Есть двы офиса на каждой по циске. Поднал на цисках впн, пинги из одной подсети в другую ходят нормально,к серверу баз данных подцепляется нормально, а вот никакую информацию из базы получить нельзя. То же самое с сервером видеонаблюдения: к нему подцепляюсь, а изображение не идет ;-(
Как узнать где проблема? Помогите!!!!!!! Время поджимает

Вот конфиги:

роутер 1:
!
version 12.2
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
no service dhcp
!
logging queue-limit 100
logging buffered 51200 informational
logging console critical
!
memory-size iomem 25
clock timezone MSK 3
clock summer-time MSKS recurring last Sun Mar 2:00 last Sun Oct 3:00
aaa new-model
!
aaa authentication login userlist local
aaa authorization network grouplist local
aaa session-id common
ip subnet-zero
no ip source-route
!
ip tcp synwait-time 10
!
no ip bootp server
ip cef
ip inspect name DEFAULT100 cuseeme
ip inspect name DEFAULT100 ftp
ip inspect name DEFAULT100 h323
ip inspect name DEFAULT100 netshow
ip inspect name DEFAULT100 rcmd
ip inspect name DEFAULT100 realaudio
ip inspect name DEFAULT100 rtsp
ip inspect name DEFAULT100 smtp
ip inspect name DEFAULT100 sqlnet
ip inspect name DEFAULT100 streamworks
ip inspect name DEFAULT100 tftp
ip inspect name DEFAULT100 tcp
ip inspect name DEFAULT100 udp
ip inspect name DEFAULT100 vdolive
ip inspect name DEFAULT100 icmp
ip audit notify log
ip audit po max-events 100
ip ssh time-out 60
ip ssh authentication-retries 2
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key test address a.a.a.a
!
crypto ipsec transform-set 3des_transformset esp-3des esp-sha-hmac
!
crypto map cmap_arm_rzn 1 ipsec-isakmp
description Tunnel to a.a.a.a
set peer a.a.a.a
set transform-set 3des_transformset
match address 100
!
interface Null0
no ip unreachables
!
interface Ethernet0/0
description $FW_OUTSIDE$$ETH-WAN$
ip address b.b.b.b 255.255.255.252
ip access-group 106 in
ip verify unicast reverse-path
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
half-duplex
no cdp enable
crypto map cmap_arm_rzn
!
interface FastEthernet0/0
description $FW_INSIDE$$ETH-LAN$
ip address 172.16.z.z 255.255.0.0
ip access-group 105 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
ip route-cache flow
speed auto
no cdp enable
!
interface Async1
no ip address
no ip redirects
no ip unreachables
no ip proxy-arp
shutdown
!
ip nat inside source route-map rmap_nat interface Ethernet0/0 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Ethernet0/0 permanent
ip route 192.168.0.0 255.255.0.0 a.a.a.a permanent
ip http server
ip http authentication local
ip http secure-server
!
logging trap debugging
access-list 100 remark IPSec Rule inboubd tunnel trafic
access-list 100 permit ip 172.16.0.0 0.0.255.255 192.168.0.0 0.0.0.255
access-list 105 remark Local network
access-list 105 deny   ip host 255.255.255.255 any
access-list 105 deny   ip 127.0.0.0 0.255.255.255 any
access-list 105 permit ip any any
access-list 106 remark IPSec Rule outboubd tunnel traffic
access-list 106 permit tcp any any established
access-list 106 permit icmp any host b.b.b.b unreachable
access-list 106 permit icmp any host b.b.b.b time-exceeded
access-list 106 permit udp any eq domain host b.b.b.b
access-list 106 permit ip 192.168.0.0 0.0.0.255 172.16.0.0 0.0.255.255
access-list 106 permit udp host a.a.a.a host b.b.b.b eq non500-isakmp
access-list 106 permit udp host a.a.a.a host b.b.b.b eq isakmp
access-list 106 permit esp host a.a.a.a host b.b.b.b
access-list 106 permit ahp host a.a.a.a host b.b.b.b
access-list 106 deny   ip 10.0.0.0 0.255.255.255 any
access-list 106 deny   ip 172.16.0.0 0.15.255.255 any
access-list 106 deny   ip 192.168.0.0 0.0.255.255 any
access-list 106 deny   ip 127.0.0.0 0.255.255.255 any
access-list 106 deny   ip host 255.255.255.255 any
access-list 106 deny   ip host 0.0.0.0 any
access-list 106 deny   ip any any log
access-list 110 remark NAT rules
access-list 110 deny   ip 172.16.0.0 0.0.255.255 192.168.0.0 0.0.0.255
access-list 110 deny   ip 172.16.0.0 0.0.255.255 172.16.0.0 0.0.255.255
access-list 110 permit ip 172.16.0.0 0.0.255.255 any
no cdp run
!
route-map rmap_nat permit 1
match ip address 110
!
snmp-server community public RO
snmp-server enable traps tty
radius-server authorization permit missing Service-Type
!
line con 0
transport output telnet
line 1
flush-at-activation
stopbits 1
speed 115200
flowcontrol hardware
line aux 0
transport output telnet
line vty 0 4
privilege level 15
transport input telnet ssh
line vty 5 15
privilege level 15
transport input telnet ssh
!
scheduler allocate 4000 1000
scheduler interval 500
end
++++++++++++++++++++++++++++++++++++++++++++++++++

