[求助]关于两台cisco ASA 5520做ipsec vpn问题（问题已解决）

各位大大，请帮看下我的两台cisco ASA 5520做ipsec vpn问题，一个在南昌，一个在广州，他们之间做点对点的ipsec vpn，请看拓扑图（两端公网地址随意用了其他地址替换了）：

两边网络单独都是通的，都没问题，都用上业务了，而且两边网络都有remote ipsec vpn，可以连接使用，现在就是两边做点对点的ipsec vpn不行，配置我是按照cisco官网上的例子来配的，但是不行，用show crypto isakmp sa和show crypto ipsec sa查看了，没连接，连两端加密认证协商都没能进行，麻烦各位大大帮看看：
南昌ASA：

9 |( H5 J& u0 Y) f, H% e. B4 i+ Jconf t
6 T( B8 U2 U/ F! @( S$ C& e$ N6 }% Waccess-list no-nat extended permit ip 10.10.0.0 255.255.240.0 10.10.20.0 255.255.255.0
! M5 m' s' U% H5 r* w: aaccess-list no-nat extended permit ip 172.0.0.0 255.255.255.0 10.10.20.0 255.255.255.0

) K7 |* {3 g% s/ zaccess-list nctogzvpn extended permit ip 172.0.0.0 255.255.255.0 10.10.20.0 255.255.255.0
access-list nctogzvpn extended permit ip 10.10.0.0 255.255.240.0 10.10.20.0 255.255.255.0
) _8 N: b5 ~1 x+ J& M& @
. ~! w9 P9 @: R! M: }& p: fcrypto isakmp policy 30
& i6 l& g+ l6 a$ X% j6 a- iauthentication pre-share
encryption des
hash sha
group 2
7 A; W$ ]% ^& t6 Y6 Dexit

, o. Y% M" p% K: [3 e: H" U0 x- wcrypto ipsec transform-set nctogztrans esp-des esp-sha-hmac
3 n) V6 A! z! ycrypto map vpnpeer 60 set pfs
crypto map vpnpeer 60 set transform-set nctogztrans
& s/ Y  l: d5 X$ Pcrypto map vpnpeer 60 set peer 59.59.59.60
crypto map vpnpeer 60 match address nctogzvpn
; E7 |) D+ k  m$ C) [6 |" x" ?) @. ]
tunnel-group 59.59.59.60 type ipsec-l2l
tunnel-group 59.59.59.60 ipsec-attributes
, m) o5 x, J) z$ u0 W pre-shared-key nctogz
exit
crypto map vpnpeer interface outside

广州ASA：

conf t
3 l1 t9 J* M; O0 r5 Q9 Iaccess-list nonat extended permit ip 10.10.20.0 255.255.255.0 10.10.0.0 255.255.240.0
5 `7 B% z4 b8 c3 Yaccess-list nonat extended permit ip 192.168.2.0 255.255.255.0 10.10.0.0 255.255.240.0
' c' }/ C; W8 R$ @) @! waccess-list nonat extended permit ip 10.10.20.0 255.255.255.0 172.0.0.0 255.255.255.0
, ^5 c% p, w( {7 z; R0 @access-list nonat extended permit ip 192.168.2.0 255.255.255.0 172.0.0.0 255.255.255.0
6 m. p9 E& ^- M; g
8 S. ?# x+ C4 H1 g4 I$ X0 raccess-list nctogzvpn extended permit ip 10.10.20.0 255.255.255.0 10.10.0.0 255.255.240.0
access-list nctogzvpn extended permit ip 192.168.2.0 255.255.255.0 10.10.0.0 255.255.240.0
access-list nctogzvpn extended permit ip 10.10.20.0 255.255.255.0 172.0.0.0 255.255.255.0
access-list nctogzvpn extended permit ip 192.168.2.0 255.255.255.0 172.0.0.0 255.255.255.0
- r- W/ v4 w. Q# O& w
crypto isakmp policy 30
2 _/ @1 X1 Y* Iauthentication pre-share
+ x0 g# R, ?6 T' M5 k# Pencryption des
hash sha
group 2
exit

