[求助]关于两台cisco ASA 5520做ipsec vpn问题（问题已解决）

各位大大，请帮看下我的两台cisco ASA 5520做ipsec vpn问题，一个在南昌，一个在广州，他们之间做点对点的ipsec vpn，请看拓扑图（两端公网地址随意用了其他地址替换了）：

两边网络单独都是通的，都没问题，都用上业务了，而且两边网络都有remote ipsec vpn，可以连接使用，现在就是两边做点对点的ipsec vpn不行，配置我是按照cisco官网上的例子来配的，但是不行，用show crypto isakmp sa和show crypto ipsec sa查看了，没连接，连两端加密认证协商都没能进行，麻烦各位大大帮看看：
. B( o0 I2 X3 ~( w南昌ASA：
6 _1 i+ h" |8 h, z+ h9 e
conf t
" I; C( z5 B- t+ F8 @5 Laccess-list no-nat extended permit ip 10.10.0.0 255.255.240.0 10.10.20.0 255.255.255.0
access-list no-nat extended permit ip 172.0.0.0 255.255.255.0 10.10.20.0 255.255.255.0
4 m/ q( `; n# q$ K, v% ?7 M' z
, T9 \4 \( c" _# G5 u% f1 Raccess-list nctogzvpn extended permit ip 172.0.0.0 255.255.255.0 10.10.20.0 255.255.255.0
access-list nctogzvpn extended permit ip 10.10.0.0 255.255.240.0 10.10.20.0 255.255.255.0
3 [2 F; I1 L2 Z  J$ x' r
- c4 Y3 m5 b" }8 ]2 z. Gcrypto isakmp policy 30
' q* X1 n- M" l9 wauthentication pre-share
encryption des
" Q! l6 p5 [& k2 vhash sha
+ I% L' y1 u5 |: b1 g. Igroup 2
0 n. |( ^$ r; ?; T- D" ~9 k0 m7 Gexit
, f% L! \: v2 A% P( B
0 K1 U. j) h; mcrypto ipsec transform-set nctogztrans esp-des esp-sha-hmac
crypto map vpnpeer 60 set pfs
2 R4 u, A' I) Qcrypto map vpnpeer 60 set transform-set nctogztrans
crypto map vpnpeer 60 set peer 59.59.59.60
crypto map vpnpeer 60 match address nctogzvpn
) e* ]+ C" O& D& c- y8 Q# M
# i# C3 K2 i4 H- [, |tunnel-group 59.59.59.60 type ipsec-l2l
tunnel-group 59.59.59.60 ipsec-attributes
/ Z7 q- o# {; V' X pre-shared-key nctogz
/ H% n! [, y% y$ Yexit
5 ?. v) ?6 l# i5 R7 E9 V4 R! tcrypto map vpnpeer interface outside
- I& k( f8 A- c8 F1 o: o0 l- M
7 s* Z. |9 ~  N& A/ B, h广州ASA：

conf t
access-list nonat extended permit ip 10.10.20.0 255.255.255.0 10.10.0.0 255.255.240.0
/ N4 I0 r& y2 m6 y( m! faccess-list nonat extended permit ip 192.168.2.0 255.255.255.0 10.10.0.0 255.255.240.0
access-list nonat extended permit ip 10.10.20.0 255.255.255.0 172.0.0.0 255.255.255.0
access-list nonat extended permit ip 192.168.2.0 255.255.255.0 172.0.0.0 255.255.255.0

