我有 2 个站点，它们之间有 IPSEC 连接。每个站点的边缘都有一个 2921。
Site A 2921 (gi0/1) ---> <--- (gi0/1) 2921 Site B
我正在通过 2921 (gi0/2) 上的第三个接口向站点 A 添加第二个 WAN 连接。
10.12.x.x Site A 2921 (gi0/1) ---> <--- (gi0/1) 2921 Site B 10.4.x.x
Site A 2921 (gi0/2) ---> 0.0.0.0
理想情况下，我想使用 PBR 将站点 A 2921 后面的用户发送到 gi0/2 接口，除非他们的目的地是站点 B 中的地址。我还在 gi0/1 接口的 IP 地址上托管站点 A 的邮件服务器。
我以前做过 PBR，但 VPN（我认为）给我带来了一些复杂性。
当我设置接口过载命令并将路由映射应用到接口时，它就会停止工作。如果我只是删除 PBR 并将 gi0/1 设置回默认路由，则一切正常。
谢谢您的帮助！
站点A配置
interface GigabitEthernet0/0
description Inside
ip address 10.12.x.x 255.255.255.0
no ip redirects
no ip proxy-arp
ip policy route-map internet
ip nbar protocol-discovery
ip nat inside
ip virtual-reassembly in
duplex auto
speed auto
no mop enabled
interface GigabitEthernet0/1
description TO SITE B
ip address a.a.a.a 255.255.255.0
no ip redirects
no ip proxy-arp
ip accounting access-violations
ip verify unicast source reachable-via rx allow-default 100
ip nbar protocol-discovery
ip flow ingress
ip nat outside
ip inspect OutsideFirewall out
ip virtual-reassembly in
duplex auto
speed auto
no cdp enable
no mop enabled
crypto map S2S_VPN
interface GigabitEthernet0/2
description TO 0.0.0.0
ip address dhcp
no ip redirects
no ip unreachables
no ip proxy-arp
ip accounting access-violations
ip verify unicast source reachable-via rx allow-default 100
ip nbar protocol-discovery
ip flow ingress
ip nat outside
ip inspect OutsideFirewall out
ip virtual-reassembly in
duplex auto
speed auto
no cdp enable
no mop enabled
ip nat inside source route-map NAT interface GigabitEthernet0/1 overload
ip nat inside source static tcp 10.12.x.10 80 interface GigabitEthernet0/1 80
ip nat inside source static tcp 10.12.x.10 995 interface GigabitEthernet0/1 995
ip nat inside source static tcp 10.12.x.10 25 interface GigabitEthernet0/1 25
ip nat inside source static tcp 10.12.x.10 443 interface GigabitEthernet0/1 443
ip nat inside source list NAT interface GigabitEthernet0/2 overload
ip route 0.0.0.0 0.0.0.0 192.x.x.x (gi0/2 gateway)
ip access-list extended NAT
deny ip any 10.4.x.x 0.0.0.255
permit ip any any
ip access-list extended to_gi01
permit ip 10.12.x.10 0.0.0.0 any
permit ip 10.12.x.x 0.0.0.255 10.4.x.x 0.0.0.255
deny ip any any
route-map internet permit 10
match ip address to_gi01
set ip next-hop a.a.a.a (gi0/1 gateway)
站点 A 加密部分
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto ipsec transform-set S2S_SET esp-3des esp-md5-hmac
mode tunnel
crypto isakmp key blahblah address x.siteB.x.x
crypto map S2S_VPN 1 ipsec-isakmp
description S2S VPN
set peer x.siteB.x.x
set transform-set S2S_SET
set pfs group1
match address siteB_ACL
ip access-list extended siteB_ACL
permit ip 10.12.x.0 0.0.0.255 10.4.x.0 0.0.0.255
简单的网络绘图
