Есть сеть магазинов(cisco 871) с центральным офисом(cisco 2911). Подключаються по впн с ipsec. В магазинах закрыт доступ ко всему, только сервер и внутрешняя сеть. Весь трафик проходит через центральный офис с proxy squid. Поставили задачу открыть доступ к сайтам поиска работников. Сайт work.ua без проблем работает через прокси, а вот rabota.ua какая то ахинея-без картинок. Пробовал и мимо прокси ганять, в ацл прописывал
permit ip host xxx.xxx.xxx.xxx host 62.149.24.180 -тоже самое
а когда пишу permit ip host xxx.xxx.xxx.xxx any то все норм отображатся. Вывод-циска что-то блокирует, возможно порт или хз что, не могу разобраться. Помогите плз

r-ka#sh run
Building configuration...

Current configuration : 7715 bytes
!
! Last configuration change at 07:09:22 UTC Mon Jul 23 2018 by toor
version 15.1
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname r-ka
!
boot-start-marker
boot-end-marker
!
!
logging buffered 51200 warnings
!
no aaa new-model
!
memory-size iomem 10
crypto pki token default removal timeout 0
!
crypto pki trustpoint TP-self-signed-2830144771
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2830144771
revocation-check none
rsakeypair TP-self-signed-2830144771
!
!
crypto pki certificate chain TP-self-signed-2830144771
certificate self-signed 01
3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 32383330 31343437 3731301E 170D3133 30313239 31383335
30385A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D32 38333031
34343737 3130819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100AEDF 6C8BEDF9 E2E122FE 2305146B 2355C9F9 91FF2E9E B226534B F7F115D5
1B2B6805 E1094EA2 70AD455C AF250BB8 9228E497 09716712 E14447FF B33319BF
262F3268 2D482E03 13B43BDF 66813DA5 1A2C87F0 AD1713DD D3D04BDF 2AC84613
241009AD 08EF9BAD 03214195 6DBA231B 02407B39 8DD6F1B9 E882B188 8D736DB2
FB870203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603
551D2304 18301680 14B6B672 CAE7836C C0B2AA87 98E7FA36 64A8626E A8301D06
03551D0E 04160414 B6B672CA E7836CC0 B2AA8798 E7FA3664 A8626EA8 300D0609
2A864886 F70D0101 05050003 81810061 D09C20BA 3E773B30 291E80CF 9A57F622
27C21153 0398402A DFCCB763 D4FDD82F EC36C76A CC5EF940 ABB01CA4 9E52FBF9
AB128E4A E80E4C5C A2075E62 434F0E3F 9AFC21CD 1C59C63D C69A63CC 82EA0856
737DC6F4 5F741050 30E169EB AF282532 0F37BFD2 43B97F28 1215C32F A58C27F4
C95DA3C6 A39D9DF7 946F98B8 56D2D8
quit
ip source-route
!
!
!
!
!
ip cef
ip domain name 11111
ip name-server 192.168.0.11
ip inspect name SDM_LOW dns
ip inspect name SDM_LOW ftp
ip inspect name SDM_LOW h323
ip inspect name SDM_LOW https
ip inspect name SDM_LOW icmp
ip inspect name SDM_LOW imap
ip inspect name SDM_LOW pop3
ip inspect name SDM_LOW netshow
ip inspect name SDM_LOW rcmd
ip inspect name SDM_LOW realaudio
ip inspect name SDM_LOW rtsp
ip inspect name SDM_LOW esmtp
ip inspect name SDM_LOW sqlnet
ip inspect name SDM_LOW streamworks
ip inspect name SDM_LOW tftp
ip inspect name SDM_LOW tcp
ip inspect name SDM_LOW udp
ip inspect name SDM_LOW vdolive
no ipv6 cef
!
!
multilink bundle-name authenticated
license udi pid CISCO881-SEC-K9 sn FCZ1705C1Z0
!
!
username toor privilege 15 secret 4 Z36zR.KjAhQVbjJ7b0bCDVGU3IZeQILto.3Cqjd17g6
!
!
!
!
!
!
crypto isakmp policy 2
encr aes
authentication pre-share
group 2
crypto isakmp key 11111111111 address XXX.XXX.XXX.XXX
!
!
crypto ipsec transform-set IPSEC-TRANS esp-aes esp-sha-hmac
mode transport
!
crypto ipsec profile IPSEC-VTI-PROF
set transform-set IPSEC-TRANS
!
!
!
!
!
!
interface Tunnel0
description TO-OFFICE
ip address 10.1.1.42 255.255.255.252
ip mtu 1400
ip virtual-reassembly in
ip tcp adjust-mss 1360
keepalive 10 3
tunnel source FastEthernet4
tunnel mode ipsec ipv4
tunnel destination XXX.XXX.XXX.XXX
tunnel protection ipsec profile IPSEC-VTI-PROF
!
interface FastEthernet0
no ip address
!
interface FastEthernet1
no ip address
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface FastEthernet4
description $ETH-WAN$
ip address YYY.YYY.YYY.YYY 255.255.255.224
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface Vlan1
description $ETH_LAN$
ip address 192.168.1.161 255.255.255.240
ip access-group 101 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip flow ingress
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1412
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip nat inside source route-map SDM_RMAP_2 interface FastEthernet4 overload
ip route 0.0.0.0 0.0.0.0 ZZZ.ZZZ.ZZZ.ZZZ permanent
ip route 192.168.0.0 255.255.0.0 Tunnel0
!
access-list 101 remark auto generated by SDM firewall configuration
access-list 101 remark SDM_ACL Category=1
access-list 101 permit ip host 192.168.1.162 89.184.64.0 0.0.21.255
access-list 101 permit ip any host AAA.AAA.AAA.AAA
access-list 101 permit ip any host 62.149.24.180
access-list 101 remark office
access-list 101 permit ip any 192.168.0.0 0.0.255.255
access-list 101 deny ip host 255.255.255.255 any
access-list 101 deny ip 127.0.0.0 0.255.255.255 any
access-list 102 permit ip any host 185.157.77.177
access-list 102 permit ip host 192.168.1.162 89.184.64.0 0.0.21.255
access-list 102 permit ip any 192.168.0.0 0.0.255.255
access-list 102 deny ip 192.168.3.0 0.0.0.255 any
access-list 102 deny ip 10.1.1.0 0.0.0.3 any
access-list 102 deny ip host 255.255.255.255 any
access-list 102 deny ip 127.0.0.0 0.255.255.255 any
access-list 104 permit ip 192.168.1.160 0.0.0.15 any
no cdp run
!
!
!
!
route-map SDM_RMAP_2 permit 1
match ip address 104