* d1 R& F* G2 d  b* Kaccess-list nctogzvpn extended permit ip 10.10.20.0 255.255.255.0 10.10.0.0 255.255.240.0
- Q6 h$ y5 S- _+ T; D/ g7 c( ^access-list nctogzvpn extended permit ip 192.168.2.0 255.255.255.0 10.10.0.0 255.255.240.0
' g8 ]" p" q+ O$ T: d# iaccess-list nctogzvpn extended permit ip 10.10.20.0 255.255.255.0 172.0.0.0 255.255.255.0
8 n: k5 ^9 |7 x% R* P% [4 \& Laccess-list nctogzvpn extended permit ip 192.168.2.0 255.255.255.0 172.0.0.0 255.255.255.0
! n. F8 r* Q7 S" l5 f& n
5 I- x  ]8 s& ?3 `+ c8 g# q2 acrypto isakmp policy 30
. J- w% B7 P) O  d) iauthentication pre-share
, G; _& j  j3 Uencryption des
: ^. F, ?5 p0 t: }; u2 thash sha
9 v3 r  H' {- ?6 r7 c. egroup 2
& b1 e; l- ]: u$ \# T6 Jexit
4 c% n  `8 y6 r) ~6 |
2 h( _+ _1 B) M3 ncrypto ipsec transform-set nctogztrans esp-des esp-sha-hmac
crypto map vpnpeer 60 set pfs
crypto map vpnpeer 60 set transform-set nctogztrans
crypto map vpnpeer 60 set peer 59.59.59.59
+ M+ }. x7 R& l5 _; u' Hcrypto map vpnpeer 60 match address nctogzvpn

tunnel-group 59.59.59.59 type ipsec-l2l
, N- x' d6 R$ _5 n& A1 ^9 T; ltunnel-group 59.59.59.59 ipsec-attributes
pre-shared-key nctogz
$ `- t# x& b- @1 l. p/ M- Z# z$ gexit
crypto map vpnpeer interface outside
9 `0 Y7 H0 J% }. N* \% ^
两个ASA一个是asa8.2，一个是asa7.2
麻烦各位大大帮看下能找出什么问题吗？两边单独的remote ipsec vpn是正常可以用的，跪求。。。

连两端加密认证协商都没能进行,说明nonat 有问题，sh xlate查看, 应该是去做ＮＡＴ去了。还有去掉ＰＦＳ试试。最好有完整的配置。

引用:                                                                                                                                作者: tailor                                                                                                                                                                                                        连两端加密认证协商都没能进行,说明nonat 有问题，sh xlate查看, 应该是去做ＮＡＴ去了。还有去掉ＰＦＳ试试。最好有完整的配置。                                                                                                                应该不是nonat的问题，因为我tracert的时候不是走的公网，而是直接经过了三层交换机后，显示无路可走，以下是两个asa的show xlate：
; b( b; y2 ]$ z" {# z: t* Zshow xlate
11 in use, 652 most used
: q) x5 w! Z* f# @5 L; l1 t6 hGlobal 58.17.4.115 Local 10.10.10.99
0 {& P" F4 N( }) V! aGlobal 58.17.4.126 Local 10.10.10.192
% A% r* e- o1 F9 c* H. S! tPAT Global 59.59.59.59(16290) Local 10.10.10.97(20094)
PAT Global 59.59.59.59(16289) Local 10.10.10.97(45453)
PAT Global 59.59.59.59(16288) Local 10.10.10.97(61475)
PAT Global 59.59.59.59(16287) Local 10.10.10.97(53325)
PAT Global 59.59.59.59(16286) Local 10.10.10.97(45094)
; e* n0 x# z& T6 k+ BPAT Global 59.59.59.59(16285) Local 10.10.10.97(24528)
  w# R1 ~, }, W* RPAT Global 59.59.59.59(16284) Local 10.10.10.98(57000)
PAT Global 59.59.59.59(16283) Local 10.10.10.98(22722)
! x9 X- z+ d/ l! H1 X7 PPAT Global 59.59.59.59(16282) Local 10.10.10.98(25946)
% F+ c* E" C1 O' U
0 F& t$ m; N) [& i( P$ H3 dshow xlate
7 in use, 200 most used
, W) I; Z  U2 f: f4 d3 L; HGlobal 59.59.59.244 Local 10.10.20.4
, s( y' v+ E/ }5 U* }% f. }Global 59.59.59.245 Local 10.10.20.5
Global 59.59.59.243 Local 10.10.20.3
Global 59.59.59.246 Local 10.10.20.6
Global 59.59.59.247 Local 10.10.20.7
Global 59.59.59.248 Local 10.10.20.8

