pix做vpn，vpn client拨入后不能访问内网

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        帮顶.  同样的问题                                                                                                                inside访问vpn地址nonat掉

做了no nat的 还是不行

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        做了no nat的 还是不行                                                                                                                配置贴上来看看

ASA Version 7.0(8)
0 k- L' O! ^! I!
hostname ciscoasa
domain-name default.domain.invalid
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
7 V2 z6 G/ F( s9 |8 Qdns-guard
% _  a+ F+ c" q% q. Y: B!
interface Ethernet0/0
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0
!
interface Ethernet0/1
nameif outside
: r/ @( A+ B& ]/ z9 N$ x security-level 0
ip address 222.178.X.X 255.255.255.252
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
9 V  g. a: w7 P$ M# Iinterface Management0/0
nameif management
security-level 100
. X+ Y' t8 w, C7 |" f. ]0 ~ ip address 192.168.1.1 255.255.255.0
, L) E5 W: L8 c- Y management-only
- z6 ?; Z" U/ {!
ftp mode passive
6 v. Q( r: _- G% O3 Y! csame-security-traffic permit intra-interface
# O8 i5 E) H. x, a* @6 F8 m! qaccess-list 111 extended permit ip any any
6 C) |1 k' ~* i/ }/ w2 J6 Aaccess-list no-nat extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list vpnclient_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
pager lines 24
logging asdm informational
mtu inside 1500
8 D/ Q& L# ~4 D9 y- amtu outside 1500
mtu management 1500
$ [' w1 g( X" b/ y/ Cip local pool vpnpool 192.168.10.100-192.168.10.199 mask 255.255.255.0
asdm image disk0:/asdm-508.bin
2 Q) S: v" ?' i) `0 gno asdm history enable
4 H2 N2 k# A: X" P9 v: Z$ [) `arp timeout 14400
- X% g+ G4 A2 g1 t3 n' k1 D: F! eglobal (outside) 1 interface
nat (inside) 0 access-list no-nat
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 5900 192.168.0.210 5900 netmask 255.255.255.255
static (inside,outside) tcp interface 1433 192.168.0.143 1433 netmask 255.255.255.255
, S6 R, b7 m+ S% L% b; n, rstatic (inside,outside) tcp interface 1434 192.168.0.143 1434 netmask 255.255.255.255
/ W* Z% F( G8 x. Y( E* g& `static (inside,outside) tcp interface 2425 192.168.0.143 2425 netmask 255.255.255.255
static (inside,outside) tcp interface 2426 192.168.0.143 2426 netmask 255.255.255.255
static (inside,outside) tcp interface 2427 192.168.0.143 2427 netmask 255.255.255.255
* s$ G6 C: |  u+ Z: C$ dstatic (inside,outside) tcp interface 2428 192.168.0.143 2428 netmask 255.255.255.255
static (inside,outside) tcp interface 2429 192.168.0.143 2429 netmask 255.255.255.255
static (inside,outside) tcp interface 5800 192.168.0.210 5800 netmask 255.255.255.255
+ I, C  E- v  M5 a  b( F0 c/ G! @1 ]access-group 111 in interface outside
5 K/ t& R" P  d7 l6 p* W, i6 E9 y/ _route outside 0.0.0.0 0.0.0.0 222.178.X.X 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
2 \: h) w) ]& F: Dtimeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
, M! t$ ]$ F: F, ztimeout uauth 0:05:00 absolute
group-policy DfltGrpPolicy attributes
# w; Q. Y  h3 d* l2 ~6 P) [  T banner none
8 K/ ]7 C2 U4 p wins-server none
  Y5 }& d! e3 K dns-server none
2 y' E( a/ n1 N/ R; X( f6 t+ v dhcp-network-scope none
( D6 k5 d& v+ B% F: e vpn-access-hours none
! G9 g' e  o. u- W vpn-simultaneous-logins 3
vpn-idle-timeout 30
' ~- ?1 \% Y8 r' v) U6 f vpn-session-timeout none
1 G8 t9 J5 H  B! N3 w) n vpn-filter none
vpn-tunnel-protocol IPSec webvpn
password-storage disable
# I0 g- }5 g  b. T- Q5 }2 _ ip-comp disable
re-xauth disable
! G6 O3 x& k; Q$ Y& g" q group-lock none
: r6 h! R/ D! m2 N2 \, Z8 M pfs disable
$ Q* _- ]7 W6 I+ s. H1 Z2 h# g ipsec-udp disable
ipsec-udp-port 10000
split-tunnel-policy tunnelall
8 @) z4 Q( W/ h! W( s split-tunnel-network-list none
9 O1 t2 _% d# {) k7 J  u* S default-domain none
7 S% i- U5 V* ~ split-dns none
; y! R8 b+ N+ u0 M: C" ? secure-unit-authentication disable
user-authentication disable
user-authentication-idle-timeout 30
ip-phone-bypass disable
leap-bypass disable
2 u% }$ P1 g# r) c% t$ M0 X# p! A nem disable
: S$ |& Q. D+ H9 v" \ backup-servers keep-client-config
client-firewall none
8 W& `4 W6 m" O client-access-rule none
webvpn
  functions url-entry
7 Y8 r; f. N0 I+ q. }3 x# I) m  port-forward-name value Application Access
- W' _7 f7 B- ?* H0 u) x+ x) bgroup-policy vpnclient internal
