800
set transform-set filial_des
set pfs group2
match address filial_des_12
crypto map DAVAI 13 ipsec-isakmp
set security-association lifetime seconds 28800
set transform-set filial_des
set pfs group2
match address filial_des_13
crypto map DAVAI 14 ipsec-isakmp
set peer x.x.x.x
set security-association lifetime seconds 28800
set transform-set filial_des
set pfs group2
match address filial_des_14
crypto map DAVAI 100 ipsec-isakmp dynamic dynmap
ip access-list extended ipsec
permit ip 10.10.12.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 10.255.0.0 0.0.0.255 10.255.1.0 0.0.0.255
permit ip 10.255.0.0 0.0.0.255 192.168.1.0 0.0.0.255
permit ip 10.10.48.0 0.0.7.255 192.168.1.0 0.0.0.255
ip access-list extended qwe
permit ip 10.10.53.0 0.0.0.255 192.168.5.0 0.0.0.255
Вариант для распечатки
