pix做vpn，vpn client拨入后不能访问内网

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        帮顶.  同样的问题                                                                                                                inside访问vpn地址nonat掉

做了no nat的 还是不行

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        做了no nat的 还是不行                                                                                                                配置贴上来看看

ASA Version 7.0(8)
!
, A4 l7 b% S- E5 ]hostname ciscoasa
domain-name default.domain.invalid
$ E- x5 m  \% }3 oenable password 8Ry2YjIyt7RRXU24 encrypted
* w& _7 C! j' \) xpasswd 2KFQnbNIdI.2KYOU encrypted
& V* V( L8 O$ [# F& l, v0 Pnames
dns-guard
0 x  t1 d- z& z' T!
6 V9 _1 s! F! e( o! C1 i( J  |interface Ethernet0/0
( M, V& [( I8 H& |2 `6 k nameif inside
7 u. [5 O7 |# F/ q$ Q4 C/ Z. W security-level 100
4 N; `, _, F6 T9 \; d ip address 192.168.0.1 255.255.255.0
!
interface Ethernet0/1
nameif outside
security-level 0
: f4 k& ^9 s" @2 M& @' q ip address 222.178.X.X 255.255.255.252
!
interface Ethernet0/2
shutdown
no nameif
no security-level
& P- B& {/ S- h$ C  z no ip address
!
interface Management0/0
nameif management
7 a; ~2 K% @' j0 N" L; I, O) N6 w1 d security-level 100
ip address 192.168.1.1 255.255.255.0
* h: B- X( r4 D" T+ q8 N8 J: y management-only
9 l) p3 B) {3 F0 ?6 f% V9 P6 Z!
# J  x9 R2 G4 @$ }9 k# _! |ftp mode passive
0 B, ?$ D8 q# c0 b$ a4 p4 osame-security-traffic permit intra-interface
access-list 111 extended permit ip any any
access-list no-nat extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list vpnclient_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
# E$ q/ n- y7 u1 Rpager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
& d( |! b( T/ @$ `/ qmtu management 1500
5 D4 z5 |% i, A; K; R( Z8 A2 uip local pool vpnpool 192.168.10.100-192.168.10.199 mask 255.255.255.0
$ p( J2 f  e2 O) t+ f& Sasdm image disk0:/asdm-508.bin
3 l$ E( t0 Z( A' s% y! Eno asdm history enable
5 R7 j+ d7 D( \% Y1 d9 varp timeout 14400
; p$ O* T  e' ?global (outside) 1 interface
5 I4 R& I  ~9 G1 E; h0 a# A0 J# Xnat (inside) 0 access-list no-nat
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 5900 192.168.0.210 5900 netmask 255.255.255.255
$ h; u( w1 T6 Y5 ostatic (inside,outside) tcp interface 1433 192.168.0.143 1433 netmask 255.255.255.255
static (inside,outside) tcp interface 1434 192.168.0.143 1434 netmask 255.255.255.255
9 D- ]9 {8 L/ gstatic (inside,outside) tcp interface 2425 192.168.0.143 2425 netmask 255.255.255.255
* u5 b% }$ n' O0 b' ?0 D: i  xstatic (inside,outside) tcp interface 2426 192.168.0.143 2426 netmask 255.255.255.255
, M3 K% J4 Z# H0 b  Ystatic (inside,outside) tcp interface 2427 192.168.0.143 2427 netmask 255.255.255.255
static (inside,outside) tcp interface 2428 192.168.0.143 2428 netmask 255.255.255.255
+ I3 q9 ]/ \! T7 ^2 j6 Zstatic (inside,outside) tcp interface 2429 192.168.0.143 2429 netmask 255.255.255.255