两个ASA的配置，公网地址被我替换了，如有雷同，敬请原谅，麻烦兄弟们帮我看看：
- M6 f# k! i3 j! ?6 O. n6 g; [* i1 K南昌ASA：
* a6 o3 ^! M) d/ K, D$ nASA Version 7.2(3)
!
hostname DIYFW
domain-name tpybank.com
8 H- ~( V: |6 A9 t% N- ienable password 7qs4CxXJz.NTdDlq encrypted
- N, S: }5 m! K2 Xnames
!
interface GigabitEthernet0/0
nameif outside
security-level 0
  q4 c, D8 X6 g, L" O ip address 59.59.59.59 255.255.255.0
9 B5 z4 |7 w) J% f9 c$ D!
interface GigabitEthernet0/1
nameif inside
2 [! }4 Q. \% m security-level 100
ip address 172.0.0.1 255.255.255.0
2 Y( U8 I1 S6 I4 `/ K: j0 G5 r' E!
interface GigabitEthernet0/2
shutdown
0 {: S) |. B* H9 F* A no nameif
no security-level
+ G& |- z) w4 {4 k6 k" Y& s" y8 T no ip address
!
interface GigabitEthernet0/3
no nameif
no security-level
no ip address
1 W1 l7 M- G& ^4 M3 C! x4 I!
; o0 C$ W" Q2 K9 r  ~+ c' }6 e" `interface Management0/0
shutdown
6 E' a0 ^+ Q7 U  [# p no nameif
6 q$ G6 b& W# f; s' y no security-level
no ip address
9 Y9 T* J4 K# F4 }4 [$ H1 ]; _!
passwd 2KFQnbNIdI.2KYOU encrypted
& s7 X" ~2 Y9 ?9 w3 |ftp mode passive
7 _0 y% I% N; y- M3 bdns server-group DefaultDNS
/ n& H7 b1 U0 I domain-name tpybank.com
access-list outside extended permit ip any any
access-list inside extended permit ip any any
access-list inside extended permit icmp any any
# s/ g/ l, F. P  x" iaccess-list vpnclient standard permit 10.10.0.0 255.255.240.0
+ U0 M1 q9 c7 B/ D# _  x( Q0 `" aaccess-list vpnclient standard permit 172.0.0.0 255.255.255.0
0 ~( G6 X8 Z# N0 a3 ?access-list ipsecclient standard permit any
access-list 100 extended permit ip 10.10.10.0 255.255.255.0 any
access-list 101 extended permit ip any any
) n5 [: u2 R/ {& u( }6 z" Zaccess-list jcsh-group_splitTunnelAcl standard permit any
access-list outside1 extended permit ip any any
access-list no-nat extended permit ip 172.16.0.0 255.255.255.0 172.31.255.0 255.255.255.0
access-list no-nat extended permit ip 10.10.0.0 255.255.240.0 172.31.255.0 255.255.255.0
access-list no-nat extended permit ip 10.10.0.0 255.255.240.0 10.10.20.0 255.255.255.0
+ {7 S$ V, W4 J9 p9 Aaccess-list no-nat extended permit ip 172.0.0.0 255.255.255.0 10.10.20.0 255.255.255.0
access-list nctogzvpn extended permit ip 10.10.0.0 255.255.240.0 10.10.20.0 255.255.255.0
9 v0 q) {  h$ v: `5 {4 l4 s# Daccess-list nctogzvpn extended permit ip 172.0.0.0 255.255.255.0 10.10.20.0 255.255.255.0
* z. d" z! `" E/ Z! n9 Ypager lines 24
logging enable
logging monitor debugging
logging buffered debugging
logging trap debugging
" W1 l9 X% m% S2 Qlogging asdm informational
. G$ m9 |" E+ ~5 klogging host inside 10.10.10.179
mtu outside 1500
mtu inside 1500
ip local pool ipsecvpnpool 172.31.255.0-172.31.255.254 mask 255.255.255.0
ip verify reverse-path interface outside
/ ^7 R) ^8 f1 y/ N& O0 R" k! I' i" pno failover
. y5 P1 L: Z( g1 Ficmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
4 ]8 |$ b, P! K  ^* t2 _, |icmp permit any inside
- V5 R, D& N' K- Wasdm image disk0:/ASDM-523.BIN
no asdm history enable
arp timeout 14400
3 N; H  V8 T; m. G8 m; Mglobal (outside) 101 interface
, H( U+ o7 c4 O8 T3 qnat (inside) 0 access-list no-nat
nat (inside) 101 0.0.0.0 0.0.0.0
! P, H9 ]$ V5 @. f7 Z: astatic (inside,outside) 59.59.59.115 10.10.10.99 netmask 255.255.255.255
static (inside,outside) 59.59.59.126 10.10.10.192 netmask 255.255.255.255
# \$ Q) }) Q0 M, W- kaccess-group outside in interface outside
) R3 I$ _: R" ?7 `0 }4 Yaccess-group inside in interface inside
route outside 0.0.0.0 0.0.0.0 59.59.59.1 1
route inside 10.10.0.0 255.255.240.0 172.0.0.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
+ {) F4 ~5 F* h/ ~) K7 }3 qtimeout uauth 0:05:00 absolute
% ^/ j) G- Q& G' a% `, L; \aaa authentication ssh console LOCAL
' U, Z7 k2 s' ^; b/ j  {4 Ohttp server enable
$ Y* c, c' `! r' Y2 b/ Ahttp 0.0.0.0 0.0.0.0 outside
4 e$ ]" `6 V# S' nsnmp-server host inside 10.10.10.19 community typ100
. n; U# ~3 L7 Vno snmp-server location
no snmp-server contact
4 P( s1 x3 g; U) b) U6 Ssnmp-server enable traps snmp authentication linkup linkdown coldstart
snmp-server enable traps syslog
snmp-server enable traps ipsec start stop
snmp-server enable traps entity config-change fru-insert fru-remove
snmp-server enable traps remote-access session-threshold-exceeded
