pix做vpn，vpn client拨入后不能访问内网

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        帮顶.  同样的问题                                                                                                                inside访问vpn地址nonat掉

做了no nat的 还是不行

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        做了no nat的 还是不行                                                                                                                配置贴上来看看

ASA Version 7.0(8)
!
5 v* U' o& Z6 ]7 w; Khostname ciscoasa
domain-name default.domain.invalid
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
8 F0 K+ @4 S( I1 P4 m7 @2 Q) kdns-guard
. [, v- Z( ]* ~6 ?1 H!
$ D: }7 ~4 G; G% h0 \4 tinterface Ethernet0/0
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0
!
interface Ethernet0/1
  I5 \3 a9 B2 x+ R8 Y1 z9 | nameif outside
5 G6 @6 P( T* X3 B2 c5 F security-level 0
ip address 222.178.X.X 255.255.255.252
4 u  t" X& X4 I2 s!
& E- a! p  @) ^2 Tinterface Ethernet0/2
& B1 A2 ]( A  @9 j. E shutdown
- ~- n3 Q' v2 K, f6 T& i# \ no nameif
no security-level
no ip address
: @( {  ]) ~  Z7 M!
interface Management0/0
nameif management
. Q- f- O' `" d' ^% o* m2 P+ l security-level 100
, y3 k6 T" X; F# ?1 A( ]  D ip address 192.168.1.1 255.255.255.0
0 H, f, O; |! L& H9 r) V1 s; h management-only
!
ftp mode passive
same-security-traffic permit intra-interface
access-list 111 extended permit ip any any
access-list no-nat extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
4 c: ~# e1 ]# Jaccess-list vpnclient_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
$ f; Q) r9 U, spager lines 24
logging asdm informational
mtu inside 1500
" l- L# H7 n. e. D- Emtu outside 1500
mtu management 1500
6 J8 T/ Y  h# a% f& i8 Cip local pool vpnpool 192.168.10.100-192.168.10.199 mask 255.255.255.0
asdm image disk0:/asdm-508.bin
+ C3 J! H; j- p5 Vno asdm history enable
- f" p" G+ x* T% e! [* i+ ]arp timeout 14400
3 [  V& s  a# D1 N. pglobal (outside) 1 interface
nat (inside) 0 access-list no-nat
nat (inside) 1 0.0.0.0 0.0.0.0
4 R7 \: }2 w; `3 g6 u$ Lstatic (inside,outside) tcp interface 5900 192.168.0.210 5900 netmask 255.255.255.255
% Y$ E- U0 Y) g* \! G& U4 |static (inside,outside) tcp interface 1433 192.168.0.143 1433 netmask 255.255.255.255
: h5 @4 q; q+ j  Z8 z/ Ustatic (inside,outside) tcp interface 1434 192.168.0.143 1434 netmask 255.255.255.255
! H4 B/ f. j/ U/ k( L+ ^static (inside,outside) tcp interface 2425 192.168.0.143 2425 netmask 255.255.255.255
static (inside,outside) tcp interface 2426 192.168.0.143 2426 netmask 255.255.255.255
static (inside,outside) tcp interface 2427 192.168.0.143 2427 netmask 255.255.255.255
- M6 J/ P4 u' n6 qstatic (inside,outside) tcp interface 2428 192.168.0.143 2428 netmask 255.255.255.255
static (inside,outside) tcp interface 2429 192.168.0.143 2429 netmask 255.255.255.255
static (inside,outside) tcp interface 5800 192.168.0.210 5800 netmask 255.255.255.255
access-group 111 in interface outside
