The topology as attachment.
Spoke site(a linux-based soho router) configured IPSec vpn with a full network route(Peer: 0.0.0.0/0) to Hub, and Dynamic IPSec VPN has been established between Hub and Spoke site；
At begining this topology can working properly,the IPSec can terminated at Hub,and I can ping the PC2 at Spoke from any interface at Hub;
But recently I cannot ping the host(pc2) at Spoke from the interfaces at Hub.Meanwihle,I can ping the PC2 from Loop101 at hosting,if change source interface to tun101,that's not working;
Does anyone has some experience to solved this problem,please help me to find it out. Thanks a lot!
========================================
Hub#show run (VPN)
crypto keyring 3gvpnsh
pre-shared-key address 0.0.0.0 0.0.0.0 key tseinfo
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
lifetime 3600
crypto isakmp keepalive 10 5
crypto isakmp nat keepalive 60
crypto ipsec transform-set 3gvpnsh esp-3des esp-sha-hmac
mode transport
crypto map 3gvpnsh 100 ipsec-isakmp dynamic 3gvpnsh
***:No Access-list configured for this dynamic VPN***
========================================
Hub#sh cry ipsec sa
protected vrf: (none)
local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
remote ident (addr/mask/prot/port): (10.13.248.44/255.255.255.252/0/0)
current_peer 114.81.217.74 port 500
PERMIT, flags={}
#pkts encaps: 942, #pkts encrypt: 942, #pkts digest: 942
#pkts decaps: 722, #pkts decrypt: 722, #pkts verify: 722
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: ***.***.***.***, remote crypto endpt.: ###.###.###.###
path mtu 1500, ip mtu 1500
current outbound spi: 0x36562A88(911616648)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0x684A6A6D(1749707373)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 871, flow_id: 871, sibling flags 80000040, crypto map: 3gvpnsh
sa timing: remaining key lifetime (k/sec): (4407128/991)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x36562A88(911616648)
transform: esp-3des esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 872, flow_id: 872, sibling flags 80000040, crypto map: 3gvpnsh
sa timing: remaining key lifetime (k/sec): (4406428/979)
IV size: 8 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
========================================================
