Doesn't walk in GRE IPSEC tunnel

Question

Cisco

Good day!
A quick question for you comrades!

If two routers see each other through a bare GRE tunnel, but not with IPSEC, then what could be the problem?

Just in case, pieces of configs:

crypto isakmp policy 1
 encr 3des
 authentication pre-share
 lifetime 28800

crypto ipsec transform-set uch1 esp-3des esp-sha-hmac

crypto isakmp key dududu address 2.2.2.2

crypto map MAPMAP 1 ipsec-isakmp 
 description MAP
 set peer 2.2.2.2
 set transform-set uch1 
 match address 140

interface Tunnel1
 description T11
 ip address 192.168.19.86 255.255.255.248
 ip tcp adjust-mss 1452
 tunnel source 1.1.1.1
 tunnel destination 2.2.2.2
 crypto map MAPMAP

access-list 140 permit ip 192.168.0.0 0.0.63.255 192.168.19.80 0.0.0.7

crypto isakmp policy 1
 encr 3des
 authentication pre-share
 lifetime 28800

crypto ipsec transform-set uch1 esp-3des esp-sha-hmac

crypto isakmp key dududu address 1.1.1.1

crypto map PAMPAM 1 ipsec-isakmp
 description PAM
 set peer 1.1.1.1
 set transform-set uch1
 match address 140

interface Tunnel11
 ip address 192.168.19.81 255.255.255.248
 ip tcp adjust-mss 1452
 tunnel source 2.2.2.2
 tunnel destination 1.1.1.1
 crypto map PAMPAM

access-list 140 permit ip 192.168.19.80 0.0.0.7 192.168.0.0 0.0.63.255

Sane debugging is difficult to do. tunnel is not alone.

Answer 1

IPSec must encrypt traffic from physical interface to physical interface, not between tunnel addresses. Those. between 1.1.1.1 and 2.2.2.2. Edit crypto acl.