IPSec VRF Aware (Crypto Map)

Question

Hello!
I have some problem with configuring vrf aware Ipsec (Crypto Map).
Any traffic (from subnet 10.6.6.248/29) do not pass trouth router, but if i run command "ping vrf inside 10.5.5.1 source gi 0/1.737" it working well.  
Configuration below:
ip vrf outside
 rd 1:1
ip vrf inside
 rd 2:2
track 10 ip sla 10 reachability
ip sla schedule 10 life forever start-time now
crypto keyring outside vrf outside 
  pre-shared-key address 10.10.10.100 key XXXXXX
crypto isakmp policy 20
 encr aes 256
 authentication pre-share
 group 2
crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 10 periodic
crypto isakmp profile AS_outside
   vrf inside
   keyring outside
   match identity address 10.10.10.100 255.255.255.255 outside
   isakmp authorization list default
crypto ipsec transform-set ESP-AESesp-aes 256 esp-sha-hmac 
 mode tunnel
crypto ipsec df-bit clear
crypto map outside 10 ipsec-isakmp 
 set peer 10.10.10.100
 set security-association idle-time 3600
 set transform-set ESP-AES 
 set pfs group2
 set isakmp-profile AS_outside
 match address inside_access
ip route vrf inside 10.5.5.0 255.255.255.0 GigabitEthernet0/0.806 10.10.10.100 track 10
ip access-list extended inside_access
 permit ip 10.6.6.248 0.0.0.7 10.5.5.0 0.0.0.255
icmp-echo 10.10.10.100 source-interface GigabitEthernet0/0.806
 vrf outside
interface GigabitEthernet0/0.806
ip vrf forwarding outside
ip address 10.10.10.101 255.255.255.0
crypto-map outside
interface GigabitEthernet0/1.737
ip vrf forwarding inside
ip address 10.6.6.252 255.255.255.248

Answer 1

Hello Frank!
>>  1. You may want to consider removing the "track 10" from your static route to eliminate any issues that this could be causing.
I tried it before. Nothing changes.
>> 2. If you teardown the tunnel, can the traffic from your end client (not the ping generated locally) cause the tunnel to build? If not, you may want to use netflow or ACL counters to verify that your packets are hitting the inside interface.
It is also checked. netflow present counters and ACL counters not present. Source ip is 10.6.6.254/29.
show command below:
ISR-vpn-1#show ip cef vrf inside exact-route  10.6.6.254 10.5.5.1
 10.6.6.254  -> 10.5.5.1 => IP adj out of GigabitEthernet0/0.806, addr 10.10.10.100 (incomplete)
ISR-vpn-1#show ip cef vrf inside 10.24.1.0/24 internal                
10.5.5.0/24, epoch 0, RIB[S], refcount 5, per-destination sharing
  sources: RIB 
  feature space:
   NetFlow: Origin AS 0, Peer AS 0, Mask Bits 24
  ifnums:
   GigabitEthernet0/0.806(24): 10.10.10.100
  path 22D160E8, path list 22AC27E8, share 1/1, type attached nexthop, for IPv4
  nexthop 10.10.10.100 GigabitEthernet0/0.806, adjacency IP adj out of GigabitEthernet0/0.806, addr 10.10.10.100 (incomplete)
  output chain: IP adj out of GigabitEthernet0/0.806, addr 10.10.10.100 (incomplete)