- R& ]) U: C+ p0 z3 Fcrypto ipsec transform-set nctogztrans esp-des esp-sha-hmac
crypto map vpnpeer 60 set pfs
8 ?0 s6 H) u1 I2 rcrypto map vpnpeer 60 set transform-set nctogztrans
crypto map vpnpeer 60 set peer 59.59.59.59
crypto map vpnpeer 60 match address nctogzvpn
) v/ |1 m- T$ H# ^% j! q  S+ ]
tunnel-group 59.59.59.59 type ipsec-l2l
+ X6 ~4 o5 L4 U: d: ]+ k$ O8 Htunnel-group 59.59.59.59 ipsec-attributes
. M. K% H* ]' t) U( e; ? pre-shared-key nctogz
1 P; Q' T" p  P1 }4 y, _exit
crypto map vpnpeer interface outside

$ y' f& X. J' a2 `两个ASA一个是asa8.2，一个是asa7.2
9 Z( V4 _# a6 E! @' }- m8 A麻烦各位大大帮看下能找出什么问题吗？两边单独的remote ipsec vpn是正常可以用的，跪求。。。

连两端加密认证协商都没能进行,说明nonat 有问题，sh xlate查看, 应该是去做ＮＡＴ去了。还有去掉ＰＦＳ试试。最好有完整的配置。

引用:                                                                                                                                作者: tailor                                                                                                                                                                                                        连两端加密认证协商都没能进行,说明nonat 有问题，sh xlate查看, 应该是去做ＮＡＴ去了。还有去掉ＰＦＳ试试。最好有完整的配置。                                                                                                                应该不是nonat的问题，因为我tracert的时候不是走的公网，而是直接经过了三层交换机后，显示无路可走，以下是两个asa的show xlate：
4 G- Q. P% S6 K# t8 d& @% Tshow xlate
  ^% d: A( i( f2 i2 ]5 S11 in use, 652 most used
Global 58.17.4.115 Local 10.10.10.99
Global 58.17.4.126 Local 10.10.10.192
) r' I0 R6 l0 D/ c, \PAT Global 59.59.59.59(16290) Local 10.10.10.97(20094)
PAT Global 59.59.59.59(16289) Local 10.10.10.97(45453)
PAT Global 59.59.59.59(16288) Local 10.10.10.97(61475)
2 p$ O' R* A# r, d" F6 gPAT Global 59.59.59.59(16287) Local 10.10.10.97(53325)
PAT Global 59.59.59.59(16286) Local 10.10.10.97(45094)
0 p0 t& W) x, g8 z/ b1 QPAT Global 59.59.59.59(16285) Local 10.10.10.97(24528)
1 K& u& l! J  b1 x5 P- [4 l/ e" iPAT Global 59.59.59.59(16284) Local 10.10.10.98(57000)
PAT Global 59.59.59.59(16283) Local 10.10.10.98(22722)
, e0 N. n1 G2 f0 S0 ]PAT Global 59.59.59.59(16282) Local 10.10.10.98(25946)

show xlate
7 in use, 200 most used
& r; `9 K4 E: Z7 h; }2 H# u+ g& CGlobal 59.59.59.244 Local 10.10.20.4
- z' J( x0 K' `/ O$ FGlobal 59.59.59.245 Local 10.10.20.5
Global 59.59.59.243 Local 10.10.20.3
7 N, r7 T  A' g7 ~8 sGlobal 59.59.59.246 Local 10.10.20.6
Global 59.59.59.247 Local 10.10.20.7
* i2 c5 A: L3 \1 e; Y0 ?Global 59.59.59.248 Local 10.10.20.8

