pix做vpn，vpn client拨入后不能访问内网

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        帮顶.  同样的问题                                                                                                                inside访问vpn地址nonat掉

做了no nat的 还是不行

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        做了no nat的 还是不行                                                                                                                配置贴上来看看

ASA Version 7.0(8)
. Y$ O6 ~# w5 Z/ B  }! V!
' {* W3 U) c8 t( J" B: H; Lhostname ciscoasa
domain-name default.domain.invalid
+ J* O; [. Y: o6 U% Y# m% Eenable password 8Ry2YjIyt7RRXU24 encrypted
  W) C% ?# F0 [7 L6 Y# C1 E3 X0 Bpasswd 2KFQnbNIdI.2KYOU encrypted
7 G' L& w0 z) t( V# Onames
7 J% X$ [2 f9 k8 H" ldns-guard
  n# x+ T! G4 j/ I: v!
interface Ethernet0/0
& n* j/ k! v/ c6 g nameif inside
security-level 100
2 B5 i5 u+ L4 @ ip address 192.168.0.1 255.255.255.0
7 q5 t, }' a, F4 Z5 t!
interface Ethernet0/1
+ c7 z$ }# E/ E( U. L5 t3 E nameif outside
  R5 f; {  f5 ^, \; y security-level 0
ip address 222.178.X.X 255.255.255.252
" R' b6 \- ^$ S!
2 R& i+ Z; w5 ?0 vinterface Ethernet0/2
shutdown
no nameif
# H+ y5 O9 _' @0 K) f& c no security-level
no ip address
!
3 d* E6 H0 e/ G$ yinterface Management0/0
nameif management
security-level 100
/ z8 m5 w; k$ L7 S0 H" n3 ~$ f ip address 192.168.1.1 255.255.255.0
  y# l: ?! u, s# H9 V management-only
!
2 X/ \! l: a! b  t% l/ d7 rftp mode passive
" t# W0 b. y: |! Gsame-security-traffic permit intra-interface
access-list 111 extended permit ip any any
access-list no-nat extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
4 O- P+ o2 [+ R6 G1 ]0 I5 ^) N- y2 Oaccess-list vpnclient_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
0 S' p  f5 G$ R2 Kpager lines 24
logging asdm informational
mtu inside 1500
( m9 |: E" ~- E5 ~mtu outside 1500
mtu management 1500
7 _) R5 x5 D0 |: }: o& _ip local pool vpnpool 192.168.10.100-192.168.10.199 mask 255.255.255.0
- h. u; L3 c+ g+ Aasdm image disk0:/asdm-508.bin
3 h# T4 U+ E% i& w# Gno asdm history enable
7 s! Z( Q) i7 F5 v2 |) Xarp timeout 14400
; B  F* T0 s: ?  Uglobal (outside) 1 interface
8 X7 E3 S8 H2 A6 snat (inside) 0 access-list no-nat
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 5900 192.168.0.210 5900 netmask 255.255.255.255
0 P  h! Q; O7 `+ w2 i, ]8 Istatic (inside,outside) tcp interface 1433 192.168.0.143 1433 netmask 255.255.255.255
7 i$ B8 p; g9 `static (inside,outside) tcp interface 1434 192.168.0.143 1434 netmask 255.255.255.255
/ n6 j. O  d7 X$ x- Z- B1 Fstatic (inside,outside) tcp interface 2425 192.168.0.143 2425 netmask 255.255.255.255
static (inside,outside) tcp interface 2426 192.168.0.143 2426 netmask 255.255.255.255
$ B1 n$ j  ?) I: y) _. \  l4 G$ Zstatic (inside,outside) tcp interface 2427 192.168.0.143 2427 netmask 255.255.255.255
' `, u7 p5 Y, _% d. Ostatic (inside,outside) tcp interface 2428 192.168.0.143 2428 netmask 255.255.255.255
static (inside,outside) tcp interface 2429 192.168.0.143 2429 netmask 255.255.255.255
