Как настроить маршрутизацию в S-terra Gate100?

Question

[Антон Уланов]

Доброе время суток, есть две железки с 3 интерфейсами в каждой (GW1 и GW2)
GW1 eth0 10.0.0.1; eth2 192.168.1.100 ( с нее бегают пинги и в инет и через GW2 в его сеть)
GW2 eth0 10.0.0.2; eth1 192.168.2.100 ( с него идет пинг до 10.0.0.1 и до 192.168.1.100) но при этом не идут пинги до 192.168.1.1 и дальше в инет
GW1

!
version 12.4
no service password-encryption
!
crypto ipsec df-bit copy
crypto isakmp identity address
username cscons privilege 15 password 0 csp
aaa new-model
!
!
hostname GW1
enable password csp
!
!
!
logging trap debugging
!
!
crypto isakmp policy 1
 encr gost
 hash gost
 authentication pre-share
 group vko
!
crypto isakmp key !QWERTY address 10.0.0.2
!
crypto ipsec transform-set TSET esp-gost28147-4m-imit
!
ip access-list extended LIST
 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
!
!
crypto map CMAP 1 ipsec-isakmp
 match address LIST
 set transform-set TSET 
 set pfs vko
 set peer 10.0.0.2
!
interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 crypto map CMAP
!
interface GigabitEthernet0/1
 no ip address
 shutdown
!
interface GigabitEthernet0/2
 ip address 192.168.1.252 255.255.255.0
!
!
ip route 192.168.2.0 255.255.255.0 10.0.0.2
ip route 0.0.0.0 0.0.0.0 192.169.1.1
ip route 0.0.0.0 0.0.0.0 192.168.1.252
!

GW2

!
version 12.4
no service password-encryption
!
crypto ipsec df-bit copy
crypto isakmp identity address
username cscons privilege 15 password 0 csp
aaa new-model
!
!
hostname GW2
enable password csp
!
!
!
logging trap debugging
!
!
crypto isakmp policy 1
 encr gost
 hash gost
 authentication pre-share
 group vko
!
crypto isakmp key !QWERTY address 10.0.0.1
!
crypto ipsec transform-set TSET esp-gost28147-4m-imit
!
ip access-list extended LIST
 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
!
!
crypto map CMAP 1 ipsec-isakmp
 match address LIST
 set transform-set TSET 
 set pfs vko
 set peer 10.0.0.1
!
interface GigabitEthernet0/0
 ip address 10.0.0.2 255.255.255.0
 crypto map CMAP
!
interface GigabitEthernet0/1
 ip address 192.168.2.242 255.255.255.0
!
interface GigabitEthernet0/2
 no ip address
 shutdown
!
!
ip route 192.168.1.0 255.255.255.0 10.0.0.1
ip route 0.0.0.0 0.0.0.0 10.0.0.1
!
end