Исходное сообщение
"Шифрованный канал между двумя роутерами Cisco 881" Отправлено leonart, 17-Окт-09 17:59
Добрый день, уважаемые специалисты! Есть необходимость настроить сабж, но квалификация похоже подводит. Подскажите в чем может быть трабл? Архитектура сети следующая: есть главный офис (роутер А, внутренний адрес 10.1.100.1, подсеть за ним 192.168.0.0/24) и подчиненное подразделение (роутер Б, внутренний адрес 10.1.100.2, подсеть за ним 192.168.2.0/24). Без применения к интерфейсу карт шифрования сеть работает как нужно. Когда же применяю карту шифрования на обоих роутерах, сеть работает не правильно. Из главного офиса в стророну роутера Б все данные передаются нормально. С вынесенного подразделения пингуются все нужные хосты начиная от роутера и заканчиваю серверами, которые за ним. Но при попытке работать с сетевыми дисками из главной сети сеть как буд-то подвисает. По всем признакам ipsec работает нормально в  debug ничего не похожего на ошибки. Заранее спасибо за помощь!!! Конфиг роутера А version 12.4 no service pad service tcp-keepalives-in service tcp-keepalives-out service timestamps debug datetime msec localtime show-timezone service timestamps log datetime msec localtime show-timezone service password-encryption service sequence-numbers ! hostname routeLGC ! boot-start-marker boot-end-marker ! security authentication failure rate 3 log security passwords min-length 6 logging message-counter syslog logging buffered 51200 logging console critical enable secret 5 ------- ! no aaa new-model clock timezone PCTime 2 clock summer-time PCTime date Mar 30 2003 3:00 Oct 26 2003 4:00 ! crypto pki trustpoint ---- enrollment selfsigned subject-name cn=---- revocation-check none rsakeypair ---- ! ! crypto pki certificate chain ----- certificate self-signed 01 ------         quit no ip source-route ! ! ip cef no ip bootp server ip domain name lgc.ua ip name-server 192.168.0.240 ! ! ! ! username admin privilege 15 secret 5 ----- ! ! crypto isakmp policy 1 encr 3des hash md5 authentication pre-share lifetime 5000 crypto isakmp key 6 lgclsk address 10.1.100.2 ! ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac crypto ipsec transform-set 3DES esp-3des esp-sha-hmac ! crypto map lgclsk 10 ipsec-isakmp set peer 10.1.100.2 set transform-set 3DES match address 110 ! archive log config   hidekeys ! ! ip tcp synwait-time 10 ip ssh time-out 60 ip ssh authentication-retries 2 ! ! ! interface FastEthernet0 ! interface FastEthernet1 ! interface FastEthernet2 ! interface FastEthernet3 ! interface FastEthernet4 description $FW_OUTSIDE$$ES_WAN$ ip address 10.1.100.1 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ip flow ingress duplex auto speed auto crypto map lgclsk ! interface Vlan1 description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$ ip address 192.168.0.251 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ip flow ingress ip tcp adjust-mss 1452 ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 10.1.100.2 permanent ip route 172.20.0.0 255.255.0.0 192.168.0.253 permanent ip route 172.23.0.0 255.255.0.0 192.168.0.253 permanent ip route 192.168.255.0 255.255.255.0 192.168.0.252 permanent ip http server ip http access-class 23 ip http authentication local ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ! ! ! logging trap debugging access-list 110 permit ip 192.168.0.0 0.0.0.255 192.168.2.0 0.0.0.255 no cdp run ! ! ! ! control-plane ! line con 0 login local no modem enable transport output telnet line aux 0 login local transport output telnet line vty 0 4 privilege level 15 login local transport input telnet ssh ! scheduler max-task-time 5000 scheduler allocate 4000 1000 scheduler interval 500 ntp update-calendar ntp server 192.168.0.241 source Vlan1 end Конфиг роутера Б version 12.4 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname routerLSK ! boot-start-marker boot-end-marker ! logging message-counter syslog logging buffered 51200 warnings enable secret 5 -------- ! no aaa new-model ! crypto pki trustpoint --------------- enrollment selfsigned subject-name cn=----------- revocation-check none rsakeypair ---------------- ! ! crypto pki certificate chain ------------- certificate self-signed 01 ------------         quit no ip source-route ! ! ip cef no ip bootp server no ip domain lookup ip domain name lgc.ua ! ! ! ! username admin privilege 15 secret 5 --------------- ! ! crypto isakmp policy 1 encr 3des hash md5 authentication pre-share lifetime 5000 crypto isakmp key 6 lgclsk address 10.1.100.1 ! ! crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac crypto ipsec transform-set 3DES esp-3des esp-sha-hmac ! crypto map lgclsk 10 ipsec-isakmp set peer 10.1.100.1 set transform-set 3DES match address 101 ! archive log config   hidekeys ! ! ! ! ! interface FastEthernet0 ! interface FastEthernet1 ! interface FastEthernet2 ! interface FastEthernet3 ! interface FastEthernet4 description $FW_OUTSIDE$$ES_WAN$ ip address 10.1.100.2 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp duplex auto speed auto crypto map lgclsk ! interface Vlan1 description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$ ip address 192.168.2.251 255.255.255.0 no ip redirects no ip unreachables no ip proxy-arp ip tcp adjust-mss 1452 ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 10.1.100.1 ip http server ip http access-class 23 ip http authentication local ip http secure-server ip http timeout-policy idle 60 life 86400 requests 10000 ! ! ! access-list 101 permit ip 192.168.2.0 0.0.0.255 192.168.0.0 0.0.0.255 no cdp run ! ! ! ! control-plane ! banner exec ^C % Password expiration warning. ----------------------------------------------------------------------- Cisco Configuration Professional (Cisco CP) is installed on this device and it provides the default username "cisco" for  one-time use. If you have already used the username "cisco" to login to the router and your IOS image supports the "one-time" user option, then this username has already expired. You will not be able to login to the router with this username after you exit this session. It is strongly suggested that you create a new username with a privilege level of 15 using the following command. username <myuser> privilege 15 secret 0 <mypassword> Replace <myuser> and <mypassword> with the username and password you want to use. ----------------------------------------------------------------------- ^C banner login ^CAuthorized access only! Disconnect IMMEDIATELY if you are not an authorized user!^C ! line con 0 login local no modem enable line aux 0 line vty 0 4 privilege level 15 login local transport input telnet ssh ! scheduler max-task-time 5000 end