( ^) A; Q3 y7 ^6 |static (inside,outside) tcp interface 5800 192.168.0.210 5800 netmask 255.255.255.255
access-group 111 in interface outside
- A/ j% b' f; u6 D1 [: Xroute outside 0.0.0.0 0.0.0.0 222.178.X.X 1
timeout xlate 3:00:00
: S# [- u9 d4 J+ V! Q  r( ~timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
4 G, l0 |- `9 l( w" d2 Otimeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
2 K' a; x/ I7 }' g7 jgroup-policy DfltGrpPolicy attributes
% ^. G+ ]6 K# A1 j banner none
wins-server none
: S- C9 D7 K4 K! b- Z9 ] dns-server none
) q) |* ]7 J5 ?; `4 j, L dhcp-network-scope none
vpn-access-hours none
* }# u. Y  Y6 w, u& P7 p5 m  ^ vpn-simultaneous-logins 3
4 g! c& O+ r7 D vpn-idle-timeout 30
! E' B% L/ b# i$ ^2 y! \/ i% ` vpn-session-timeout none
) Z3 C1 s7 ?1 }9 c' H vpn-filter none
vpn-tunnel-protocol IPSec webvpn
password-storage disable
ip-comp disable
re-xauth disable
1 a* z: V5 r* w group-lock none
pfs disable
ipsec-udp disable
ipsec-udp-port 10000
; V4 i  u3 D5 a split-tunnel-policy tunnelall
2 x+ a$ G3 d/ d8 a5 ? split-tunnel-network-list none
9 X6 Q9 e" X1 g, T0 F default-domain none
7 r! e% ^! _, |/ b6 R3 z  C# \ split-dns none
secure-unit-authentication disable
user-authentication disable
user-authentication-idle-timeout 30
1 E6 w. b  ?% {4 v: Y7 P ip-phone-bypass disable
leap-bypass disable
+ d) u( g2 N7 k5 i. z% w nem disable
backup-servers keep-client-config
4 O1 A& d* E0 u client-firewall none
client-access-rule none
webvpn
  functions url-entry
  port-forward-name value Application Access
group-policy vpnclient internal
group-policy vpnclient attributes
  C& A$ i1 Y! e0 A dns-server value 61.128.128.67
vpn-tunnel-protocol IPSec
' E# L+ Z" P  r% Y3 x/ E  o split-tunnel-policy tunnelspecified
) D$ R8 q4 l' l" P+ o7 y/ b  D split-tunnel-network-list value vpnclient_splitTunnelAcl
webvpn
username admin11 password 2oVCF4GkSvYRaajj encrypted
7 ^5 E$ y3 J8 R0 Rusername admin11 attributes
vpn-group-policy vpnclient
, k( W( d4 l6 p0 v. ` webvpn
. `& L; u+ N. q9 I/ ~: Q! rusername cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
aaa authentication ssh console LOCAL
' `: S1 h* N# J" raaa authentication enable console LOCAL
1 Q* ]- {; _  V4 M" ^5 ~aaa authentication http console LOCAL
* g/ j8 G- z) saaa authentication serial console LOCAL
aaa authentication telnet console LOCAL
http server enable
' \! x4 R5 i1 vhttp 192.168.0.0 255.255.255.0 inside
$ V+ }/ ?, s4 }7 H- L- k' D1 \& U4 rhttp 0.0.0.0 0.0.0.0 inside
: L* S; e, H0 V% v+ _http 0.0.0.0 0.0.0.0 outside
: d. U: Y- l! r7 R- p7 u+ j3 jhttp 192.168.1.0 255.255.255.0 management
& r* O% w& J7 Ano snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set vpnset esp-des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
0 D" r/ X; v3 T0 u" ocrypto ipsec security-association lifetime kilobytes 4608000
1 J& `6 u2 q3 y- I# S1 Wcrypto dynamic-map outside-dyn-map 10 set transform-set vpnset