两个ASA的配置，公网地址被我替换了，如有雷同，敬请原谅，麻烦兄弟们帮我看看：
' G" _& n6 c- i: {# D) e8 c* Y6 _7 y南昌ASA：
8 E9 G. e) z, H; k( F0 lASA Version 7.2(3)
/ Z# i' ]  F% A4 X( A+ G!
: r  ?9 s& U" P+ V7 b* Z! Thostname DIYFW
& c% i  U, P. |3 d, ddomain-name tpybank.com
enable password 7qs4CxXJz.NTdDlq encrypted
! N: A5 A, G: Q/ @names
( B  P- V" F# A1 i, f!
1 U( a( q2 {; k. b) M8 o. k! ?interface GigabitEthernet0/0
nameif outside
9 J- `8 D! r+ z: L security-level 0
! ~1 I3 e5 v, q ip address 59.59.59.59 255.255.255.0
; y" E5 k3 F' \!
, M7 @3 r% t" }, |: H0 h# Binterface GigabitEthernet0/1
nameif inside
0 b4 \$ ^; c5 E5 x3 L& x security-level 100
* H3 {0 i- L% F! A$ v ip address 172.0.0.1 255.255.255.0
7 w% w3 J; n) r!
interface GigabitEthernet0/2
- i, O6 A& _- u0 w* x shutdown
no nameif
2 _4 E9 }# a( U; R0 G no security-level
no ip address
/ e5 T2 x7 O3 q1 N; ^* z, H  v!
; L' s! z3 ]& @0 u+ h6 _interface GigabitEthernet0/3
no nameif
no security-level
$ k9 {, ~( D9 d8 k no ip address
!
interface Management0/0
1 X% w9 V  t7 i$ z* b! s- m& e shutdown
3 K! y8 ?  e3 }0 y no nameif
* W: b& l) I. U- e( ?& {( \0 B no security-level
9 h) K2 |# e8 Y7 N, S no ip address
) F6 k; m9 _- I4 a7 ~. l) h6 N# ]!
passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
dns server-group DefaultDNS
domain-name tpybank.com
- G; M- |' j" ~! }/ Eaccess-list outside extended permit ip any any
access-list inside extended permit ip any any
+ R, _2 W+ p) n6 haccess-list inside extended permit icmp any any
1 `9 k6 [1 s2 v+ i- s7 |access-list vpnclient standard permit 10.10.0.0 255.255.240.0
access-list vpnclient standard permit 172.0.0.0 255.255.255.0
) i+ K# b! v# e' haccess-list ipsecclient standard permit any
access-list 100 extended permit ip 10.10.10.0 255.255.255.0 any
access-list 101 extended permit ip any any
2 o- P; D2 J* K  h$ M6 Caccess-list jcsh-group_splitTunnelAcl standard permit any
+ b7 J# x, w' Z3 @  b/ }% V( m% gaccess-list outside1 extended permit ip any any
  R2 a' y1 E/ G; raccess-list no-nat extended permit ip 172.16.0.0 255.255.255.0 172.31.255.0 255.255.255.0
, x4 s% a7 M) m; X0 B; M" R( w. G/ }* {access-list no-nat extended permit ip 10.10.0.0 255.255.240.0 172.31.255.0 255.255.255.0
access-list no-nat extended permit ip 10.10.0.0 255.255.240.0 10.10.20.0 255.255.255.0
access-list no-nat extended permit ip 172.0.0.0 255.255.255.0 10.10.20.0 255.255.255.0
access-list nctogzvpn extended permit ip 10.10.0.0 255.255.240.0 10.10.20.0 255.255.255.0
access-list nctogzvpn extended permit ip 172.0.0.0 255.255.255.0 10.10.20.0 255.255.255.0
) V$ v3 j9 A6 @& s3 Upager lines 24
logging enable
logging monitor debugging
- k6 f8 f5 ^. M% v+ {logging buffered debugging
' @( _/ P% B$ ologging trap debugging
logging asdm informational
logging host inside 10.10.10.179
4 ]& u2 s9 a0 }6 h# G! G1 O: e5 Nmtu outside 1500
0 w. w2 Z% s4 z1 c9 b: Rmtu inside 1500
5 Y/ {5 T; x# q0 i9 uip local pool ipsecvpnpool 172.31.255.0-172.31.255.254 mask 255.255.255.0
ip verify reverse-path interface outside
no failover
icmp unreachable rate-limit 1 burst-size 1
) t( G0 U$ n  G# uicmp permit any outside
6 X8 v9 p1 E: M, [icmp permit any inside
- Q) D' }2 l! H: m' e. ]asdm image disk0:/ASDM-523.BIN
no asdm history enable
arp timeout 14400
5 w/ U3 W! v5 U: K! M  C. xglobal (outside) 101 interface
nat (inside) 0 access-list no-nat
8 H1 n4 T7 A. ~7 A' M! h" S3 y% Wnat (inside) 101 0.0.0.0 0.0.0.0
static (inside,outside) 59.59.59.115 10.10.10.99 netmask 255.255.255.255
static (inside,outside) 59.59.59.126 10.10.10.192 netmask 255.255.255.255
access-group outside in interface outside
8 }1 ~  E  \! O  l( saccess-group inside in interface inside
route outside 0.0.0.0 0.0.0.0 59.59.59.1 1
route inside 10.10.0.0 255.255.240.0 172.0.0.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa authentication ssh console LOCAL
2 J4 d  X1 c9 ?! B( U9 x2 nhttp server enable
http 0.0.0.0 0.0.0.0 outside
* S0 l, V6 X3 N/ E) p! _snmp-server host inside 10.10.10.19 community typ100
# X3 B8 K/ y( \% I$ Yno snmp-server location
  f0 j# d8 Q( O: }; J! y& S- x9 xno snmp-server contact
* |% z: Q! B/ z7 b+ A" N7 j" lsnmp-server enable traps snmp authentication linkup linkdown coldstart