service resetoutside
crypto ipsec transform-set dialvpn esp-des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set TRANS_ESP_DES_SHA esp-des esp-sha-hmac
crypto ipsec transform-set TRANS_ESP_DES_SHA mode transport
crypto ipsec transform-set nctogztrans esp-des esp-sha-hmac
" t6 a6 F1 Q) K7 @crypto dynamic-map dynomap 10 set transform-set dialvpn
3 i3 U5 W5 B0 B8 wcrypto dynamic-map dynomap 10 set reverse-route
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-DES-SHA
crypto dynamic-map outside_dyn_map 40 set pfs
crypto dynamic-map outside_dyn_map 40 set transform-set TRANS_ESP_DES_SHA
crypto map vpnpeer 10 ipsec-isakmp dynamic dynomap
% o% ?0 ^* q* ncrypto map vpnpeer 60 match address nctogzvpn
crypto map vpnpeer 60 set peer 59.59.59.60
crypto map vpnpeer 60 set transform-set nctogztrans
crypto map vpnpeer interface outside
" \* p0 N# F6 H& y- Ocrypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
0 \' L- R' D# w$ h, hcrypto isakmp identity address
, F/ R; \- G# a3 ^6 ccrypto isakmp enable outside
, E5 b: k& @, [1 C$ {3 ccrypto isakmp policy 1
6 G7 Q7 f: r) B: S, _1 V* @5 ~ authentication pre-share
encryption des
hash md5
group 2
lifetime 86400
crypto isakmp policy 30
% }% E1 o- ?( A8 T' v authentication pre-share
/ m1 v# r6 T" o7 ^0 h& x5 f3 j encryption des
hash sha
1 O( ~$ d: K" U) Y6 D5 n; ?) }7 P+ r group 2
lifetime 86400
+ I4 J3 C' a; H: Z+ b: B6 z! f5 ucrypto isakmp policy 50
authentication crack
encryption des
hash sha
group 2
lifetime 86400
crypto isakmp nat-traversal  20
vpn-sessiondb max-session-limit 450
% J' a- ^6 ?2 [, R) jtelnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 5
ssh version 1
console timeout 0
& }8 w5 e& W$ \4 c6 ?7 dpriority-queue inside
/ {8 r' p2 n6 W; t/ l; L!
class-map limitconnect
match access-list 101
- Z! `- b$ {, s& Z' s* z8 Gclass-map QOS
match access-list 100
class-map type inspect http match-all httpfilter
1 X  \0 I% e% [8 q" ? match req-resp content-type mismatch
match request header allow length gt 5000
! R/ r5 D) Y, h9 [* ~: [0 R. J match response header count gt 200
match request uri length gt 1000
class-map type inspect ftp match-all ftpfilter
) K; {" L1 s9 v7 G3 ?' R match request-command mkd
# Y* a$ e1 d- u% h+ v; {2 f* a  U. l( eclass-map inspection_default
4 ^# f) Y3 b% W3 A3 W# z2 G2 d match default-inspection-traffic
class-map flitcontent
match access-list 100
!
!
$ k5 h! `& y8 R+ e) t7 s+ @. q2 bpolicy-map limitconnect
3 q" p, z, ~2 K' v6 t, A; w& `/ `( a class limitconnect
0 y6 s6 }# `# F3 C  set connection conn-max 30000
policy-map QOS
class QOS   
class limitconnect
  set connection conn-max 30000
policy-map global_policy
5 S+ j) Q! F) l! b5 s& g class inspection_default
  inspect ftp
! L* W8 R  |% O2 C) Q  inspect h323 h225
  inspect h323 ras
  inspect rsh
) @8 W) p8 P( q2 @% ^  inspect rtsp
* j) q6 m7 v! h' N0 E) k  inspect esmtp
  inspect sqlnet
- e5 X# D% ^! m2 ^  inspect skinny
$ V8 `3 \/ Y' j  inspect sunrpc
  inspect xdmcp
" r" @" y% p/ X  inspect sip
8 P' X( I( E2 a( x* a  inspect netbios
" G9 \) v$ m1 R2 Y+ _2 C# }! k  inspect tftp
& n4 u  U4 e4 f& K" P; |& L  inspect icmp
3 M7 |2 l- j0 spolicy-map flitcontent
class flitcontent
# J( J; M3 K2 u' y$ z1 W& K5 Y; {!
service-policy global_policy global
service-policy QOS interface inside
, F' l) Y; ?  c+ [1 ^group-policy sk-group internal
3 Y1 k$ T) z# l% U6 T; Wgroup-policy sk-group attributes
7 D) p3 V; n5 m/ [; m/ A split-tunnel-policy tunnelspecified
1 f1 x  I. U( C" f0 H4 F( q split-tunnel-network-list value vpnclient
3 ~- n- E( v( Uusername vpnuser password ZC2U2lwElxOuM0y+z/4mXg== nt-encrypted privilege 0
/ @; F( C, G) t* y4 d9 nusername networker password Ge08R8/YEb1oXNI9 encrypted privilege 0
/ }, w8 ]! T( ]7 }4 n" B3 Ltunnel-group sk-group type ipsec-ra
tunnel-group sk-group general-attributes
( |8 D* E( d. P% f5 W address-pool ipsecvpnpool
# n; y0 h: O) G# h7 L) | default-group-policy sk-group
tunnel-group sk-group ipsec-attributes
pre-shared-key *
tunnel-group 59.59.59.60 type ipsec-l2l
tunnel-group 59.59.59.60 ipsec-attributes
6 S; n1 r5 p- j5 i% g0 W pre-shared-key *
prompt hostname context
Cryptochecksum:200b24ebb637185e77dc3623b20a596a
, P! X2 t9 E& R# c. R: e5 |: end


