pix做vpn，vpn client拨入后不能访问内网

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        帮顶.  同样的问题                                                                                                                inside访问vpn地址nonat掉

做了no nat的 还是不行

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        做了no nat的 还是不行                                                                                                                配置贴上来看看

ASA Version 7.0(8)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password 8Ry2YjIyt7RRXU24 encrypted
7 N2 `; E6 A8 c( P$ mpasswd 2KFQnbNIdI.2KYOU encrypted
names
( J1 u8 C/ Z5 ?- A1 H: Q6 cdns-guard
* [# N6 d4 E2 t- @  R5 I!
interface Ethernet0/0
9 v: r6 g) b& z+ p" d/ f nameif inside
security-level 100
6 G" N9 }% S6 k0 P+ E+ |  q9 W$ U ip address 192.168.0.1 255.255.255.0
!
: ^2 W- }2 X+ u$ Z4 Winterface Ethernet0/1
nameif outside
security-level 0
ip address 222.178.X.X 255.255.255.252
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
, }3 g0 T" ?8 f4 ^7 o: F' i7 k security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
  f# U& M* R1 o, |, y!
: M% e2 L6 I* \! |# ^7 Nftp mode passive
same-security-traffic permit intra-interface
6 t- z4 }  G) ], [" A: t& yaccess-list 111 extended permit ip any any
access-list no-nat extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
! U: x8 T5 v! R# k. V7 Daccess-list vpnclient_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
pager lines 24
logging asdm informational
* y8 o& l& }& o7 @$ r: Qmtu inside 1500
+ ^$ U/ |! k' z9 _& d4 a# d7 ^! K9 G! tmtu outside 1500
mtu management 1500
. z0 l4 t/ D* C/ R2 O( i1 J0 D9 |ip local pool vpnpool 192.168.10.100-192.168.10.199 mask 255.255.255.0
asdm image disk0:/asdm-508.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
9 F8 P) _. }8 u/ O3 r) V/ a  pnat (inside) 0 access-list no-nat
nat (inside) 1 0.0.0.0 0.0.0.0
1 T% w* ?1 b# v% x- @static (inside,outside) tcp interface 5900 192.168.0.210 5900 netmask 255.255.255.255
9 Z$ C, m2 f, b0 ~* {* hstatic (inside,outside) tcp interface 1433 192.168.0.143 1433 netmask 255.255.255.255
5 D! {+ g* M& fstatic (inside,outside) tcp interface 1434 192.168.0.143 1434 netmask 255.255.255.255
static (inside,outside) tcp interface 2425 192.168.0.143 2425 netmask 255.255.255.255
6 ^! N3 U1 r9 P  [. q4 sstatic (inside,outside) tcp interface 2426 192.168.0.143 2426 netmask 255.255.255.255
static (inside,outside) tcp interface 2427 192.168.0.143 2427 netmask 255.255.255.255
6 f  p% R5 s( o1 Ystatic (inside,outside) tcp interface 2428 192.168.0.143 2428 netmask 255.255.255.255
' V: E1 x4 {. l+ f" Xstatic (inside,outside) tcp interface 2429 192.168.0.143 2429 netmask 255.255.255.255
# G4 Y( A7 W+ {static (inside,outside) tcp interface 5800 192.168.0.210 5800 netmask 255.255.255.255
4 e! r+ B0 `, S5 }* v  saccess-group 111 in interface outside
route outside 0.0.0.0 0.0.0.0 222.178.X.X 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
4 S5 Q" w" c' C3 X  egroup-policy DfltGrpPolicy attributes
& w& Z' O, `, S; i banner none
wins-server none
- h7 o8 X( A" H. l1 C( v dns-server none
6 t) q- J0 R' J9 j( t7 J& @; O dhcp-network-scope none
vpn-access-hours none
vpn-simultaneous-logins 3
vpn-idle-timeout 30
2 I, m4 f! T4 }( y6 n. { vpn-session-timeout none
. I* c1 I, v% \& ^5 u: \ vpn-filter none
* f+ e* J. x5 O- b* n& S3 \2 _2 n vpn-tunnel-protocol IPSec webvpn
password-storage disable
, j4 p) i5 B4 p' r$ q  [$ Z ip-comp disable
re-xauth disable
* f, Z5 U0 {8 L5 s/ f group-lock none
2 i+ Z2 w+ y: d# e8 x pfs disable
1 U( b* M3 u! ` ipsec-udp disable
$ j3 [/ }* p5 R, [ ipsec-udp-port 10000
split-tunnel-policy tunnelall
split-tunnel-network-list none
default-domain none
' S+ z, J/ A) X3 @ split-dns none
& }, g2 V* N# ~( D secure-unit-authentication disable
user-authentication disable
3 i; _1 Q* x. z( n. x user-authentication-idle-timeout 30
* T* n, W! o6 s' e ip-phone-bypass disable
7 {& v" l2 X& x; O) _ leap-bypass disable
4 J  M% _- r( z& W+ _. P nem disable
2 Y9 g) b4 L+ U* O4 T: K7 S backup-servers keep-client-config
client-firewall none
client-access-rule none
0 `: ?8 }' l+ N! r webvpn
  functions url-entry
  port-forward-name value Application Access
1 e' p5 c) ?! o  O0 Egroup-policy vpnclient internal