. C5 d& F+ B; Y( Qsnmp-server enable traps syslog
snmp-server enable traps ipsec start stop
snmp-server enable traps entity config-change fru-insert fru-remove
( f5 U5 v. P, N6 X/ k2 N6 F' h4 dsnmp-server enable traps remote-access session-threshold-exceeded
" [6 z; `3 O0 b5 a0 P* Oservice resetoutside
crypto ipsec transform-set dialvpn esp-des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
& ~' n, Q; V# d( Pcrypto ipsec transform-set TRANS_ESP_DES_SHA esp-des esp-sha-hmac
crypto ipsec transform-set TRANS_ESP_DES_SHA mode transport
crypto ipsec transform-set nctogztrans esp-des esp-sha-hmac
crypto dynamic-map dynomap 10 set transform-set dialvpn
% d( ]+ i# F( Y! b) g& i% w$ Tcrypto dynamic-map dynomap 10 set reverse-route
8 d+ C4 ~) T8 _1 J) E! Acrypto dynamic-map outside_dyn_map 20 set pfs
& Q  \6 n1 z# `8 Lcrypto dynamic-map outside_dyn_map 20 set transform-set ESP-DES-SHA
crypto dynamic-map outside_dyn_map 40 set pfs
7 i- e& I  g" u. j/ l& F( Dcrypto dynamic-map outside_dyn_map 40 set transform-set TRANS_ESP_DES_SHA
crypto map vpnpeer 10 ipsec-isakmp dynamic dynomap
8 z' j9 e8 R. x9 q7 b1 j5 Scrypto map vpnpeer 60 match address nctogzvpn
crypto map vpnpeer 60 set peer 59.59.59.60
2 ?- L% j/ i% o7 fcrypto map vpnpeer 60 set transform-set nctogztrans
crypto map vpnpeer interface outside
2 S- S9 P* W6 i* w$ E; N1 e/ `crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 1
# ~  l4 J! I& S2 B authentication pre-share
1 g! O: |3 a! [/ }, p# ^) g encryption des
. v3 V: R. w8 c8 p hash md5
group 2
# y6 \  M' A/ d  ? lifetime 86400
crypto isakmp policy 30
/ G; g% ~, D" x authentication pre-share
encryption des
( i1 M& d' `0 D, v4 X hash sha
group 2
lifetime 86400
crypto isakmp policy 50
6 `- G1 l2 {* u2 p# R authentication crack
encryption des
hash sha
group 2
6 f0 r5 _9 C  H9 {0 ^8 ~ lifetime 86400
7 u0 E# j4 r) Q) \. Y% scrypto isakmp nat-traversal  20
# ?' V( {, J3 V/ i! j/ mvpn-sessiondb max-session-limit 450
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 5
% D7 S' M. ~6 C- M5 F0 }ssh version 1
, z* ?+ G, F4 w1 cconsole timeout 0
priority-queue inside
9 g& q9 ~  b1 q!
$ k  J$ v' Z- @+ g0 xclass-map limitconnect
match access-list 101
$ z9 V9 X' h) f1 @. e& oclass-map QOS
match access-list 100
  d2 w( W  R' y5 ^9 f1 }5 ^4 D( cclass-map type inspect http match-all httpfilter
match req-resp content-type mismatch
match request header allow length gt 5000
match response header count gt 200
' ^) r$ j0 E' ? match request uri length gt 1000
class-map type inspect ftp match-all ftpfilter
match request-command mkd
  l1 F+ e9 \/ b6 Y. ^6 Vclass-map inspection_default
match default-inspection-traffic
class-map flitcontent
match access-list 100
!
!
policy-map limitconnect
) R: A3 Q" J  }5 ^ class limitconnect
: ?! `& x# W/ j+ v  set connection conn-max 30000
policy-map QOS
7 K# f( x6 g' O9 d2 {* r- n class QOS   
class limitconnect
; ?" n8 Q  _8 n  L8 b6 ]4 E  set connection conn-max 30000
policy-map global_policy
( M% j0 S! Y2 ^3 G6 w class inspection_default
5 m& |: ^7 j! P, `  inspect ftp
  inspect h323 h225
  inspect h323 ras
( |* @3 c3 j8 ?& z* [  q. t- r! e/ L  inspect rsh
  inspect rtsp
" j5 K; u  ?, B& ]4 P( X3 b  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect icmp
policy-map flitcontent
$ [& o& U' m4 z' T class flitcontent
!
service-policy global_policy global
( b) L/ k4 V$ a/ x/ Qservice-policy QOS interface inside
7 A( N" D, _& Hgroup-policy sk-group internal
group-policy sk-group attributes
- p! F- X& u) U5 @7 {, ?. `) r split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnclient
5 d) a- N/ Z5 V5 xusername vpnuser password ZC2U2lwElxOuM0y+z/4mXg== nt-encrypted privilege 0
username networker password Ge08R8/YEb1oXNI9 encrypted privilege 0
tunnel-group sk-group type ipsec-ra
tunnel-group sk-group general-attributes
address-pool ipsecvpnpool
) t2 T9 W3 y% |  o5 S# s4 _  d9 e default-group-policy sk-group
tunnel-group sk-group ipsec-attributes
pre-shared-key *
tunnel-group 59.59.59.60 type ipsec-l2l
tunnel-group 59.59.59.60 ipsec-attributes
pre-shared-key *
8 t# t; i2 Q5 ]# Y, u6 ?- aprompt hostname context
Cryptochecksum:200b24ebb637185e77dc3623b20a596a
: end
5 h! G: ]* x+ K! I  Q