static (inside,outside) tcp interface 5800 192.168.0.210 5800 netmask 255.255.255.255
# b& j/ Q" J+ e" G$ \1 X6 c+ {/ S) Caccess-group 111 in interface outside
route outside 0.0.0.0 0.0.0.0 222.178.X.X 1
/ M; \  j$ S. k9 i- i0 {9 `3 u# |timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
6 ^; N: Y+ i* @1 b0 t6 @, Ntimeout uauth 0:05:00 absolute
group-policy DfltGrpPolicy attributes
banner none
2 X7 h7 j* t! E1 V4 G) h6 U wins-server none
7 w: Q/ q2 n/ G% G9 V dns-server none
dhcp-network-scope none
5 I/ ]& l/ z6 D! b& B vpn-access-hours none
vpn-simultaneous-logins 3
8 ^! r; F: u# I3 G! w vpn-idle-timeout 30
vpn-session-timeout none
3 ]2 P2 ~) \6 p  ?# \+ V5 O) N# x6 U9 K vpn-filter none
vpn-tunnel-protocol IPSec webvpn
' Y! D+ R9 _- h3 Y: F7 w  A password-storage disable
ip-comp disable
re-xauth disable
' L# \, p- c6 B* a  | group-lock none
pfs disable
" y7 P4 u, X4 I* x ipsec-udp disable
ipsec-udp-port 10000
0 g( E$ C- }) }6 t split-tunnel-policy tunnelall
8 N# b4 Z3 T. f8 L, E  u split-tunnel-network-list none
7 I# j- i8 h$ c! c4 X3 V default-domain none
split-dns none
secure-unit-authentication disable
user-authentication disable
user-authentication-idle-timeout 30
$ f: X! [. `8 f8 ^* R ip-phone-bypass disable
1 e: \4 y' ]7 |9 I leap-bypass disable
nem disable
backup-servers keep-client-config
$ |# S! @$ |, G9 y% v client-firewall none
client-access-rule none
webvpn
1 p; g. G$ {7 q) b, N  functions url-entry
  port-forward-name value Application Access
; w& _4 B8 \9 V: m: v: v+ w3 ^group-policy vpnclient internal
2 m1 m" G6 g# }3 V/ R. B+ o/ d* Z. Zgroup-policy vpnclient attributes
. C1 q! S) `7 e- ]* G dns-server value 61.128.128.67
4 @$ e8 l/ q7 f* b6 o vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
* E) i& j: ~$ A* |) u3 W split-tunnel-network-list value vpnclient_splitTunnelAcl
7 W6 F/ \# g) q6 C8 W webvpn
. h' Z& ^' ~% e' w$ o& M3 K) D5 Z3 nusername admin11 password 2oVCF4GkSvYRaajj encrypted
6 _- Q9 Q6 E4 ~: H+ M6 }! S2 tusername admin11 attributes
4 g. V9 U/ b2 t5 | vpn-group-policy vpnclient
1 P7 B9 b9 x, E' P9 m webvpn
username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
aaa authentication ssh console LOCAL
2 K* U! c- t7 K: Q. o3 N. ]' laaa authentication enable console LOCAL
# M9 R6 `! i( D& p" Y9 Kaaa authentication http console LOCAL
aaa authentication serial console LOCAL
' b2 [( |% b. J3 A( H' waaa authentication telnet console LOCAL
http server enable
http 192.168.0.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 inside
http 0.0.0.0 0.0.0.0 outside
1 [* `! N5 F; B& d+ Mhttp 192.168.1.0 255.255.255.0 management
4 w5 B' ^5 U7 ~- u5 N: ]no snmp-server location
# `* |/ J# O  o1 n% w3 lno snmp-server contact
) q. W. z5 d" o5 [snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set vpnset esp-des esp-md5-hmac
6 y% Q* ]3 Z6 g: O6 c6 hcrypto ipsec security-association lifetime seconds 28800
) m0 H6 N/ H! W3 i' H- V; c/ Z3 ncrypto ipsec security-association lifetime kilobytes 4608000
+ ?( U$ [; w1 }% s7 Jcrypto dynamic-map outside-dyn-map 10 set transform-set vpnset
