pix做vpn，vpn client拨入后不能访问内网

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        帮顶.  同样的问题                                                                                                                inside访问vpn地址nonat掉

做了no nat的 还是不行

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        做了no nat的 还是不行                                                                                                                配置贴上来看看

ASA Version 7.0(8)
4 x* w( I& k8 I!
hostname ciscoasa
! L: Z8 S& h9 D4 bdomain-name default.domain.invalid
& G% u: ]8 Q) m; C, S  [1 R5 ?enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
dns-guard
!
interface Ethernet0/0
% ?6 r0 g% @, [1 Y! o nameif inside
7 I: ^# n! a8 Y( p' H5 K- R2 @ security-level 100
ip address 192.168.0.1 255.255.255.0
!
- C% _2 G/ \5 tinterface Ethernet0/1
) J$ g% g7 A' \2 C# x8 f nameif outside
6 b& H8 O' G0 j9 a  Z security-level 0
ip address 222.178.X.X 255.255.255.252
!
3 [& j+ E# E! D  s6 L' a! M' s, _' ^& iinterface Ethernet0/2
shutdown
/ S" u0 K0 k$ [7 E  P no nameif
+ n  x% R1 L+ M8 S no security-level
no ip address
!
, w$ ~8 X* ]: Ginterface Management0/0
nameif management
! v7 }. ]* n9 M( ~ security-level 100
" K, K+ ]1 r( f( x9 W! y1 z& |+ a ip address 192.168.1.1 255.255.255.0
' C6 A' S. `( t; f5 N7 W2 r management-only
, v+ Y- b- u, F4 l!
ftp mode passive
* B) W1 ^) l) d" Y* Asame-security-traffic permit intra-interface
: ^6 M0 B  y' A" l: qaccess-list 111 extended permit ip any any
access-list no-nat extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
0 Y* c4 y( H- v7 w. _/ ~access-list vpnclient_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
" t* z  P; Y/ ]pager lines 24
logging asdm informational
' Y, c7 Y. Q, q" Hmtu inside 1500
mtu outside 1500
mtu management 1500
ip local pool vpnpool 192.168.10.100-192.168.10.199 mask 255.255.255.0
asdm image disk0:/asdm-508.bin
+ V4 w6 N2 d' J7 c! H9 g! sno asdm history enable
; N; @* ~) ~; D7 `arp timeout 14400
; }* U. s9 ~9 {7 H5 H( Rglobal (outside) 1 interface
nat (inside) 0 access-list no-nat
& A1 [7 L& i' s6 n% n9 Snat (inside) 1 0.0.0.0 0.0.0.0
& Q4 X0 y5 R# W9 M2 J# O3 pstatic (inside,outside) tcp interface 5900 192.168.0.210 5900 netmask 255.255.255.255
static (inside,outside) tcp interface 1433 192.168.0.143 1433 netmask 255.255.255.255
8 s4 ^4 o; q& x" ]) }static (inside,outside) tcp interface 1434 192.168.0.143 1434 netmask 255.255.255.255
( g# b3 N3 }8 t2 R1 Qstatic (inside,outside) tcp interface 2425 192.168.0.143 2425 netmask 255.255.255.255
) n4 w# u; M  y/ Pstatic (inside,outside) tcp interface 2426 192.168.0.143 2426 netmask 255.255.255.255
static (inside,outside) tcp interface 2427 192.168.0.143 2427 netmask 255.255.255.255
static (inside,outside) tcp interface 2428 192.168.0.143 2428 netmask 255.255.255.255
static (inside,outside) tcp interface 2429 192.168.0.143 2429 netmask 255.255.255.255
static (inside,outside) tcp interface 5800 192.168.0.210 5800 netmask 255.255.255.255
4 n: E: n: n( N" `2 Zaccess-group 111 in interface outside
. V  D6 Q: i* D8 kroute outside 0.0.0.0 0.0.0.0 222.178.X.X 1
9 l6 t- p8 @- A. x6 k. btimeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
  t0 |& p6 ?2 Dgroup-policy DfltGrpPolicy attributes
banner none
wins-server none
) |! K2 ?& s' l2 p( B! K) O2 z9 x dns-server none
/ n7 U: U2 Y2 x) y3 V  d dhcp-network-scope none
vpn-access-hours none
vpn-simultaneous-logins 3
vpn-idle-timeout 30
/ C$ L# [) S7 H5 q- _ vpn-session-timeout none
vpn-filter none
vpn-tunnel-protocol IPSec webvpn
5 o  t% b! ^: y6 }" F/ b password-storage disable
2 X+ D* W# @6 E0 } ip-comp disable
re-xauth disable
: v7 Q6 M% U* T/ e/ s/ Z4 f group-lock none
pfs disable
ipsec-udp disable
1 J6 r& K6 ]" y3 a. A8 o/ \ ipsec-udp-port 10000
split-tunnel-policy tunnelall
# Z6 u' F- a; t4 S' E split-tunnel-network-list none
default-domain none
; v6 m# e  C4 X! y7 c& P# N- J split-dns none
& d- [  s3 S/ l0 M. y. m secure-unit-authentication disable
user-authentication disable
user-authentication-idle-timeout 30
  P  V! T* E0 I) w/ D ip-phone-bypass disable
: o) I4 b2 f* o' U& Q1 C  Q: z" |; X leap-bypass disable
nem disable
backup-servers keep-client-config
client-firewall none
client-access-rule none
( `; X& B" w9 b8 w0 N webvpn