. |& h9 v2 ~: j  w+ o+ U广州ASA：
2 d7 s( e- h% W. P, A, x. |ASA Version 8.2(4)
!
, S% i6 m8 O  y8 mhostname GZFW
  K/ U# A7 o5 n8 L! i5 t! Odomain-name tpy100.com
8 h8 h1 y  i$ d* Z/ L. |8 Eenable password r2GUYr0JBoB38neH encrypted
5 X3 `/ d/ T+ w5 l" F! xpasswd 2KFQnbNIdI.2KYOU encrypted
names
!
1 [  E: J( {; U7 r4 kinterface GigabitEthernet0/0
nameif outside
7 L" Z. [7 f4 j! r  r security-level 0
ip address 59.59.59.60 255.255.255.240
) S- q' ~' |! o!
interface GigabitEthernet0/1
& X/ w8 L/ z; X! h# T: v/ z nameif inside
security-level 100
ip address 10.10.20.254 255.255.255.0
0 G( |% |/ O- g!
- W6 S4 ~! [7 \, F5 [* t5 F5 @interface GigabitEthernet0/2
9 S) s3 n, H1 d% X no nameif
no security-level
# L. Q9 j2 p' V+ V( d no ip address
) d/ q/ ?) J) P!
; t" p7 Q- [" ?, l1 w" Linterface GigabitEthernet0/3
+ q& ^3 [0 l1 ~* _! R8 R no nameif
no security-level
: r" f. T# m' V# h' b no ip address
!
interface Management0/0
* w) e+ ^) F3 b1 q; z% Y6 S nameif management
6 a  ?" i3 b% @" p. g+ m security-level 100
6 D9 B! E" w: J. c( @# w* ^  W ip address 192.168.51.254 255.255.255.0
1 a+ e7 z1 R( }0 x% l3 T" @ management-only
!
boot system disk0:/asa824-k8.bin
ftp mode passive
clock timezone CST 8
9 q% T! }7 v% b# l( Gdns server-group DefaultDNS
domain-name tpy100.com
access-list outside extended permit ip any any
access-list outside extended permit icmp any any
4 O- u" h5 e! v# K4 Baccess-list outside extended permit tcp any any
access-list outside extended permit udp any any
access-list inside extended permit ip any any
# H1 L9 x8 W; |, F7 Z0 h  iaccess-list inside extended permit icmp any any
access-list nonat extended permit ip 10.10.20.0 255.255.255.0 10.120.19.0 255.255.255.0
4 ^0 F9 F2 b6 E% G- Q* Daccess-list nonat extended permit ip 192.168.2.0 255.255.255.0 10.120.19.0 255.255.255.0
access-list nonat extended permit ip 192.168.51.0 255.255.255.0 10.120.19.0 255.255.255.0
access-list nonat extended permit ip 10.10.20.0 255.255.255.0 10.10.0.0 255.255.240.0
access-list nonat extended permit ip 192.168.2.0 255.255.255.0 10.10.0.0 255.255.240.0
" Q& m4 K" g' L; [$ x  s) v" f' @, Eaccess-list nonat extended permit ip 10.10.20.0 255.255.255.0 172.0.0.0 255.255.255.0
access-list nonat extended permit ip 192.168.2.0 255.255.255.0 172.0.0.0 255.255.255.0
access-list vpn-client standard permit 10.10.20.0 255.255.255.0
access-list vpn-client standard permit 192.168.2.0 255.255.255.0
4 R) y' J( R+ w; d) U  \, t# Faccess-list vpn-client standard permit 192.168.51.0 255.255.255.0
access-list nctogzvpn extended permit ip 10.10.20.0 255.255.255.0 10.10.0.0 255.255.240.0
access-list nctogzvpn extended permit ip 192.168.2.0 255.255.255.0 10.10.0.0 255.255.240.0
access-list nctogzvpn extended permit ip 10.10.20.0 255.255.255.0 172.0.0.0 255.255.255.0
access-list nctogzvpn extended permit ip 192.168.2.0 255.255.255.0 172.0.0.0 255.255.255.0