group-policy vpnclient attributes
! v* b4 A" j: ~* n& k dns-server value 61.128.128.67
8 R  O6 a1 l( U4 A- J vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnclient_splitTunnelAcl
' A2 A! ]4 d: ?9 m webvpn
, B- d5 y8 k% l2 k5 Zusername admin11 password 2oVCF4GkSvYRaajj encrypted
: ^* j4 ^! k* E% Z7 Q# ]$ \# K: Qusername admin11 attributes
vpn-group-policy vpnclient
webvpn
% z3 x4 z, p8 t; {/ e/ g" g( {username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
' k" {/ L! {" h' c/ m, ^aaa authentication ssh console LOCAL
' d3 m, U+ `2 q% b0 haaa authentication enable console LOCAL
4 \' I9 Y* A: S* V/ G) m$ v  uaaa authentication http console LOCAL
7 L! f& {1 u$ vaaa authentication serial console LOCAL
4 N9 U) H& b! j; C; F! h1 caaa authentication telnet console LOCAL
; q( L0 C$ L! @  M" l( y, z* ?http server enable
' ?5 f+ l: y4 A8 d. j$ Uhttp 192.168.0.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 inside
$ Q8 k* i" R# B0 fhttp 0.0.0.0 0.0.0.0 outside
# U9 c. l5 J4 B9 a. qhttp 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
3 F1 C* l6 C; U3 Tcrypto ipsec transform-set vpnset esp-des esp-md5-hmac
) a& B5 ?" w' l/ _crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
* n0 ^2 }6 v5 \2 bcrypto dynamic-map outside-dyn-map 10 set transform-set vpnset
crypto dynamic-map outside-dyn-map 10 set security-association lifetime seconds 288000
& S, X0 P5 L5 C+ \' Ocrypto dynamic-map outside-dyn-map 10 set security-association lifetime kilobytes 4608000
crypto dynamic-map outside-dyn-map 10 set reverse-route
- Z# j8 T: Q2 H7 g$ z6 S/ Rcrypto map outside_map 65535 set security-association lifetime seconds 28800
; i/ V+ ?2 F) K, o' |! Lcrypto map outside_map 65535 set security-association lifetime kilobytes 4608000
2 O7 E$ N' y3 u" b2 h+ n" Pcrypto map ESP-DES-MD5 20 set security-association lifetime seconds 28800
; Q* t2 u1 y( N, b! i8 `crypto map ESP-DES-MD5 20 set security-association lifetime kilobytes 4608000
& T6 M% W' y* M; ?crypto map mymap 10 set security-association lifetime seconds 28800
! M6 |: L% z( U: o* g) E9 {$ Tcrypto map mymap 10 set security-association lifetime kilobytes 4608000
crypto map outside-map 10 ipsec-isakmp dynamic outside-dyn-map
crypto map outside-map interface outside
isakmp identity address
isakmp enable outside
  q, s# a3 [2 j% e& Uisakmp policy 1 authentication pre-share
isakmp policy 1 encryption des
isakmp policy 1 hash md5
isakmp policy 1 group 2
7 D% q9 c7 C0 H8 s9 sisakmp policy 1 lifetime 86400
# q- R4 S9 E! P$ _" U$ n5 V* \- pisakmp nat-traversal  20
tunnel-group DefaultL2LGroup ipsec-attributes
* T$ A& H5 S. o# a; ?* Q pre-shared-key *
tunnel-group vpnclient type ipsec-ra
: R" @+ I; F$ h  itunnel-group vpnclient general-attributes
# p" o& i: X) `# Q7 ^ address-pool vpnpool
( M$ i1 K  B+ B- [7 U4 k( }7 c default-group-policy vpnclient
tunnel-group vpnclient ipsec-attributes
1 i2 z( F7 Q; K0 n5 E, Q pre-shared-key *
1 u' B# |- O" C/ dtunnel-group-map default-group cisco
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 outside
3 e& B5 |/ u- |6 M* b6 y9 E9 v! u! cssh timeout 60
console timeout 0
/ D8 p% ~' ?7 y, }1 E/ Edhcpd address 192.168.0.2-192.168.0.254 inside
/ X5 V3 @4 w9 J: m$ p1 I) Rdhcpd address 192.168.1.2-192.168.1.254 management
# h# i$ E& P" N( S5 Fdhcpd dns 61.128.128.68 61.128.192.68
5 F7 n- `' Q7 @2 p# Pdhcpd lease 3600
dhcpd ping_timeout 50
' `: s# e  b+ B: i% D& [dhcpd enable inside
# ]. C; C# t/ }5 B2 Rdhcpd enable management
!
class-map inspection_default
# x5 g: v7 z2 W, g6 K* Q$ K9 M match default-inspection-traffic
!
2 G2 @0 p( [5 ?5 K  N1 `!
4 n; P" I1 ]2 h5 z, ~$ J6 }policy-map global_policy
3 @3 e. X1 L+ D6 T# Q class inspection_default
  inspect dns maximum-length 512
  inspect ftp
" M7 {! r" P/ X( }" m6 n( o  inspect h323 h225
  inspect h323 ras
& R' I0 A. o( R% t) @  inspect rsh
  inspect rtsp
) \6 E/ g5 ^/ Z, N8 }3 c  inspect esmtp
  inspect sqlnet
* R& K4 _5 S: e, Z' S  inspect skinny
3 s% H- Y2 u* E# G( I  inspect sunrpc
  inspect xdmcp
/ b6 X! T' u* c8 C; Q  inspect sip
  inspect netbios
! i1 h, O1 m! w' Q: {* b  inspect tftp
, g; T0 Y3 M' T' ]* h( O!
service-policy global_policy global
' A" J( a9 ^+ A  s. _4 V, @client-update enable
Cryptochecksum:aef2b202fd891d6f72ef70a222d07ad7
' |) }* t7 j9 v0 g# p  B8 i: end
8 h4 S: p: z! H  v
请问下楼上的师傅QQ号是多少. 能否找你私下聊一下, 主要就是这个VPN的问题个.

设置拨号连接参数，点击“属性”进入TCP/IP协议设置，勾选“在远程网络上使用默认网关”前面的勾。