msr830

# 

acl number 3000 

 rule 0 permit ip source 100.83.206.0 0.0.1.255 destination 10.0.0.0 0.255.255.255

 rule 5 permit ip source 100.83.206.0 0.0.1.255 destination 192.168.0.0 0.0.255.255

 rule 10 permit ip source 100.83.206.0 0.0.1.255 destination 100.64.0.0 0.0.31.255 

acl number 3001

 rule 0 deny ip source 100.83.206.0 0.0.1.255 destination 10.0.0.0 0.255.255.255 

rule 1 deny ip source 100.83.206.0 0.0.1.255 destination 192.168.0.0 0.0.255.255 

rule 2 deny ip source 100.83.206.0 0.0.1.255 destination 100.64.0.0 0.0.31.255 

rule 10 permit ip source 100.83.206.0 0.0.1.255 

acl number 3002 

 rule 0 permit ip source 100.83.206.0 0.0.1.255 destination 10.0.0.0 0.255.255.255 

rule 5 permit ip source 100.83.206.0 0.0.1.255 destination 192.168.0.0 0.0.255.255

 rule 10 permit ip source 100.83.206.0 0.0.1.255 destination 100.64.0.0 0.0.31.255 

# 

 vlan 1 

 #

 vlan 3 

 #  

  ike proposal 1 

 encryption-algorithm 3des-cbc 

 dh group2 

 authentication-algorithm md5 

 sa duration 28800

 #

 ike dpd zzz 

 interval-time 2

# 

 ike dpd zzz2

 interval-time 2    

  # 

 ike peer 1 

#

ike peer zzz

 proposal 1 

 pre-shared-key cipher $c$3$s42u4LUh3NpCQW/Xoi1VRASDPa8zZeaYFxOBx1g= 

 remote-address 120.132.35.242

 local-address 111.47.21.65 

 nat traversal 

 dpd zzz      

# ike peer zzz2 

 proposal 1 

 pre-shared-key cipher $c$3$Ez32QSyDMcivr4PPYLeSeKENmp31hxJmjVePXFE= 

 remote-address 120.132.35.242

 local-address 113.57.105.58 

 nat traversal 

 dpd zzz2 

 # 

 ipsec transform-set zzz 

 encapsulation-mode tunnel 

 transform esp 

 esp authentication-algorithm sha1 

 esp encryption-algorithm 3des 

#            

   ipsec transform-set zzz2 

 encapsulation-mode tunnel 

 transform esp 

 esp authentication-algorithm sha1 

 esp encryption-algorithm 3des 

# 

ipsec policy 1048576 1 isakmp 

 connection-name zzz 

 security acl 3000 

 pfs dh-group2

 ike-peer zzz

 transform-set zzz 

 sa duration traffic-based 4608000

 sa duration time-based 28800 

# 

 ipsec policy 1048580 1 isakmp

 connection-name zzz2 

 security acl 3002 

 pfs dh-group2

 ike-peer zzz2

 transform-set zzz2 

 sa duration traffic-based 4608000

 sa duration time-based 28800

 undo policy enable

# interface GigabitEthernet0/0 

 port link-mode route nat outbound 3001 

 ip address 111.47.21.65 255.255.255.0 

 ipsec no-nat-process enable

 ipsec policy 1048576 

 dns server 211.137.58.20

 #               

interface GigabitEthernet0/4 

 port link-mode route

 nat outbound

 shutdown

 ip address 113.57.105.58 255.255.255.128

 ipsec no-nat-process enable ipsec policy 1048580 

 dns server 218.104.111.114 

 dns server 218.104.111.122 

#               

# nqa entry admin vpn

 type icmp-echo 

 destination ip 120.132.35.242 

 frequency 5000 

 next-hop 111.47.21.1 

 reaction 1 checked-element probe-fail threshold-type consecutive 5 action-type trap-only source interface GigabitEthernet0/0 

#               

 ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet0/0 111.47.21.1

 ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet0/4 113.57.105.1 preference 50 

ip route-static 10.0.0.0 255.0.0.0 GigabitEthernet0/0 111.47.21.1 

ip route-static 10.0.0.0 255.0.0.0 GigabitEthernet0/4 113.57.105.1 preference 50

 ip route-static 100.64.0.0 255.224.0.0 GigabitEthernet0/4 113.57.105.1 preference 50

 ip route-static 100.64.0.0 255.224.0.0 111.47.21.1 track 1

 ip route-static 192.168.0.0 255.255.0.0 GigabitEthernet0/0 111.47.21.1

 ip route-static 192.168.0.0 255.255.0.0 GigabitEthernet0/4 113.57.105.1 preference 50 

# 

 track 1 nqa entry admin vpn reaction 1 

#               

nqa schedule admin vpn start-time now lifetime forever 

#               

配置完成后track状态为invalid是什么原因