Взяли в аренду помянутую киску, до этого пытались работать с D-Link (не помню модель) - не потянула 10 VPN, но всё работало. Циска тянет, но перестали реплицироваться домены (под WinServ 2003), месяц копаемся - не можем победить. Соответственно корпорат-почта (внутри сети) не ходит - ЭксченджСерв не может найти домены получателей... Схема проста - 9 ф-лов подрубаются к основному серверу. Есть соображения?

Спасибо!

Конфиг вот такой:
==========
Building configuration...

Current configuration : 7541 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname cicso
!
boot-start-marker
boot-end-marker
!
logging buffered 52000 debugging
enable secret 5 $1$Iaha$Zhpx6T5EF5baVv833mumZ0
!
no aaa new-model
!
resource policy
!
ip subnet-zero
no ip source-route
ip cef
!
!
no ip bootp server
no ip domain lookup
ip domain name jek.local
!
!
crypto pki trustpoint TP-self-signed-1656205900
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1656205900
revocation-check none
rsakeypair TP-self-signed-1656205900
!
!
crypto pki certificate chain TP-self-signed-1656205900
certificate self-signed 01
  BLA-BLA-BLA
  quit
username jek privilege 15 secret 5 $BLA
!
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
lifetime 28800
crypto isakmp key RC232 address 172.31.12.6 255.255.255.252 no-xauth
crypto isakmp key RC232 address 172.31.12.10 255.255.255.252 no-xauth
crypto isakmp key RC232 address 172.31.12.14 255.255.255.252 no-xauth
crypto isakmp key RC232 address 172.31.12.26 255.255.255.252 no-xauth
crypto isakmp key RC232 address 172.31.12.30 255.255.255.252 no-xauth
crypto isakmp key RC232 address 172.31.12.34 255.255.255.252 no-xauth
crypto isakmp key RC232 address 172.31.12.38 255.255.255.252 no-xauth
crypto isakmp key RC232 address 172.31.12.18 255.255.255.252 no-xauth
crypto isakmp key RC232 address 172.31.12.22 255.255.255.252 no-xauth
crypto isakmp key RC232 address 172.31.12.42 255.255.255.252 no-xauth
!
!
crypto ipsec transform-set set esp-3des
!
crypto map SDM_CMAP_1 1 ipsec-isakmp
description CNT(6-62)
set peer 172.31.12.6
set security-association lifetime seconds 28800
set transform-set set
set pfs group1
match address 100
reverse-route
crypto map SDM_CMAP_1 2 ipsec-isakmp
description SOVa(10-56)
set peer 172.31.12.10
set security-association lifetime seconds 28800
set transform-set set
set pfs group1
match address 101
reverse-route
crypto map SDM_CMAP_1 3 ipsec-isakmp
description LENIN(14-59)
set peer 172.31.12.14
set security-association lifetime seconds 28800
set transform-set set
set pfs group1
match address 102
reverse-route
crypto map SDM_CMAP_1 4 ipsec-isakmp
description VRSH(18-60)
set peer 172.31.12.18
set security-association lifetime seconds 28800
set transform-set set
set pfs group1
match address 103
reverse-route
crypto map SDM_CMAP_1 5 ipsec-isakmp
description SOVp(22-58)
set peer 172.31.12.22
set security-association lifetime seconds 28800
set transform-set set
set pfs group1
match address 104
reverse-route
crypto map SDM_CMAP_1 6 ipsec-isakmp
description KRA(26-61)
set peer 172.31.12.26
set security-association lifetime seconds 28800
set transform-set set
set pfs group1
match address 105
reverse-route
crypto map SDM_CMAP_1 7 ipsec-isakmp
description KRO(30-55)
set peer 172.31.12.30
set security-association lifetime seconds 28800
set transform-set set
set pfs group1
match address 106
reverse-route
crypto map SDM_CMAP_1 8 ipsec-isakmp
description TZR(34-63)
set peer 172.31.12.34
set security-association lifetime seconds 28800
set transform-set set
set pfs group1
match address 107
reverse-route
crypto map SDM_CMAP_1 9 ipsec-isakmp
description KIR(38-57)
set peer 172.31.12.38
set security-association lifetime seconds 28800
set transform-set set
set pfs group1
match address 108
reverse-route
crypto map SDM_CMAP_1 10 ipsec-isakmp
description Renessans(42-52)
set peer 172.31.12.42
set security-association lifetime seconds 28800
set transform-set set
set pfs group1
match address 109
reverse-route
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description $FW_OUTSIDE$$ES_WAN$
ip address 172.31.12.2 255.255.255.252
no ip redirects
no ip unreachables
no ip proxy-arp
duplex auto
speed auto
crypto map SDM_CMAP_1
!
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
ip address 192.168.50.200 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip tcp adjust-mss 1452
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.31.12.1
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
access-list 100 remark SDM_ACL Category=4
access-list 100 remark IPSec Rule
access-list 100 permit ip 192.168.50.0 0.0.0.255 192.168.62.0 0.0.0.255
access-list 101 remark SDM_ACL Category=4
access-list 101 remark IPSec Rule
access-list 101 permit ip 192.168.50.0 0.0.0.255 192.168.56.0 0.0.0.255
access-list 102 remark SDM_ACL Category=4
access-list 102 remark IPSec Rule
access-list 102 permit ip 192.168.50.0 0.0.0.255 192.168.59.0 0.0.0.255
access-list 103 remark SDM_ACL Category=4
access-list 103 remark IPSec Rule
access-list 103 permit ip 192.168.50.0 0.0.0.255 192.168.60.0 0.0.0.255
access-list 104 remark SDM_ACL Category=4
access-list 104 remark IPSec Rule
access-list 104 permit ip 192.168.50.0 0.0.0.255 192.168.58.0 0.0.0.255
access-list 105 remark SDM_ACL Category=4
access-list 105 remark IPSec Rule
access-list 105 permit ip 192.168.50.0 0.0.0.255 192.168.61.0 0.0.0.255
access-list 106 remark SDM_ACL Category=4
access-list 106 remark IPSec Rule
access-list 106 permit ip 192.168.50.0 0.0.0.255 192.168.55.0 0.0.0.255
access-list 107 remark SDM_ACL Category=4
access-list 107 remark IPSec Rule
access-list 107 permit ip 192.168.50.0 0.0.0.255 192.168.63.0 0.0.0.255
access-list 108 remark SDM_ACL Category=4
access-list 108 remark IPSec Rule
access-list 108 permit ip 192.168.50.0 0.0.0.255 192.168.57.0 0.0.0.255
access-list 109 remark SDM_ACL Category=4
access-list 109 remark IPSec Rule
access-list 109 permit ip 192.168.50.0 0.0.0.255 192.168.52.0 0.0.0.255
no cdp run
!
control-plane
!
banner login ^CCCCCCCCAuthorized access only!
Disconnect IMMEDIATELY if you are not an authorized user!^C
!
line con 0
login local
no modem enable
line aux 0
line vty 0 4
privilege level 15
login local
transport input telnet ssh
!
scheduler max-task-time 5000
end