0 [$ n- N  k2 q- ?( _& \1 z9 Apager lines 24
* S# \; R# }$ ~$ i! w+ f1 wlogging enable
$ p, }& J# ^; H6 t2 R; ~  blogging asdm informational
; l/ _$ y. g9 T6 W. w1 [mtu outside 1500
- y+ ^  d# C" D" u/ s. Emtu inside 1500
mtu management 1500
ip local pool vpnpool 10.120.19.1-10.120.19.254 mask 255.255.255.0
) X+ R* O# h/ @+ S! Z3 qno failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
) m; y% K! B6 Dicmp permit any inside
asdm image disk0:/asdm-641.bin
) A; }# e$ s$ P- c% n% g$ pno asdm history enable
; V$ d: j" @% L! U, C" Carp timeout 14400
global (outside) 101 interface
* m$ G; k' M" Xnat (inside) 0 access-list nonat
nat (inside) 101 0.0.0.0 0.0.0.0
static (inside,outside) 59.59.59.244 10.10.20.4 netmask 255.255.255.255
& V3 N) m  u- w5 i  ~static (inside,outside) 59.59.59.245 10.10.20.5 netmask 255.255.255.255
static (inside,outside) 59.59.59.243 10.10.20.3 netmask 255.255.255.255
, G, J- q' E* w3 [5 [  Ustatic (inside,outside) 59.59.59.246 10.10.20.6 netmask 255.255.255.255
; @# z- _  w$ i* q! ]static (inside,outside) 59.59.59.247 10.10.20.7 netmask 255.255.255.255
! `; v; q2 x" J% |0 Z! Qstatic (inside,outside) 59.59.59.248 10.10.20.8 netmask 255.255.255.255
static (inside,outside) 59.59.59.249 192.168.2.101 netmask 255.255.255.255
access-group outside in interface outside
access-group inside in interface inside
8 k4 x6 o) h9 p) B; b& a! |8 Vroute outside 0.0.0.0 0.0.0.0 59.59.59.241 1
route inside 192.168.2.0 255.255.255.0 10.10.20.1 1
1 G/ Z3 [' V+ }, \timeout xlate 3:00:00
8 K" X: y. ?4 d0 b) d- Xtimeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
, q* T& F- ^# V6 Rtimeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
) i3 @; x( k* M2 H7 h1 J6 ctimeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
3 b6 _% f9 q6 q# h* {1 y: ~) `timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
  P+ O5 \  U3 W0 m6 }$ d  d' X5 ^aaa authentication telnet console LOCAL
( U. i* N! I  F; k- X1 J) Chttp server enable
2 U2 C* v% n. t% L+ ^3 z* [  K5 Uhttp 0.0.0.0 0.0.0.0 inside
http 0.0.0.0 0.0.0.0 outside
3 ~- v& P- d1 h# W4 f) |6 ano snmp-server location
3 f8 i3 F6 |) V' ?6 Z+ s4 bno snmp-server contact
( \: t" Y# h* [0 Zsnmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
7 U3 Y8 F3 w7 @( J8 P1 P# ecrypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
5 w' m" S* @, i# D: P% H( t5 Q4 ~crypto ipsec transform-set TRANS_ESP_DES_SHA esp-des esp-sha-hmac
# M4 N5 s- c- R8 ^1 ]crypto ipsec transform-set TRANS_ESP_DES_SHA mode transport
crypto ipsec transform-set nctogztrans esp-des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
8 ~! U& N3 R5 Ccrypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map dynomap 10 set transform-set ESP-DES-MD5
* |8 u6 J# T" q* i/ l9 q  |1 O1 Ucrypto map vpnpeer 10 ipsec-isakmp dynamic dynomap
crypto map vpnpeer 60 match address nctogzvpn