" j( ?  R- S( `7 ?  ~" j" N  y广州ASA：
ASA Version 8.2(4)
!
hostname GZFW
domain-name tpy100.com
& {* C$ ?7 \' Menable password r2GUYr0JBoB38neH encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
: m1 R" b: c, v4 z% Z9 W8 S7 b, n) Xnames
!
! Q: N+ E0 }/ Sinterface GigabitEthernet0/0
. u. w8 l0 B) O& I% d- D- G; H nameif outside
security-level 0
ip address 59.59.59.60 255.255.255.240
!
6 P- O+ P8 N) q# vinterface GigabitEthernet0/1
nameif inside
security-level 100
ip address 10.10.20.254 255.255.255.0
!
4 \6 [& i# z6 k4 Cinterface GigabitEthernet0/2
, K5 h! ~- v. E2 O7 G8 Y# Y no nameif
no security-level
6 E( ]- p! z% U no ip address
!
0 r# B' L& y3 y$ `9 ointerface GigabitEthernet0/3
no nameif
no security-level
. Z5 l7 P# l5 Y" l# Z( f4 V% u, Z. J no ip address
. q- I% O) A1 F5 j4 v( `& _0 {!
interface Management0/0
& m& A6 D% t' `* ? nameif management
security-level 100
; Y9 V2 R% r* f1 l" C5 x5 x1 Y ip address 192.168.51.254 255.255.255.0
( P* \& H! j: u0 A% h" n* @ management-only
/ y2 {! s" J& `7 K1 R8 l!
boot system disk0:/asa824-k8.bin
; y8 g9 N  X6 G2 E/ aftp mode passive
5 F2 z- R4 O1 d' K# ?. r) n( k  W, _. ?clock timezone CST 8
dns server-group DefaultDNS
, @: C1 S5 W( b! E domain-name tpy100.com
- Y7 u( B8 c3 haccess-list outside extended permit ip any any
$ b) O# j+ _) W" Z, J$ Paccess-list outside extended permit icmp any any
3 S/ J3 w& y& K& ]* Xaccess-list outside extended permit tcp any any
% j- x2 }2 {" v7 c( xaccess-list outside extended permit udp any any
access-list inside extended permit ip any any
4 t/ u8 S; r( W$ b7 daccess-list inside extended permit icmp any any
access-list nonat extended permit ip 10.10.20.0 255.255.255.0 10.120.19.0 255.255.255.0
access-list nonat extended permit ip 192.168.2.0 255.255.255.0 10.120.19.0 255.255.255.0
, k/ _: H! ]7 p; xaccess-list nonat extended permit ip 192.168.51.0 255.255.255.0 10.120.19.0 255.255.255.0
' a& K8 G3 W, u; h, n2 Aaccess-list nonat extended permit ip 10.10.20.0 255.255.255.0 10.10.0.0 255.255.240.0
access-list nonat extended permit ip 192.168.2.0 255.255.255.0 10.10.0.0 255.255.240.0
access-list nonat extended permit ip 10.10.20.0 255.255.255.0 172.0.0.0 255.255.255.0
access-list nonat extended permit ip 192.168.2.0 255.255.255.0 172.0.0.0 255.255.255.0
access-list vpn-client standard permit 10.10.20.0 255.255.255.0
/ z4 b' J& j8 N: ?access-list vpn-client standard permit 192.168.2.0 255.255.255.0
5 W. U9 x8 Y- q; E6 L! t3 Baccess-list vpn-client standard permit 192.168.51.0 255.255.255.0
1 L+ A* G6 g0 G8 @3 e/ n, \access-list nctogzvpn extended permit ip 10.10.20.0 255.255.255.0 10.10.0.0 255.255.240.0
access-list nctogzvpn extended permit ip 192.168.2.0 255.255.255.0 10.10.0.0 255.255.240.0
access-list nctogzvpn extended permit ip 10.10.20.0 255.255.255.0 172.0.0.0 255.255.255.0