роутер 2
!
version 12.3
no service pad
service tcp-keepalives-in
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
no service dhcp
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 informational
!
clock timezone PCTime 3
clock summer-time PCTime date Mar 30 2003 2:00 Oct 26 2003 3:00
no aaa new-model
ip subnet-zero
no ip source-route
ip tftp source-interface Ethernet0
no ip domain lookup
!
no ip bootp server
ip inspect name DEFAULT100 cuseeme
ip inspect name DEFAULT100 ftp
ip inspect name DEFAULT100 h323
ip inspect name DEFAULT100 netshow
ip inspect name DEFAULT100 rcmd
ip inspect name DEFAULT100 realaudio
ip inspect name DEFAULT100 rtsp
ip inspect name DEFAULT100 smtp
ip inspect name DEFAULT100 sqlnet
ip inspect name DEFAULT100 streamworks
ip inspect name DEFAULT100 tftp
ip inspect name DEFAULT100 tcp
ip inspect name DEFAULT100 udp
ip inspect name DEFAULT100 vdolive
ip inspect name DEFAULT100 icmp
ip audit notify log
ip audit po max-events 100
no ftp-server write-enable
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key test address b.b.b.b
!
crypto ipsec transform-set armavir_rzn esp-3des esp-sha-hmac
!
crypto map cmap_arm_rzn 1 ipsec-isakmp
description Tunnel to b.b.b.b
set peer b.b.b.b
set transform-set armavir_rzn
match address 100
!
interface Ethernet0
description $FW_INSIDE$$ETH-LAN$$ETH-SW-LAUNCH$
ip address 192.168.0.x 255.255.255.0
ip access-group 102 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat inside
no ip route-cache
no cdp enable
!
interface Ethernet1
description $ETH-WAN$$FW_OUTSIDE$
ip address a.a.a.a 255.255.255.252
ip access-group 104 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat outside
no ip route-cache
duplex auto
no cdp enable
crypto map cmap_arm_rzn
!
ip nat inside source route-map rmap_nat interface Ethernet1 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Ethernet1 permanent
ip route 172.16.0.0 255.255.0.0 b.b.b.b permanent
ip http server
ip http authentication local
ip http secure-server
!
logging trap debugging
access-list 100 remark IPSec Rule inboubd tunnel trafic
access-list 100 permit ip 192.168.0.0 0.0.0.255 172.16.0.0 0.0.255.255
access-list 102 remark permit local network traffic
access-list 102 deny   ip host 255.255.255.255 any
access-list 102 deny   ip 127.0.0.0 0.255.255.255 any
access-list 102 permit ip 192.168.0.0 0.0.0.255 any
access-list 104 remark IPSec Rule outboubd tunnel traffic
access-list 104 permit ip 172.16.0.0 0.0.255.255 192.168.0.0 0.0.0.255
access-list 104 permit udp host b.b.b.b host a.a.a.a eq non500-isakmp
access-list 104 permit udp host b.b.b.b host a.a.a.a eq isakmp
access-list 104 permit esp host b.b.b.b host a.a.a.a
access-list 104 permit ahp host b.b.b.b host a.a.a.a
access-list 104 permit ip host b.b.b.b host a.a.a.a
access-list 104 deny   ip any any log
access-list 105 remark VTY access from admin ip
access-list 105 permit ip host b.b.b.b any
access-list 105 permit ip 192.168.0.0 0.0.255.255 any
access-list 105 deny   ip any any log
access-list 106 remark NAT rules
access-list 106 deny   ip 192.168.0.0 0.0.0.255 172.16.0.0 0.0.255.255
access-list 106 permit ip 192.168.0.0 0.0.0.255 any
no cdp run
route-map rmap_nat permit 1
match ip address 106
!
control-plane
!
дшту сon 0
login local
no modem enable
transport preferred all
transport output all
line aux 0
transport preferred all
transport output all
line vty 0 4
access-class 105 in
exec-timeout 2 0
privilege level 15
login local
length 0
transport preferred all
transport input telnet ssh
transport output all
!
scheduler max-task-time 5000
!
end

• Помогите определить в чем проблема с VPN, AlexDv, 15:37 , 11-Фев-05, (1)  
  • Помогите определить в чем проблема с VPN, mich, 17:44 , 11-Фев-05, (2)  
    • Помогите определить в чем проблема с VPN, AlexDv, 18:15 , 11-Фев-05, (3)