3 `6 v: @$ w5 r0 Dcrypto map vpnpeer 60 set peer 59.59.59.59
, J$ ^9 ]2 J/ a3 Hcrypto map vpnpeer 60 set transform-set nctogztrans
crypto map vpnpeer interface outside
crypto isakmp identity address
% T7 B7 h9 Y0 }! Qcrypto isakmp enable outside
crypto isakmp policy 10
. X, _% l9 d6 {( W# }% q! @- J* L authentication pre-share
encryption des
( T4 r4 T+ N3 r6 x) ` hash md5
group 2
lifetime 86400
crypto isakmp policy 30
* b6 J$ w% \8 G/ |7 e( {9 i. y authentication pre-share
9 o( g) Z% h, F encryption des
hash sha
* _" v  i7 t  l, q1 Z" l( s group 2
, R! d$ Y" D# v, O; D lifetime 86400
+ [0 c6 M# ?- P& r* |+ X) k+ r* Dtelnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 5
! m# G" f" p& Issh version 1
console timeout 0
management-access management
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
) R1 E. D8 \4 Fgroup-policy betterlife internal
group-policy betterlife attributes
vpn-tunnel-protocol IPSec l2tp-ipsec
$ P4 }9 ~; n5 t, H* S, w split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpn-client
1 ~  Q+ @' F: ^5 q5 P5 husername vpnuser password 35y3osDoYvzwb04ktFQIgA== nt-encrypted
username vpnuser attributes
service-type remote-access
username networker password oDfhMUGcNlh2Hyjp encrypted privilege 0
tunnel-group betterlife type remote-access
tunnel-group betterlife general-attributes
4 s4 v$ a8 b. ^. p' G9 i5 R address-pool vpnpool
) g3 W4 `8 t% d6 u- I' s default-group-policy betterlife
tunnel-group betterlife ipsec-attributes
pre-shared-key *****
' Y  |! E# m1 d8 K2 _( L% dtunnel-group 59.59.59.59 type ipsec-l2l
4 h9 F; \0 w; v! U. {, A. L( ytunnel-group 59.59.59.59 ipsec-attributes
- T( q$ B* p; s  d$ S" G/ Q pre-shared-key *****
& H1 O5 O) R& C9 d!
. t2 i( N: N' U/ ?4 l' eclass-map inspection_default
& F& c  O: q5 O/ l6 e! x match default-inspection-traffic
9 X5 V7 u1 \# a6 _, e, f3 ]: H!
0 b$ a$ N" U0 C$ @# o- }!
" N- D/ L4 A. P( c- tpolicy-map global_policy
2 L& a. J$ ?( |; H% H class inspection_default
  inspect ftp
9 q& H& s( |8 h2 ?4 J  inspect h323 h225
  inspect h323 ras
; |: t+ G4 u/ s* ]" v  inspect rsh
/ J$ w" ^- C+ m# a6 b8 l  inspect rtsp
8 A5 S' h4 t& @  inspect esmtp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect netbios
1 c# H0 U0 Y- T# b8 }  inspect tftp
1 F) z# Z' g- Z9 Y6 f1 x& i  inspect icmp
& v$ Q" K0 ?9 d+ G+ @- ~/ m!
8 \6 q, p% Q+ h/ r3 Bservice-policy global_policy global
1 x) w# l6 U4 _4 w+ j8 O2 t- Lprompt hostname context
call-home
profile CiscoTAC-1
  no active
% S% q: z* Y( `  destination address http https://tools.cisco.com/its/service/...es/DDCEService
  destination address email callhome@cisco.com
, ~- g$ |9 O9 R8 L2 \) E4 C  destination transport-method http
# v% {( n' n3 B  E  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
$ ?! B* n- O4 b- V! C4 n4 d  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:3321c1f8720e4ec4583796ab04d8f0fe
: end