access-list nctogzvpn extended permit ip 192.168.2.0 255.255.255.0 172.0.0.0 255.255.255.0
3 }2 @0 d: W7 e: B- R% Hpager lines 24
  l9 [. J' t0 T& l2 ?+ P( G- Nlogging enable
logging asdm informational
) |" ~/ x( {( Y5 dmtu outside 1500
mtu inside 1500
mtu management 1500
1 ?. v& B' v- ?* o3 H1 O& Qip local pool vpnpool 10.120.19.1-10.120.19.254 mask 255.255.255.0
no failover
* i" X( W2 x% Xicmp unreachable rate-limit 1 burst-size 1
6 {. {' y& c# M. j4 A2 z/ zicmp permit any outside
icmp permit any inside
% A1 E; r& F1 C1 D" `6 ~+ |asdm image disk0:/asdm-641.bin
no asdm history enable
# u! I" X" t# O  q7 Barp timeout 14400
# E1 B1 W! N" v& o9 `2 xglobal (outside) 101 interface
nat (inside) 0 access-list nonat
nat (inside) 101 0.0.0.0 0.0.0.0
- Q9 p+ d& j* H4 H1 Z) Jstatic (inside,outside) 59.59.59.244 10.10.20.4 netmask 255.255.255.255
3 Y6 C) a- h  X2 r" lstatic (inside,outside) 59.59.59.245 10.10.20.5 netmask 255.255.255.255
static (inside,outside) 59.59.59.243 10.10.20.3 netmask 255.255.255.255
6 b) q1 ~$ T% S5 o, f! sstatic (inside,outside) 59.59.59.246 10.10.20.6 netmask 255.255.255.255
% I, T8 m+ f: n6 [static (inside,outside) 59.59.59.247 10.10.20.7 netmask 255.255.255.255
# C# t. C/ Q% ^- ostatic (inside,outside) 59.59.59.248 10.10.20.8 netmask 255.255.255.255
9 D8 K0 ^* F! d1 }static (inside,outside) 59.59.59.249 192.168.2.101 netmask 255.255.255.255
access-group outside in interface outside
: ^3 y6 T( k5 _3 p" ~( |access-group inside in interface inside
route outside 0.0.0.0 0.0.0.0 59.59.59.241 1
route inside 192.168.2.0 255.255.255.0 10.10.20.1 1
& o, I2 S: ]) |: V6 c& ctimeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
9 b+ E: v2 w9 Qtimeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
2 E$ W5 j) y3 gaaa authentication telnet console LOCAL
http server enable
5 V! \1 f, F" J# Q+ x9 S* B" Qhttp 0.0.0.0 0.0.0.0 inside
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
, p2 N; Z" _6 Gno snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
; C: _% S% p6 p! Xcrypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
+ [/ G# s) l0 i% x0 a4 dcrypto ipsec transform-set TRANS_ESP_DES_SHA esp-des esp-sha-hmac
0 X4 a9 m4 A% f5 Qcrypto ipsec transform-set TRANS_ESP_DES_SHA mode transport
crypto ipsec transform-set nctogztrans esp-des esp-sha-hmac
% Q2 \6 u: A6 O; E* `. T& _" \9 ]9 ocrypto ipsec security-association lifetime seconds 28800
# w/ _2 D5 K8 K6 l- n4 T& ccrypto ipsec security-association lifetime kilobytes 4608000
$ @% ?. I: Y& K' C! [, ycrypto dynamic-map dynomap 10 set transform-set ESP-DES-MD5
crypto map vpnpeer 10 ipsec-isakmp dynamic dynomap
crypto map vpnpeer 60 match address nctogzvpn
9 N, J& z6 R4 u' ^! f/ Rcrypto map vpnpeer 60 set peer 59.59.59.59
# s" w! Y2 n" _4 U! x" ocrypto map vpnpeer 60 set transform-set nctogztrans
2 Z/ Q* U& ]# i2 U  zcrypto map vpnpeer interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