crypto dynamic-map outside-dyn-map 10 set security-association lifetime seconds 288000
crypto dynamic-map outside-dyn-map 10 set security-association lifetime kilobytes 4608000
9 F1 ]3 E, }7 wcrypto dynamic-map outside-dyn-map 10 set reverse-route
, s" z& {0 C4 ^! _7 a! hcrypto map outside_map 65535 set security-association lifetime seconds 28800
" q9 w8 d, W$ [# r! a. {crypto map outside_map 65535 set security-association lifetime kilobytes 4608000
crypto map ESP-DES-MD5 20 set security-association lifetime seconds 28800
6 u& t5 g( J: ~$ E( Rcrypto map ESP-DES-MD5 20 set security-association lifetime kilobytes 4608000
; J( M7 Q% ~  Dcrypto map mymap 10 set security-association lifetime seconds 28800
crypto map mymap 10 set security-association lifetime kilobytes 4608000
crypto map outside-map 10 ipsec-isakmp dynamic outside-dyn-map
crypto map outside-map interface outside
  y7 |7 z% T! i1 c3 Cisakmp identity address
8 v( {! N2 h7 q5 d6 xisakmp enable outside
isakmp policy 1 authentication pre-share
8 E& i" g  H% L4 Wisakmp policy 1 encryption des
, _3 A$ t) U" t; s: R5 ?( risakmp policy 1 hash md5
isakmp policy 1 group 2
5 x- @! e# S& e2 |* r( P2 v# disakmp policy 1 lifetime 86400
0 \7 R7 @  T3 k  R7 }+ a/ }isakmp nat-traversal  20
tunnel-group DefaultL2LGroup ipsec-attributes
7 w$ H* J8 L) Z6 e  y* n pre-shared-key *
tunnel-group vpnclient type ipsec-ra
; w* T: c' [' G/ _tunnel-group vpnclient general-attributes
address-pool vpnpool
+ z$ Y) `% d* U4 m$ x default-group-policy vpnclient
- K' U  S, \5 I3 ptunnel-group vpnclient ipsec-attributes
- S: ^$ E1 i  g. ~% `) ]  q9 q pre-shared-key *
2 @, l: i/ d: o+ `( L' Ktunnel-group-map default-group cisco
6 F! U" w8 l7 p0 \& y* j1 Etelnet 192.168.0.0 255.255.255.0 inside
7 h9 c9 A- L. ptelnet timeout 5
8 y9 G7 {! r1 w2 d: z- Ossh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 outside
- s. w" H& \+ }, Z8 r. Cssh timeout 60
console timeout 0
+ A3 G1 D; n( W5 z2 h# i; qdhcpd address 192.168.0.2-192.168.0.254 inside
dhcpd address 192.168.1.2-192.168.1.254 management
6 p0 p6 x/ ^& o) A! n& W2 {dhcpd dns 61.128.128.68 61.128.192.68
( }* k4 c- s9 H! p: D1 Fdhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable inside
: n/ D; x1 d. k! K+ qdhcpd enable management
!
class-map inspection_default
match default-inspection-traffic
7 V: I7 n0 ~3 U!
!
# k! x9 _2 J9 c+ {7 f3 ]policy-map global_policy
class inspection_default
1 G) }* C# n. }& O  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
' H& r/ P' e  w4 Y8 A$ Y! P$ c( L  inspect rsh
  inspect rtsp
2 K9 z) I) n* O* F6 U, K% {; @  inspect esmtp
  inspect sqlnet
! M0 D- a( C, k6 t  inspect skinny
( H, @4 O; R; V, I4 t) [" j$ f* [  inspect sunrpc
  inspect xdmcp
" S) E% [. }  `9 L  inspect sip
  inspect netbios
4 U- ^% H" X' _& K5 }  inspect tftp
1 B  d/ O0 m3 X/ `4 M!
service-policy global_policy global
, M( E" d9 u& Dclient-update enable
Cryptochecksum:aef2b202fd891d6f72ef70a222d07ad7
: end

3 |0 `$ _2 l3 v1 t( k请问下楼上的师傅QQ号是多少. 能否找你私下聊一下, 主要就是这个VPN的问题个.

设置拨号连接参数，点击“属性”进入TCP/IP协议设置，勾选“在远程网络上使用默认网关”前面的勾。