Исходное сообщение
"IPSEC между Cisco Router и MS Forefront TMG" Отправлено msanlimit, 25-Янв-17 17:33
> И на роутере А - НЕТ НАТа, т.е. прописывается интересный трафик только > (он прописан)... Посмотри конфиги ниже, на основании твоей схемы. У меня туннель работает: TMG2010 crypto isakmp policy 1 encr aes authentication pre-share group 2 crypto isakmp key cisco address 99.99.37.29     ! crypto ipsec transform-set set esp-des esp-sha-hmac mode tunnel ! crypto map map 10 ipsec-isakmp set peer 99.99.37.29 set transform-set set match address 101 ! interface Loopback0 description local-NET ip address 172.16.1.1 255.255.255.0 ! interface GigabitEthernet0/1 description to-C2951_NAT ip address 192.168.11.3 255.255.255.0 crypto map map ! ip route 0.0.0.0 0.0.0.0 192.168.11.1 ! access-list 101 permit ip 172.16.1.0 0.0.0.255 10.72.1.0 0.0.0.255 С2951 NAT !         interface GigabitEthernet0/1 description to-INTERNET ip address 212.87.199.5 255.255.255.0 ip nat outside ! interface GigabitEthernet0/2 description to-TMG2010 ip address 192.168.11.1 255.255.255.0 ip nat inside ! ip nat inside source route-map nat interface GigabitEthernet0/1 overload ip route 0.0.0.0 0.0.0.0 212.87.199.6 ! route-map nat permit 10 match ip address 101 ! access-list 101 deny   ip 172.16.1.0 0.0.0.255 10.72.1.0 0.0.0.255 access-list 101 permit ip 172.16.1.0 0.0.0.255 any access-list 101 permit ip 192.168.11.0 0.0.0.255 any С2900 crypto isakmp policy 1 encr aes authentication pre-share group 2 crypto isakmp key cisco address 212.87.199.5   ! crypto ipsec transform-set set esp-des esp-sha-hmac mode tunnel ! crypto map map 10 ipsec-isakmp set peer 212.87.199.5 set transform-set set match address 101 ! interface Loopback0 description local-NET ip address 10.72.1.1 255.255.255.0 ! interface GigabitEthernet0/1 description to-INTERNET ip address 99.99.37.29 255.255.255.0 crypto map map ! ip route 0.0.0.0 0.0.0.0 99.99.37.28 ! access-list 101 permit ip 10.72.1.0 0.0.0.255 172.16.1.0 0.0.0.255