( p5 ]- f0 n4 N- M encryption des
- F8 B* _, c; [. X0 d+ i/ w3 j hash md5
% u; e0 @  S* F/ c; A+ I group 2
lifetime 86400
crypto isakmp policy 30
authentication pre-share
encryption des
hash sha
group 2
8 I& F8 v! c7 t' Z. ?) f$ ~  ^" j lifetime 86400
telnet 0.0.0.0 0.0.0.0 inside
. f6 d& I! c  U1 P( r( n- \. g, I. Ltelnet timeout 5
1 A5 ]( z% E2 c$ s2 o7 Essh 0.0.0.0 0.0.0.0 outside
" d7 B- F* A" N+ ~0 p$ q0 Fssh 0.0.0.0 0.0.0.0 inside
6 J0 f; P/ K% W( @$ d0 |+ u& Wssh timeout 5
ssh version 1
console timeout 0
management-access management
threat-detection basic-threat
threat-detection statistics access-list
8 y3 h) D; ^5 O) r' V. b4 v5 T; Pno threat-detection statistics tcp-intercept
2 R, B1 A/ y/ R4 |. t# Q2 S, ]webvpn
- a5 ]3 x: H9 v6 kgroup-policy betterlife internal
group-policy betterlife attributes
6 D9 ]) O; c* d! p% o( N vpn-tunnel-protocol IPSec l2tp-ipsec
2 y3 @; j: `- Q2 Y) X) D split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpn-client
username vpnuser password 35y3osDoYvzwb04ktFQIgA== nt-encrypted
) L) Q; ~3 g+ A! c4 gusername vpnuser attributes
service-type remote-access
username networker password oDfhMUGcNlh2Hyjp encrypted privilege 0
tunnel-group betterlife type remote-access
tunnel-group betterlife general-attributes
address-pool vpnpool
default-group-policy betterlife
  f' {0 e8 F. p$ I2 C; \3 y( z- htunnel-group betterlife ipsec-attributes
pre-shared-key *****
tunnel-group 59.59.59.59 type ipsec-l2l
tunnel-group 59.59.59.59 ipsec-attributes
; a4 L, V& B; S8 _ pre-shared-key *****
!
class-map inspection_default
! u7 ^& Z: G" k9 o/ }8 D match default-inspection-traffic
3 i2 P! |$ D0 |! ]$ K% z!
!
policy-map global_policy
  D& ^' D3 b( y  t5 ]/ I class inspection_default
  inspect ftp
- i8 k0 `! ?+ a0 ~: O5 K  inspect h323 h225
  inspect h323 ras
$ Q+ C- i, r  H  c8 P6 m( S  r+ Y! |  inspect rsh
  inspect rtsp
  inspect esmtp
- T+ o1 j3 ~0 q* G8 z" D& L  inspect sqlnet
- P" U- N6 b! |( u. p# Z  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect netbios
  inspect tftp
# a. @! |2 M, Y( @0 q- u; w5 O  inspect icmp
!
% H3 c; u6 V4 h7 l3 z9 Z2 f6 f7 [service-policy global_policy global
0 T# m' o8 Y  h6 V0 d1 \5 r2 e6 lprompt hostname context
3 A  G% T; s6 D2 U2 I) Icall-home
1 U, T- e' b$ }- ^+ `) R/ ]- ~( Q* g profile CiscoTAC-1
  no active
. n; W$ i3 u, h$ m, V; x8 b  destination address http https://tools.cisco.com/its/service/...es/DDCEService
  destination address email callhome@cisco.com
/ F+ [& @! Z2 Z! v) Y6 I  E7 P  destination transport-method http
  subscribe-to-alert-group diagnostic
- [' K5 T# H8 @2 e  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
) a" }# r, N3 h  subscribe-to-alert-group configuration periodic monthly
2 M) h& e5 e' A% \, o0 N( ^, C. k8 S  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:3321c1f8720e4ec4583796ab04d8f0fe
: end