route outside 0.0.0.0 0.0.0.0 222.178.X.X 1
6 ~. M- M8 [. d$ u' stimeout xlate 3:00:00
$ O7 Y9 Q' l8 u( ?, ~; C- Ftimeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
) @! M/ p& t. x* d; V" A& ^* Ltimeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
group-policy DfltGrpPolicy attributes
2 R% P0 ]& d  h4 ~2 I, r3 k; V banner none
/ ~; k7 i) K5 J- t7 Z* ]6 X% Q wins-server none
dns-server none
dhcp-network-scope none
! k2 [' J) E. j: v; E vpn-access-hours none
3 n0 j; Z; c: P6 S! [ vpn-simultaneous-logins 3
2 U& Y: j+ I7 ?4 `' q  I- W# L! h! C vpn-idle-timeout 30
vpn-session-timeout none
$ Z* f6 }1 F2 Q5 A0 S3 T vpn-filter none
4 e: B( O/ v2 @, j3 V' M! } vpn-tunnel-protocol IPSec webvpn
& W/ P2 Z" s. t9 j. K$ w# r5 S$ k) K password-storage disable
) J* [8 _- N4 W! E; W$ ?! e ip-comp disable
5 L7 g0 Y2 b2 q! u4 L3 \# } re-xauth disable
' L' e! w% v; C3 l! U: M group-lock none
# _& y' X, k7 \; ~. B* v- N pfs disable
  B, W2 }0 h, X ipsec-udp disable
ipsec-udp-port 10000
split-tunnel-policy tunnelall
$ ], c0 j! i! A; }' h7 z. j split-tunnel-network-list none
3 F8 a, T3 W1 E default-domain none
split-dns none
1 V/ j. a# f0 l- m& v% L$ @9 U! C secure-unit-authentication disable
user-authentication disable
user-authentication-idle-timeout 30
ip-phone-bypass disable
leap-bypass disable
nem disable
) f  G6 I; y( i. U2 D% R$ m3 Q backup-servers keep-client-config
! i" m% T) x! U client-firewall none
; Q8 h6 Z6 e% k/ w+ m" x client-access-rule none
webvpn
  functions url-entry
9 `8 ?( A' [# }/ d  port-forward-name value Application Access
2 i) ?& h" _# Z& k3 I* Y% _! ygroup-policy vpnclient internal
group-policy vpnclient attributes
dns-server value 61.128.128.67
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnclient_splitTunnelAcl
8 t- ]5 V; v7 ]( x webvpn
username admin11 password 2oVCF4GkSvYRaajj encrypted
username admin11 attributes
8 @& e, o! B3 v vpn-group-policy vpnclient
webvpn
2 T* U4 U* D4 E, [; uusername cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
" \6 v/ Q2 \  N; I- e+ yaaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
0 I0 c. p' U( w! baaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication telnet console LOCAL
# O, E7 O" g/ l3 f( whttp server enable
http 192.168.0.0 255.255.255.0 inside
# v1 _' j$ c8 j2 h# n  u' p1 Lhttp 0.0.0.0 0.0.0.0 inside
# ^9 f0 Z# C- [4 Shttp 0.0.0.0 0.0.0.0 outside
. [# m" F" v7 F" uhttp 192.168.1.0 255.255.255.0 management
/ j5 o6 M7 W5 f) `) G: cno snmp-server location
, D6 E  a4 S* N  Y  pno snmp-server contact
+ F+ W' N' S3 f; Fsnmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set vpnset esp-des esp-md5-hmac
3 g' Z. w3 W2 R" fcrypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map outside-dyn-map 10 set transform-set vpnset
$ B+ C; D6 Q6 z. ?% Lcrypto dynamic-map outside-dyn-map 10 set security-association lifetime seconds 288000
crypto dynamic-map outside-dyn-map 10 set security-association lifetime kilobytes 4608000