5 v1 W( {0 P+ G9 |8 |6 k  functions url-entry
  port-forward-name value Application Access
group-policy vpnclient internal
group-policy vpnclient attributes
5 \& t' r$ ?+ x dns-server value 61.128.128.67
! ?$ T( N0 v5 f# d" `! [  m. f9 K vpn-tunnel-protocol IPSec
% t* Q+ @0 K1 m; S+ z3 _ split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnclient_splitTunnelAcl
webvpn
) d- D6 T" A& Q5 eusername admin11 password 2oVCF4GkSvYRaajj encrypted
username admin11 attributes
1 v( _& K, |1 K" v vpn-group-policy vpnclient
webvpn
username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
+ t  y( p1 d# N, ^2 n) I3 f; maaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
; C* O& I( Y# Q( |) [: H' x$ ~/ haaa authentication telnet console LOCAL
6 W+ s  Q8 n2 }# y; whttp server enable
http 192.168.0.0 255.255.255.0 inside
% x, k5 a3 Z1 ^* F* }http 0.0.0.0 0.0.0.0 inside
, l) k  Q+ v7 K9 H% T# J$ p" S" Uhttp 0.0.0.0 0.0.0.0 outside
& @3 D% o" b- J( }; T4 a# bhttp 192.168.1.0 255.255.255.0 management
7 w2 j) [& B. Q" Q3 U! gno snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set vpnset esp-des esp-md5-hmac
( D6 ?: r* A9 d: fcrypto ipsec security-association lifetime seconds 28800
9 P' g$ v7 D* l+ M9 R& u6 rcrypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map outside-dyn-map 10 set transform-set vpnset
. D; c! d9 l1 x, k( icrypto dynamic-map outside-dyn-map 10 set security-association lifetime seconds 288000
. H# g& j( ?9 i! q4 y2 lcrypto dynamic-map outside-dyn-map 10 set security-association lifetime kilobytes 4608000
) x6 R7 }  n# @6 e/ dcrypto dynamic-map outside-dyn-map 10 set reverse-route
! S  p. r% S+ N+ J5 ?, O+ hcrypto map outside_map 65535 set security-association lifetime seconds 28800
crypto map outside_map 65535 set security-association lifetime kilobytes 4608000
crypto map ESP-DES-MD5 20 set security-association lifetime seconds 28800
5 m; V" y5 V, X0 n& g5 mcrypto map ESP-DES-MD5 20 set security-association lifetime kilobytes 4608000
, u5 Y8 x: B# {8 _, Z1 B( d/ U% acrypto map mymap 10 set security-association lifetime seconds 28800
crypto map mymap 10 set security-association lifetime kilobytes 4608000
crypto map outside-map 10 ipsec-isakmp dynamic outside-dyn-map
crypto map outside-map interface outside
isakmp identity address
1 x0 Y- C2 G/ Z' D0 Y# @isakmp enable outside
! [# D* \* w/ ]5 ~7 D% P( n9 P+ y9 Pisakmp policy 1 authentication pre-share
isakmp policy 1 encryption des
7 P9 U1 O; J, j8 _4 nisakmp policy 1 hash md5
+ a- q& @5 M" fisakmp policy 1 group 2
1 u4 D: \2 R' V. U; Zisakmp policy 1 lifetime 86400
. A8 }3 ]& ]+ jisakmp nat-traversal  20
tunnel-group DefaultL2LGroup ipsec-attributes
& R# o3 `; o+ Z6 _' @ pre-shared-key *
tunnel-group vpnclient type ipsec-ra
tunnel-group vpnclient general-attributes
address-pool vpnpool
/ G0 K  N0 U' y default-group-policy vpnclient
- A1 O& L; s# u) N7 X9 Qtunnel-group vpnclient ipsec-attributes
" Q" J% |8 B% Q$ c7 d# B* E pre-shared-key *
tunnel-group-map default-group cisco
) O. ~/ M6 c+ X2 V% X. atelnet 192.168.0.0 255.255.255.0 inside
1 p" a$ e, d2 J" K+ Itelnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
4 t8 C% V' |% k1 E, H9 xssh 0.0.0.0 0.0.0.0 outside
" G; `8 M2 H* kssh timeout 60
/ c: H# b( K5 I7 [console timeout 0
# G1 p$ |# `, Y0 adhcpd address 192.168.0.2-192.168.0.254 inside
5 ?; F3 y% E* x- W- o/ Udhcpd address 192.168.1.2-192.168.1.254 management
! r" R8 t) U; o2 s4 ]dhcpd dns 61.128.128.68 61.128.192.68
dhcpd lease 3600
& Q5 O8 h# K8 Bdhcpd ping_timeout 50
, Q4 B. q) @2 v; \3 @7 t7 x3 Kdhcpd enable inside
9 V; Q0 c0 ~/ b1 v! B/ z7 @' mdhcpd enable management
!
class-map inspection_default
match default-inspection-traffic
!
- O1 I8 f1 c* Y9 M; d% m- W!
policy-map global_policy
. j# ?: W. N+ O/ D; ]" g class inspection_default
2 m, n3 l* w' Q7 P' |: j3 i/ j  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
' Z8 }: d- R$ P0 m. V  inspect rsh
0 i( t. f& u# B  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
* z2 w4 L' H: x% O/ D5 h3 s!
service-policy global_policy global
, Y  U9 Z% h0 O" {* Hclient-update enable
Cryptochecksum:aef2b202fd891d6f72ef70a222d07ad7
: end
3 _  j6 I1 J7 h. M$ i
* s5 c+ V# X, z请问下楼上的师傅QQ号是多少. 能否找你私下聊一下, 主要就是这个VPN的问题个.

设置拨号连接参数，点击“属性”进入TCP/IP协议设置，勾选“在远程网络上使用默认网关”前面的勾。