在线等高手帮看看啊~~~

跪求帮看下怎么回事，谢谢

跪求帮看下怎么回事，谢谢，查了好几天了都没找到原因。。。

crypto map vpnpeer 10 ipsec-isakmp dynamic dynomap 应该放在最后，如crypto map vpnpeer 65535 ipsec-isakmp dynamic dynomap。还有两边的ＡＣＬ不对称。
# q7 ~+ o& `. j* j8 P! K, Yaccess-list nctogzvpn extended permit ip 10.10.0.0 255.255.240.0 10.10.20.0 255.255.255.0
access-list nctogzvpn extended permit ip 172.0.0.0 255.255.255.0 10.10.20.0 255.255.255.0

access-list nctogzvpn extended permit ip 10.10.20.0 255.255.255.0 10.10.0.0 255.255.240.0
/ h3 j: G/ j6 C3 Z: j5 Haccess-list nctogzvpn extended permit ip 192.168.2.0 255.255.255.0 10.10.0.0 255.255.240.0
access-list nctogzvpn extended permit ip 10.10.20.0 255.255.255.0 172.0.0.0 255.255.255.0
access-list nctogzvpn extended permit ip 192.168.2.0 255.255.255.0 172.0.0.0 255.255.255.0
后一个问题不是很关键，对一些６.x 版本的ＯＳ会有问题。

谢谢楼上那位大神啊，问题已解决，ACL不是问题的主因，主因是动态map和静态map的序列号，试过了，当动态map序列号比静态map序列号小，则静态map即点对点ipsec vpn用不了，配置时也会提示，所以动态map序列号比静态map序列号大才行。以上是我的说法，不知道对不对。
我是先配的动态map及remote ipsec vpn，然后配的静态map即点对点ipsec vpn，所以导致后来出现问题一直找不到原因，两边整体配置我就不重发了，我是直接把crypto map vpnpeer 10 ipsec-isakmp dynamic dynomap 改成了crypto map vpnpeer 65535 ipsec-isakmp dynamic dynomap，问题就解决了，show isakmp sa也能看到两边的协商认证后的连接情况，acl也稍微修改了下以使两边内网能正常通信。
  `1 ?5 P& m, p& p( R再次非常感谢tailor大神！

学艺不精啊，以后要多多学习哇。。。