Коллеги столкнулся со следующей проблемой =)) Залил на роутеры нормальные иосы (с шифрованием и всем остальным ;-) )настроил впн, но он не работает, интерфейсы down, пакеты не идут.Делал все по статье с хабра http://linkmeup.ru/blog/50.html
В итоге у меня:
R1#sh crypto session
Crypto session current status
Interface: FastEthernet4
Session status: DOWN
Peer: 250.0.0.1 port 500
IPSEC FLOW: permit ip host 192.168.1.1 host 10.99.99.254
Active SAs: 0, origin: crypto map
=====================================================================
R1#show crypto ipsec sa
interface: FastEthernet4
Crypto map tag: MAP1, local addr 251.0.0.1
protected vrf: (none)
local ident (addr/mask/prot/port): (192.168.1.1/255.255.255.255/0/0)
remote ident (addr/mask/prot/port): (10.99.99.254/255.255.255.255/0/0)
current_peer 250.0.0.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 251.0.0.1, remote crypto endpt.: 250.0.0.1
plaintext mtu 1500, path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet4
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none
inbound esp sas:
inbound ah sas:
inbound pcp sas:
outbound esp sas:
outbound ah sas:
outbound pcp sas:
Если пытаюсь завернуть трафик в тунель, ничего не выходит, пингов нет:
R1#ping 10.99.99.254 source 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.99.99.254, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1
Подскажите как поднять сессию, что ни так?
Добавлено через 16 минут
Настройки NAT с обеих сторон:
ip access-list extended NAT
permit ip 192.168.1.0 0.0.0.255 any
и соответственно:
ip access-list extended NAT
permit ip 10.99.99.0 0.0.0.255 any
Добавлено через 5 часов 44 минуты
Парни думаю затык в NAT, есть у кого какие нибудь соображения?
Выкладываю конфиг с одной стороны, с другой то же самое с учетом противоположной стороны тунеля:
R1#sh runn
R1#sh running-config
Building configuration...
Current configuration : 2908 bytes
!
! Last configuration change at 12:16:12 UTC Wed Dec 16 2015 by fatera
!
version 15.5
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
no service dhcp
!
hostname R1
!
boot-start-marker
boot system flash:c890-universalk9-mz.155-2.T1.bin
boot-end-marker
!
!
enable secret 4 cisco
!
no aaa new-model
ethernet lmi ce
bsd-client server url https://cloudsso.cisco.com/as/token.oauth2
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
ip domain name R1
ip name-server 8.8.8.8
ip name-server 8.8.4.4
ip cef
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
cts logging verbose
license udi pid CISCO891-K9 sn FCZ174291T5
!
!
username R1 privilege 15 password 7 CISCO
!
redundancy
!
!
!
!
no cdp run
!
!
!
crypto isakmp policy 1
encr aes
authentication pre-share
crypto isakmp key CISCO address 113.33.107.11
!
!
crypto ipsec transform-set AES128-SHA esp-aes esp-sha-hmac
mode tunnel
!
!
!
crypto map MAP1 10 ipsec-isakmp
set peer 113.33.107.11
set transform-set AES128-SHA
match address 101
!
!
!
!
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface FastEthernet4
no ip address
!
interface FastEthernet5
no ip address
!
interface FastEthernet6
no ip address
!
interface FastEthernet7
no ip address
!
interface FastEthernet8
ip address 10.99.99.254 255.255.255.0
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
vlan-id dot1q 455
exit-vlan-config
!
!
interface GigabitEthernet0
ip address 22.33.62.26 255.255.255.224
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
crypto map MAP1
!
interface Vlan1
no ip address
!
interface Async1
no ip address
encapsulation slip
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip nat inside source list NAT interface GigabitEthernet0 overload
ip nat inside source static tcp 10.99.99.1 3389 62.33.234.26 4441 extendable
ip nat inside source static tcp 10.99.99.2 3389 62.33.234.26 4442 extendable
ip nat inside source static tcp 10.99.99.3 3389 62.33.234.26 4443 extendable
ip route 0.0.0.0 0.0.0.0 62.33.234.1
ip route 10.99.99.0 255.255.255.0 192.168.1.1
!
ip access-list extended NAT
permit ip 10.99.99.0 0.0.0.255 any
!
!
!
access-list 101 permit ip host 10.99.99.254 host 192.168.1.1
!
control-plane
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
!
!
!
line con 0
password 7 CISCO
login
line 1
modem InOut
speed 115200
flowcontrol hardware
line aux 0
line vty 0 4
login local
transport input ssh
!
!
end
Вариант для распечатки
(ok) on 22-Дек-15, 16:12 