在线等高手帮看看啊~~~

跪求帮看下怎么回事，谢谢

跪求帮看下怎么回事，谢谢，查了好几天了都没找到原因。。。

crypto map vpnpeer 10 ipsec-isakmp dynamic dynomap 应该放在最后，如crypto map vpnpeer 65535 ipsec-isakmp dynamic dynomap。还有两边的ＡＣＬ不对称。
access-list nctogzvpn extended permit ip 10.10.0.0 255.255.240.0 10.10.20.0 255.255.255.0
access-list nctogzvpn extended permit ip 172.0.0.0 255.255.255.0 10.10.20.0 255.255.255.0
- e: |2 D7 Z9 `% q$ J  {3 g
% ~% E" \8 Y, H" d7 w8 }access-list nctogzvpn extended permit ip 10.10.20.0 255.255.255.0 10.10.0.0 255.255.240.0
access-list nctogzvpn extended permit ip 192.168.2.0 255.255.255.0 10.10.0.0 255.255.240.0
access-list nctogzvpn extended permit ip 10.10.20.0 255.255.255.0 172.0.0.0 255.255.255.0
! }/ d+ m1 b7 i- n; K7 Haccess-list nctogzvpn extended permit ip 192.168.2.0 255.255.255.0 172.0.0.0 255.255.255.0
后一个问题不是很关键，对一些６.x 版本的ＯＳ会有问题。

谢谢楼上那位大神啊，问题已解决，ACL不是问题的主因，主因是动态map和静态map的序列号，试过了，当动态map序列号比静态map序列号小，则静态map即点对点ipsec vpn用不了，配置时也会提示，所以动态map序列号比静态map序列号大才行。以上是我的说法，不知道对不对。
% Z3 w4 D+ }: |5 T: T7 O! Z" n我是先配的动态map及remote ipsec vpn，然后配的静态map即点对点ipsec vpn，所以导致后来出现问题一直找不到原因，两边整体配置我就不重发了，我是直接把crypto map vpnpeer 10 ipsec-isakmp dynamic dynomap 改成了crypto map vpnpeer 65535 ipsec-isakmp dynamic dynomap，问题就解决了，show isakmp sa也能看到两边的协商认证后的连接情况，acl也稍微修改了下以使两边内网能正常通信。
再次非常感谢tailor大神！

学艺不精啊，以后要多多学习哇。。。