Проблема такая, настроил тунель IPSEC с роутером Dlink-Di804HV
Но есть пролема, большая нагрузка на процессор.
Причину я выяснил - это в этой строчке
access-list 102 permit ip any any log
А именно в логах. Если приписывать это без логов
access-list 102 permit ip any any
То почему-то пакеты перестают ходить по тунелю, для меня это всегда останется загадкой.
Что можно сделать с IPSEC, чтобы не юзать логи?

Вот конфиг
---------------------------------------------------------------------------------

router#sh run
Building configuration...

Current configuration : 3067 bytes
!
version 12.4
service config
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service single-slot-reload-enable
!
hostname router
!
boot-start-marker
boot-end-marker
!
!
redundancy
enable secret 5 ********
!
aaa new-model
!
!
aaa authentication ppp default group radius
!
aaa session-id common
!
!
ip cef
ip domain name cisco.organization.ru
!
!
vpdn enable
!
vpdn-group 1
! Default PPTP VPDN group
accept-dialin
  protocol pptp
  virtual-template 1
!
!
username root password 0 ********
!
!
ip ssh time-out 60
ip ssh authentication-retries 2
!
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key key address 172.0.0.2
!
!
crypto ipsec transform-set SAMPLE_SET esp-3des
!
crypto map DI-804HV 4 ipsec-isakmp
set peer 172.0.0.2
set security-association lifetime seconds 28800
set transform-set SAMPLE_SET
set pfs group2
match address 101
!
!
!
interface Loopback0
ip address 1.1.1.1 255.255.255.255
!
interface FastEthernet0/0/0
ip address 172.0.0.1 255.255.255.0
ip access-group 102 in
ip nat outside
ip virtual-reassembly
half-duplex
crypto map DI-804HV
!
interface FastEthernet0/1/0
ip address 192.168.0.49 255.255.240.0
ip access-group 102 in
ip nat inside
ip virtual-reassembly
half-duplex
!
interface FastEthernet2/0/0
no ip address
shutdown
half-duplex
!
interface FastEthernet2/1/0
ip address 10.0.0.1 255.255.255.0
ip access-group 102 in
ip nat inside
ip virtual-reassembly
half-duplex
!
interface Virtual-Template1
ip unnumbered FastEthernet0/0/0
no ip proxy-arp
peer default ip address pool DHCP-VPN
ppp authentication ms-chap
!
ip local pool DHCP-VPN 192.168.14.1 192.168.14.254
ip forward-protocol nd
ip route 192.168.255.0 255.255.255.0 FastEthernet0/0/0
!
no ip http server
no ip http secure-server
!
ip nat inside source list NAT interface FastEthernet0/0/0 overload
ip nat inside source static tcp 1.1.1.1 23 172.0.0.1 23 extendable
ip nat inside source static tcp 1.1.1.1 1723 172.0.0.1 1723 extendable
!
!
ip access-list extended NAT
deny   ip 192.168.0.0 0.0.15.255 192.168.255.0 0.0.0.255
deny   ip 10.0.0.0 0.0.0.255 192.168.255.0 0.0.0.255
deny   ip 192.168.0.0 0.0.15.255 192.168.254.0 0.0.0.255
permit ip any any
access-list 101 permit ip 192.168.0.0 0.0.15.255 192.168.255.0 0.0.0.255
access-list 102 permit ip any any log
!
!
radius-server host 192.168.0.252 auth-port 1812 acct-port 1813 timeout 5
radius-server key key
!
control-plane
!
line con 0
line aux 0
line vty 0 4
password ********
transport input ssh
!
!
end
---------------------------------------------------------------------------------