YilinChen 发表于 2017-10-27 16:29
听说过 DMVPN 么？
您好 我做的是IPSEC 总部和两个分支 都可以通讯，然后 我把分支有相互对指了一下，隧道也起来，但是就不是不能PING 通
new-asa(config)# sh crypto ipsec sa
interface: outside
Crypto map tag: csd, seq num: 13, local addr:
access-list vpn-new permit ip 172.16.30.0 255.255.255.0 172.16.10.0 255.255.255.0
local ident (addr/mask/prot/port): (172.16.30.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (172.16.10.0/255.255.255.0/0/0)
current_peer:
#pkts encaps: 92, #pkts encrypt: 92, #pkts digest: 92
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 92, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#send errors: 0, #recv errors: 0
local crypto endpt.: 122., remote crypto endpt.: 140
path mtu 1500, ipsec overhead 58, media mtu 1500
current outbound spi: BC2F1E8B
inbound esp sas:
spi: 0x4289D274 (1116328564)
transform: esp-3des esp-md5-hmac no compression
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 610304, crypto-map: csd
sa timing: remaining key lifetime (kB/sec): (3915000/28709)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
outbound esp sas:
spi: 0xBC2F1E8B (3157204619)
transform: esp-3des esp-md5-hmac no compression
in use settings ={L2L, Tunnel, }
slot: 0, conn_id: 610304, crypto-map: csd
sa timing: remaining key lifetime (kB/sec): (3914992/28709)
IV size: 8 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