' S- J8 G& W& T6 x3 e! g% G5 _1 g) dcrypto dynamic-map outside-dyn-map 10 set security-association lifetime seconds 288000
crypto dynamic-map outside-dyn-map 10 set security-association lifetime kilobytes 4608000
crypto dynamic-map outside-dyn-map 10 set reverse-route
crypto map outside_map 65535 set security-association lifetime seconds 28800
crypto map outside_map 65535 set security-association lifetime kilobytes 4608000
  i5 q8 u4 M' P2 vcrypto map ESP-DES-MD5 20 set security-association lifetime seconds 28800
* q$ m7 \: _# @  jcrypto map ESP-DES-MD5 20 set security-association lifetime kilobytes 4608000
1 G1 e$ x; S: S2 C" d: g) P8 o1 vcrypto map mymap 10 set security-association lifetime seconds 28800
" J+ D. s% V) W  U4 h( c/ h- mcrypto map mymap 10 set security-association lifetime kilobytes 4608000
1 E/ U4 |% z# {4 O! Zcrypto map outside-map 10 ipsec-isakmp dynamic outside-dyn-map
: j5 B" Y  i; D- }3 ccrypto map outside-map interface outside
: x/ d4 E5 @6 `$ }isakmp identity address
9 X% u% _3 C  ^* k9 T2 d) a' Jisakmp enable outside
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption des
isakmp policy 1 hash md5
isakmp policy 1 group 2
5 e1 U- d* j8 j2 _; zisakmp policy 1 lifetime 86400
isakmp nat-traversal  20
tunnel-group DefaultL2LGroup ipsec-attributes
pre-shared-key *
2 Y0 U/ Z  e7 |: F' t# B9 n4 Stunnel-group vpnclient type ipsec-ra
5 B+ s2 l( J$ \" otunnel-group vpnclient general-attributes
address-pool vpnpool
default-group-policy vpnclient
# i/ d6 Z# W; p, C2 {tunnel-group vpnclient ipsec-attributes
pre-shared-key *
  U( x: q6 n" W% Q2 Z3 q0 Itunnel-group-map default-group cisco
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
3 @4 L2 @- ^# I: U7 ?. mssh 0.0.0.0 0.0.0.0 outside
: s# o, P2 p  a; J& e1 ^, mssh timeout 60
, p& m  ^' I& Z3 {console timeout 0
dhcpd address 192.168.0.2-192.168.0.254 inside
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd dns 61.128.128.68 61.128.192.68
$ w) w* M+ D: h. s' x7 jdhcpd lease 3600
1 S$ S+ ~7 K, X9 c% H/ z  ^dhcpd ping_timeout 50
dhcpd enable inside
% ~: J) l  ^; _; Idhcpd enable management
# K  }& O# Z7 e! r!
class-map inspection_default
4 w. Q! t& y; Z  n  y# i match default-inspection-traffic
!
!
policy-map global_policy
2 |; l4 F' B9 r class inspection_default
! p4 Q5 k1 g  I  inspect dns maximum-length 512
3 H# b5 w3 D! ^4 i. {  inspect ftp
' z: \9 y% g. V* C4 z  inspect h323 h225
4 C) D( V& e' N$ |4 }% Y3 m  inspect h323 ras
  inspect rsh
  inspect rtsp
! D: F& ]4 Y4 r: L% `  inspect esmtp
  inspect sqlnet
  inspect skinny
) R; h7 \' O6 \/ f# m+ w1 `  inspect sunrpc
+ l- C! k' @" O  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
) }& q$ W1 G1 c( P, N3 L7 jservice-policy global_policy global
client-update enable
9 b2 @7 X7 L: J1 ?' tCryptochecksum:aef2b202fd891d6f72ef70a222d07ad7
* ~4 C8 f' i& c2 Q% h) W) M: end

2 k1 [5 z6 B: J3 P( N5 a6 F请问下楼上的师傅QQ号是多少. 能否找你私下聊一下, 主要就是这个VPN的问题个.

设置拨号连接参数，点击“属性”进入TCP/IP协议设置，勾选“在远程网络上使用默认网关”前面的勾。