Добрый день.
Настраиваю VPN IPSec  туннель между маршрутизатором cisco 1841 и zyxel usg 50.
Туннель устанавливается без ошибок, пакеты шифруются. Проверяю на cisco
ping 10.0.3.1(адрес zyxel usg 50) so 10.0.1.1 (адрес cisco 1841) хост 10.0.3.1 доступен.
Однако, если пинговать ping 10.0.3.1 то хост 10.0.3.1 не доступен. В чем может быть дело?

Cisco 1841
version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service sequence-numbers
no service dhcp
!
hostname Router1
!
boot-start-marker
boot-end-marker
!
no aaa new-model
!
resource policy

vpdn enable
!
!
!
username admin password 0 1234
!
!
!
crypto isakmp policy 10
authentication pre-share
group 5
crypto isakmp key pass address 1.1.1.1
!
!
crypto ipsec transform-set vpn esp-des esp-sha-hmac
!
crypto ipsec profile vpn
set security-association lifetime seconds 300
set transform-set vpn
!
!
crypto map Office 10 ipsec-isakmp
set peer 1.1.1.1
set transform-set vpn
match address VPNtoOffice
!
!
!
interface FastEthernet0/0
no ip address
duplex auto
speed auto
!
interface FastEthernet0/0.2
encapsulation dot1Q 10 native
ip address 192.168.250.1 255.255.255.0
ip access-group Lan1 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip accounting output-packets
ip inspect INS in
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
ip policy route-map INET
no snmp trap link-status
no cdp enable
!

interface FastEthernet0/0.3
encapsulation dot1Q 2
ip address 10.0.1.1 255.255.255.0
no snmp trap link-status
no cdp enable
!
interface FastEthernet0/1
no ip address
ip mtu 1492
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 10

interface Dialer1
ip address negotiated
ip access-group Inet1 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip mtu 1492
ip inspect INET in
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 10
no cdp enable
ppp authentication chap callin
ppp chap hostname userpppoe
ppp chap password 0 passppoe
ppp ipcp dns request
crypto map Office
!
ip classless
ip route 0.0.0.0 0.0.0.0 Dialer1
ip route 172.16.0.0 255.240.0.0 Null0
!
!
no ip http server
no ip http secure-server
ip nat inside source route-map ISP1 interface Dialer1 overload
!
ip access-list standard Nat
permit 192.168.0.0 0.0.255.255
!
ip access-list extended Inet1
permit icmp any any
permit ip host 1.1.1.1 host 1.1.1.2
ip access-list extended Lan1
permit icmp any any
permit ip host 192.168.250.2 host 192.168.250.1
permit ip host 192.168.250.2 any
ip access-list extended Locals
permit ip any 192.168.0.0 0.0.255.255
ip access-list extended VPNtoOffice
permit ip 10.0.1.0 0.0.0.255 10.0.3.0 0.0.0.255
permit ip 10.0.3.0 0.0.0.255 10.0.1.0 0.0.0.255
!
snmp-server community public RO
no cdp run
route-map INET deny 5
match ip address Locals
!
route-map ISP1 permit 10
match ip address Nat
match interface Dialer1
!
!
!
control-plane
!
!
line con 0
line aux 0
line vty 0 4
exec-timeout 0 0
login local
!
end