crypto dynamic-map outside-dyn-map 10 set reverse-route
crypto map outside_map 65535 set security-association lifetime seconds 28800
2 K- s1 {6 u& bcrypto map outside_map 65535 set security-association lifetime kilobytes 4608000
  t  f' ~* H  l1 Wcrypto map ESP-DES-MD5 20 set security-association lifetime seconds 28800
$ r6 s1 _4 O0 M/ W1 Z; o+ [% Mcrypto map ESP-DES-MD5 20 set security-association lifetime kilobytes 4608000
crypto map mymap 10 set security-association lifetime seconds 28800
" n) a+ X  \; _) c7 E  Z& Jcrypto map mymap 10 set security-association lifetime kilobytes 4608000
crypto map outside-map 10 ipsec-isakmp dynamic outside-dyn-map
crypto map outside-map interface outside
% O# I- x& D( M$ Iisakmp identity address
) v8 }# P# [9 O0 l9 ~7 tisakmp enable outside
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption des
! h) j5 J# @7 ^1 f( Pisakmp policy 1 hash md5
isakmp policy 1 group 2
' B- s; n" d0 r$ H  ^& i2 lisakmp policy 1 lifetime 86400
+ W, M8 H9 \  t. yisakmp nat-traversal  20
/ B+ y/ _5 T8 D2 a. ttunnel-group DefaultL2LGroup ipsec-attributes
7 Q" f7 C. U* A- @ pre-shared-key *
tunnel-group vpnclient type ipsec-ra
' s) a3 H0 M$ k6 m; @! Ptunnel-group vpnclient general-attributes
address-pool vpnpool
default-group-policy vpnclient
- r: w7 x0 R) u! a3 ttunnel-group vpnclient ipsec-attributes
$ k8 V8 z' ~" u) B( N0 G4 U pre-shared-key *
- N* Q7 |0 w, `5 Gtunnel-group-map default-group cisco
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
8 g2 i1 D5 Z3 ]& H" S/ l2 Bssh 0.0.0.0 0.0.0.0 outside
ssh timeout 60
* n8 z# T  ?4 aconsole timeout 0
dhcpd address 192.168.0.2-192.168.0.254 inside
7 G% ^" S$ s# f1 ldhcpd address 192.168.1.2-192.168.1.254 management
) s7 c  s. y( K0 V2 K4 @dhcpd dns 61.128.128.68 61.128.192.68
* P0 E7 {, |+ E( fdhcpd lease 3600
3 S7 A2 n+ K- Q' y$ P& n. S( tdhcpd ping_timeout 50
9 g# O4 f: V6 l& T; w3 pdhcpd enable inside
dhcpd enable management
!
; O9 F  z$ {5 w  G2 i& Sclass-map inspection_default
match default-inspection-traffic
% |  K5 `. `  Y7 P!
. u8 @, E! p- |7 \, i0 }& f!
policy-map global_policy
class inspection_default
& a& g, S6 Q) }7 i* r( J7 A( ^  inspect dns maximum-length 512
- _+ n; n* t. J- N) @  inspect ftp
6 u, W7 N: B3 B9 ?! m  inspect h323 h225
" Y4 I  Q* B; R: ?* l3 T  inspect h323 ras
  inspect rsh
  inspect rtsp
9 ]6 [  B, p5 E9 V/ q! D  inspect esmtp
  inspect sqlnet
0 A+ Z, S8 [3 h3 e* g  inspect skinny
  inspect sunrpc
  inspect xdmcp
3 N( H+ i% l. n' s& \" }9 {  k  inspect sip
9 B8 Y; a2 c' A6 h  inspect netbios
8 u% A" H6 p, Z% ], Y: r+ K  inspect tftp
: k" I7 o# c$ x- h2 n!
service-policy global_policy global
5 k% Z# i( q/ Y- Hclient-update enable
+ C4 _9 T, z9 U. B& eCryptochecksum:aef2b202fd891d6f72ef70a222d07ad7
. @# Z! V3 L3 r- L1 L% M: V: end

9 x' N+ _- N  A5 a5 i7 X请问下楼上的师傅QQ号是多少. 能否找你私下聊一下, 主要就是这个VPN的问题个.

设置拨号连接参数，点击“属性”进入TCP/IP协议设置，勾选“在远程网络上使用默认网关”前面的勾。