急,客户端是adsl上网,怎么才能登陆进pix515E的vpn

**Cmyrtle [Lv4 初露锋芒]** · 发表于 2013-7-24 06:41:07

需要在防火墙上做如何配置
防火墙是 pix515E

客户端是pppoe 上网

**hawk793 [Lv4 初露锋芒]** · 发表于 2013-7-24 09:35:15

看我的帖子，
用cisco的客户端软件

**eric980643 [Lv4 初露锋芒]** · 发表于 2013-7-24 18:02:55

我用的客户端软件是 cisco vpn client 4.0.1

**sleet [Lv4 初露锋芒]** · 发表于 2013-7-24 19:18:58

提示,the necessary vpn sub-system is not valiable
you can't connect to the remote vpn server

**rinker [Lv4 初露锋芒]** · 发表于 2013-7-24 21:46:47

pixfirewall#show run
: Saved
:
PIX Version 6.3(3)
interface ethernet0 100full
interface ethernet1 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names

!--- Do not use Network Address Translation (NAT) for inside-to-pool
!--- traffic. This should not go through NAT.

access-list 101 permit ip 10.89.129.128 255.255.255.240 10.89.129.192 255.255.255.240

!--- Permits Internet Control Message Protocol (ICMP)
!--- Transmission Control Protocol (TCP) and User Datagram Protocol (UDP)
!--- traffic from any host on the Internet (non-VPN) to the web server.

access-list 120 permit icmp any host 10.89.129.131
access-list 120 permit tcp any host 10.89.129.131
access-list 120 permit udp any host 10.89.129.131

pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 192.168.1.1 255.255.255.0
ip address inside 10.89.129.194 255.255.255.240
ip audit info action alarm
ip audit attack action alarm

!--- Specifies the inside IP address range to be assigned
!--- to the VPN Clients.

ip local pool VPNpool 10.89.129.200-10.89.129.204
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
pdm history enable
arp timeout 14400

!--- Defines a pool of global addresses to be used by NAT.

global (outside) 1 192.168.1.6-192.168.1.10

nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0 0 0

!--- Specifies which outside IP address to apply to the web server.

static (inside,outside) 192.168.1.11 10.89.129.131 netmask 255.255.255.255 0 0

!--- Apply ACL 120 to the outside interface in the inbound direction.

access-group 120 in interface outside

!--- Defines a default route for the PIX.

route outside 0.0.0.0 0.0.0.0 192.168.1.3 1

!--- Defines a route for traffic within the PIX's
!--- subnet to reach other inside hosts.

route inside 10.89.129.128 255.255.255.128 10.89.129.193 1

timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local

!--- Authentication, authorization, and accounting (AAA)
!--- statements for authentication. Method AuthInbound uses TACACS+.

aaa-server AuthInbound protocol tacacs+

!--- Specify the TACACS+ server and key.

aaa-server AuthInbound (inside) host 10.89.129.134 <deleted> timeout 10

!--- Authenticate HTTP, FTP, and Telnet traffic to the web server.

aaa authentication include http outside
10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound

aaa authentication include ftp outside
10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound

aaa authentication include telnet outside
10.89.129.131 255.255.255.255 0.0.0.0 0.0.0.0 AuthInbound

no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable

!--- Trust IPSec traffic and avoid going through ACLs/NAT.

sysopt connection permit-ipsec

!--- IPSec and dynamic map configuration.

crypto ipsec transform-set myset esp-des esp-md5-hmac
crypto dynamic-map dynmap 10 set transform-set myset
crypto map mymap 10 ipsec-isakmp dynamic dynmap

!--- Assign IP address for VPN 1.1 Clients.

crypto map mymap client configuration address initiate
crypto map mymap client configuration address respond

!--- Use the AAA server for authentication (AuthInbound).

crypto map mymap client authentication AuthInbound

!--- Apply the IPSec/AAA/ISAKMP configuration to the outside interface.

crypto map mymap interface outside
isakmp enable outside

!--- Pre-shared key for VPN 1.1 Clients.

isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
isakmp identity address

!--- Assign address from "VPNpool" pool for VPN 1.1 Clients.

isakmp client configuration address-pool local VPNpool outside

!--- ISAKMP configuration for VPN Client 3.x/4.x.

isakmp policy 10 authentication pre-share
isakmp policy 10 encryption des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400

!--- ISAKMP configuration for VPN Client 1.x.

isakmp policy 20 authentication pre-share
isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 group 1
isakmp policy 20 lifetime 86400

!--- Assign addresses from "VPNpool" for VPN Client 3.x/4.x.

vpngroup vpn3000 address-pool VPNpool

vpngroup vpn3000 idle-time 1800

!--- Group password for VPN Client 3.x/4.x (not shown in configuration).

vpngroup vpn3000 password ********
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:ba54c063d94989cbd79076955dbfeefc
: end
pixfirewall#

**mosheh [Lv5 不断成长]** · 发表于 2013-7-24 23:12:03

我和你配的差不多,我用公网ip可以连上vpn
adsl的pppoe访问不了

**ayayay [Lv8 技术精悍]** · 发表于 2013-11-6 22:00:54

不错不错，楼主您辛苦了。。。

**sadasz [Lv8 技术精悍]** · 发表于 2013-11-7 20:26:09

路过，支持一下啦

**azcat [Lv8 技术精悍]** · 发表于 2013-11-9 10:22:14

支持一下:lol

**楚行云 [Lv8 技术精悍]** · 发表于 2013-11-9 10:55:03

主题标签Tag

more　+今日重磅推荐Recommend No.1

more　+社区更新Forums

more　+随机图赏Gallery

[安全] 急,客户端是adsl上网,怎么才能登陆进pix515E的vpn

相关帖子

客服中心

投诉建议