group-policy vpnclient attributes
dns-server value 61.128.128.67
$ M. K# X: B$ I9 o vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
3 p1 ?' A- @& `+ b& V! |6 r' ? split-tunnel-network-list value vpnclient_splitTunnelAcl
webvpn
6 E6 b8 e9 ^4 _' ~/ @8 cusername admin11 password 2oVCF4GkSvYRaajj encrypted
username admin11 attributes
vpn-group-policy vpnclient
& X4 H1 p, N3 A6 c webvpn
username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
% r" ^6 \% E  V% Z; ^aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
1 \4 U2 f) O' {aaa authentication serial console LOCAL
aaa authentication telnet console LOCAL
http server enable
. ?5 D! W4 Q7 M  O4 y8 w& vhttp 192.168.0.0 255.255.255.0 inside
6 ^% Y  U8 c# ]7 \% c, B1 rhttp 0.0.0.0 0.0.0.0 inside
http 0.0.0.0 0.0.0.0 outside
) C* w5 T3 F) w% K1 \2 s1 q* Z; Xhttp 192.168.1.0 255.255.255.0 management
6 [: ~* R& J3 u( L6 xno snmp-server location
6 c! x' b; k, k5 R3 ~no snmp-server contact
  ?1 s0 x5 R" Wsnmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set vpnset esp-des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
/ h- _" }' q2 O- S' g  Qcrypto dynamic-map outside-dyn-map 10 set transform-set vpnset
crypto dynamic-map outside-dyn-map 10 set security-association lifetime seconds 288000
crypto dynamic-map outside-dyn-map 10 set security-association lifetime kilobytes 4608000
, C8 ?/ q# \5 k+ c6 s* Dcrypto dynamic-map outside-dyn-map 10 set reverse-route
# z# A# q& [& }. J- z0 wcrypto map outside_map 65535 set security-association lifetime seconds 28800
crypto map outside_map 65535 set security-association lifetime kilobytes 4608000
; _  }; ~9 }9 R/ B. b2 ^  x: L4 _crypto map ESP-DES-MD5 20 set security-association lifetime seconds 28800
crypto map ESP-DES-MD5 20 set security-association lifetime kilobytes 4608000
. d/ }3 N  I8 m  i$ Y% @. |crypto map mymap 10 set security-association lifetime seconds 28800
* r/ g+ Q& j, X# Q4 p' v+ h7 {crypto map mymap 10 set security-association lifetime kilobytes 4608000
crypto map outside-map 10 ipsec-isakmp dynamic outside-dyn-map
9 s/ a$ q, j$ ^: ^crypto map outside-map interface outside
. M/ p% x  Y: j, |3 {  Sisakmp identity address
; E0 V7 c, D& y/ s; E" ?isakmp enable outside
isakmp policy 1 authentication pre-share
9 ?: c, L, e$ G& _  @" b/ ~isakmp policy 1 encryption des
, \5 u& h- P8 m. eisakmp policy 1 hash md5
isakmp policy 1 group 2
+ W. b2 S4 ~5 }7 Z7 T: Pisakmp policy 1 lifetime 86400
6 O$ [" \9 d8 nisakmp nat-traversal  20
tunnel-group DefaultL2LGroup ipsec-attributes
8 P6 D4 a8 J1 Q' Y pre-shared-key *
2 F- z" y& _  Dtunnel-group vpnclient type ipsec-ra
tunnel-group vpnclient general-attributes
; n# W  u7 G6 y" f( Z3 w1 ~0 [% ]" d- | address-pool vpnpool
default-group-policy vpnclient
+ H' v, e/ c) `6 Utunnel-group vpnclient ipsec-attributes
* r1 u8 y2 l0 w4 f3 [4 q pre-shared-key *
. e; k5 T6 |) b0 C  c( @2 Qtunnel-group-map default-group cisco
. {& B  V1 ?8 u4 Ytelnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 outside
: N/ e/ F6 E7 D! ~# s' Q! xssh timeout 60
; W* `- w+ M  f$ c0 k' {$ `console timeout 0
dhcpd address 192.168.0.2-192.168.0.254 inside
% M  }9 T% n7 \3 u$ [- Gdhcpd address 192.168.1.2-192.168.1.254 management
! O) j. ]0 D; P" Q/ }* mdhcpd dns 61.128.128.68 61.128.192.68
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable inside
dhcpd enable management
/ b5 t' w2 h+ \$ n7 v# Q!
9 N  e1 _! [4 @6 d- I) l8 Bclass-map inspection_default
match default-inspection-traffic
!
8 K: X, m/ C! p, I. Z!
  M6 t& g/ Y% e, Vpolicy-map global_policy
9 x, h9 k- w5 I& b$ U class inspection_default
" G2 e* D+ e9 Y  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
/ k& |6 H, @3 p! `  t/ s5 R  inspect h323 ras
  inspect rsh
% f2 J& f7 }, I/ b6 s  inspect rtsp
/ j5 d: i4 Y: B2 q' S; C  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
6 Q  l1 [9 N, l6 U) O8 N/ Y  inspect xdmcp
# ?1 w( E8 V. ?6 C/ U6 [* Y  inspect sip
  inspect netbios
) T7 S; U% h1 n' F$ i  inspect tftp
!
  A8 N. S4 [4 \: l) vservice-policy global_policy global
client-update enable
Cryptochecksum:aef2b202fd891d6f72ef70a222d07ad7
' z8 E1 l* e$ x% @/ u( v, E) O5 p0 i7 k: end
8 Q1 n+ |, e, N" s
请问下楼上的师傅QQ号是多少. 能否找你私下聊一下, 主要就是这个VPN的问题个.

设置拨号连接参数，点击“属性”进入TCP/IP协议设置，勾选“在远程网络上使用默认网关”前面的勾。