Исходное сообщение
"cisco 1841: не могу настроить gre+ipsec туннель" Отправлено demchenko, 30-Июн-10 13:48
>[оверквотинг удален] >tak... kak ponimaju iz show commands na 212.45.2.67: >    #pkts encaps: 40, #pkts encrypt: 40, #pkts digest: >40 >    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: >0 >paketi vxodjat v tunnel tak kak encaps i encrypt 40 i errorov >netu. stranno chto decps i decrypt 0. poxozhe na to chto >obratno paketi ne xodjat c 213.182.181.66. > >kak vigledit analogichnie show commnads na drugom ciske? вот так: #sh crypto ipsec sa interface: Tunnel1     Crypto map tag: Tunnel1-head-0, local addr 213.182.181.66    protected vrf: (none)    local  ident (addr/mask/prot/port): (213.182.181.66/255.255.255.255/47/0)    remote ident (addr/mask/prot/port): (212.45.2.67/255.255.255.255/47/0)    current_peer 212.45.2.67 port 500      PERMIT, flags={origin_is_acl,}     #pkts encaps: 50, #pkts encrypt: 50, #pkts digest: 50     #pkts decaps: 55, #pkts decrypt: 55, #pkts verify: 55     #pkts compressed: 0, #pkts decompressed: 0     #pkts not compressed: 0, #pkts compr. failed: 0     #pkts not decompressed: 0, #pkts decompress failed: 0     #send errors 0, #recv errors 0      local crypto endpt.: 213.182.181.66, remote crypto endpt.: 212.45.2.67      path mtu 1500, ip mtu 1500, ip mtu idb Vlan3      current outbound spi: 0xC20B462A(3255518762)      PFS (Y/N): N, DH group: none      inbound esp sas:       spi: 0xC788A48C(3347621004)         transform: esp-3des esp-md5-hmac ,         in use settings ={Tunnel, }         conn id: 2015, flow_id: FPGA:15, sibling_flags 80000046, crypto map: Tunnel1-head-0         sa timing: remaining key lifetime (k/sec): (4540168/76298)         IV size: 8 bytes         replay detection support: Y         Status: ACTIVE       spi: 0x39AC5EB5(967597749)         transform: esp-3des esp-md5-hmac ,         in use settings ={Tunnel, }         conn id: 2017, flow_id: FPGA:17, sibling_flags 80000046, crypto map: Tunnel1-head-0         sa timing: remaining key lifetime (k/sec): (4434487/77073)         IV size: 8 bytes         replay detection support: Y         Status: ACTIVE      inbound ah sas:      inbound pcp sas:      outbound esp sas:       spi: 0x6916F589(1763112329)         transform: esp-3des esp-md5-hmac ,         in use settings ={Tunnel, }         conn id: 2016, flow_id: FPGA:16, sibling_flags 80000046, crypto map: Tunnel1-head-0         sa timing: remaining key lifetime (k/sec): (4540168/76298)         IV size: 8 bytes         replay detection support: Y         Status: ACTIVE       spi: 0xC20B462A(3255518762)         transform: esp-3des esp-md5-hmac ,         in use settings ={Tunnel, }         conn id: 2018, flow_id: FPGA:18, sibling_flags 80000046, crypto map: Tunnel1-head-0         sa timing: remaining key lifetime (k/sec): (4434487/77073)         IV size: 8 bytes         replay detection support: Y         Status: ACTIVE      outbound ah sas:      outbound pcp sas: #sh crypto isakmp sa IPv4 Crypto ISAKMP SA dst             src             state          conn-id status 213.182.181.66  212.45.2.67     QM_IDLE           1006 ACTIVE IPv6 Crypto ISAKMP SA число decaps совпадает с encaps на московской циске. т.е. получается питерская циска отправляет и получает пакеты, а московская - только отправляет. >I esho pochemu u vas na "msk" stoit shared na tunnel protection... >? u vas na "msk" est' drugoi tunel s tem zhe >crypto map? нет, нету. каюсь - не разбираясь в значении параметра скопипастил с одной из статей по настройке циски. убрал - ничего не изменилось.