pix做vpn，vpn client拨入后不能访问内网

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        帮顶.  同样的问题                                                                                                                inside访问vpn地址nonat掉

做了no nat的 还是不行

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        做了no nat的 还是不行                                                                                                                配置贴上来看看

ASA Version 7.0(8)
2 |8 B5 F7 W( X, u1 E4 A!
hostname ciscoasa
domain-name default.domain.invalid
7 J( d- A( F3 c% z7 T; U( {2 Zenable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
dns-guard
!
5 Q; [- O' o" I- I3 O1 u- z. }interface Ethernet0/0
5 H1 B  \- h: o2 l, _$ v) w nameif inside
4 t' f6 G: k# M3 u0 U security-level 100
ip address 192.168.0.1 255.255.255.0
!
7 o* a; X+ U% }interface Ethernet0/1
nameif outside
security-level 0
ip address 222.178.X.X 255.255.255.252
  ?- v3 h; `: i( J% o- E8 V  V!
interface Ethernet0/2
6 b& Q4 Q. D* ?& D0 p shutdown
no nameif
no security-level
- W: S' F2 Q& q/ Y- }4 r no ip address
!
7 ^; Y4 M! ]" u" N( sinterface Management0/0
7 J# k0 R# d  |0 ?- A nameif management
" ]2 m; o1 b. j# _% I! u security-level 100
7 {7 ~  H2 ~/ k& p# S5 n$ [" t ip address 192.168.1.1 255.255.255.0
! u1 K# t. [- j  S& \: N2 r* t  j9 b6 d: \ management-only
!
ftp mode passive
3 J3 H8 o& s' n9 n, m0 d& asame-security-traffic permit intra-interface
access-list 111 extended permit ip any any
" j7 z3 p( k/ Y" haccess-list no-nat extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
) J, k( s- X$ i1 Gaccess-list vpnclient_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
pager lines 24
/ ]" s. k' c9 k$ clogging asdm informational
mtu inside 1500
mtu outside 1500
mtu management 1500
% _# a7 K- ~1 S' e& I+ fip local pool vpnpool 192.168.10.100-192.168.10.199 mask 255.255.255.0
  @. Q* O* |3 P- v5 h, easdm image disk0:/asdm-508.bin
no asdm history enable
arp timeout 14400
6 f" `2 q; c2 t2 oglobal (outside) 1 interface
1 G- o$ B% m* [) m' Nnat (inside) 0 access-list no-nat
+ a6 Z# O8 ]# c* J9 Pnat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 5900 192.168.0.210 5900 netmask 255.255.255.255
static (inside,outside) tcp interface 1433 192.168.0.143 1433 netmask 255.255.255.255
static (inside,outside) tcp interface 1434 192.168.0.143 1434 netmask 255.255.255.255
7 f! q( t$ [% }+ U% a2 @/ `static (inside,outside) tcp interface 2425 192.168.0.143 2425 netmask 255.255.255.255
static (inside,outside) tcp interface 2426 192.168.0.143 2426 netmask 255.255.255.255
7 @' w: {* {: C/ t# n* Dstatic (inside,outside) tcp interface 2427 192.168.0.143 2427 netmask 255.255.255.255
8 K2 p5 q* }  [. F% [+ Bstatic (inside,outside) tcp interface 2428 192.168.0.143 2428 netmask 255.255.255.255
+ j1 ], d9 K4 S2 ~  u2 l. n. jstatic (inside,outside) tcp interface 2429 192.168.0.143 2429 netmask 255.255.255.255
static (inside,outside) tcp interface 5800 192.168.0.210 5800 netmask 255.255.255.255
access-group 111 in interface outside
" p1 ?5 w9 A/ Y8 r/ h+ `( J+ froute outside 0.0.0.0 0.0.0.0 222.178.X.X 1
' K, X% u2 I" k4 H6 f1 Htimeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
; }. n1 C6 a  o! u$ A& G& s+ Q2 B4 rtimeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
1 s/ Z" P! t" w  }. k4 vgroup-policy DfltGrpPolicy attributes
banner none
( l; B, r+ F: o' Q wins-server none
dns-server none
6 j4 F! ]1 y. x dhcp-network-scope none
vpn-access-hours none
vpn-simultaneous-logins 3
, j9 Z4 X4 i/ [# F vpn-idle-timeout 30
vpn-session-timeout none
vpn-filter none
vpn-tunnel-protocol IPSec webvpn
password-storage disable
ip-comp disable
re-xauth disable
group-lock none
pfs disable
1 }# P* @# H- h, K ipsec-udp disable
ipsec-udp-port 10000
/ X4 g8 y; F$ K1 t. K3 S2 L/ z split-tunnel-policy tunnelall
- p4 D; }) U& \; p1 q' K  a: ~2 A split-tunnel-network-list none
9 U5 m' J. h: h default-domain none
split-dns none
secure-unit-authentication disable
user-authentication disable
& G( `: y$ {  Y" e: e- ]' ?  I. v user-authentication-idle-timeout 30
. w( }* p8 P* P6 l, K0 H3 l ip-phone-bypass disable
leap-bypass disable
4 Y5 q4 ~9 H& J$ n1 k5 V3 B nem disable
backup-servers keep-client-config
; Z" F4 ^* l) h8 t0 w9 y client-firewall none
client-access-rule none
webvpn
8 z* y- Q, i7 _  functions url-entry
+ t( |) q( D2 Q! x% z  port-forward-name value Application Access
group-policy vpnclient internal
group-policy vpnclient attributes
7 G6 {" L# a& n1 e dns-server value 61.128.128.67
/ G% y; I) L: n6 Y2 s vpn-tunnel-protocol IPSec
" V8 O* H% t: S5 r# Z2 E5 u split-tunnel-policy tunnelspecified
2 t% ]' f. a! o9 ^; _ split-tunnel-network-list value vpnclient_splitTunnelAcl
9 X+ E. G3 G) P+ |1 S6 ~ webvpn
username admin11 password 2oVCF4GkSvYRaajj encrypted
username admin11 attributes
8 ?. B  T5 o# m' x4 x vpn-group-policy vpnclient
webvpn
username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
; Q1 w4 _  D' B! M: ~aaa authentication serial console LOCAL
% W( ?, C+ V9 r. {& Oaaa authentication telnet console LOCAL
http server enable
" \0 G1 d  M! Mhttp 192.168.0.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 inside
http 0.0.0.0 0.0.0.0 outside
http 192.168.1.0 255.255.255.0 management
/ L4 }& V" ~6 V) w! K! Tno snmp-server location
no snmp-server contact
, s4 T3 z, k+ d( t- csnmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set vpnset esp-des esp-md5-hmac
: K: ^2 u( S/ j! M2 t* x5 X9 wcrypto ipsec security-association lifetime seconds 28800
& l4 }+ n  {0 Y& W4 h; Bcrypto ipsec security-association lifetime kilobytes 4608000
6 G( N; n; K4 \0 K7 kcrypto dynamic-map outside-dyn-map 10 set transform-set vpnset
crypto dynamic-map outside-dyn-map 10 set security-association lifetime seconds 288000
: k3 B8 ^  K* l* ocrypto dynamic-map outside-dyn-map 10 set security-association lifetime kilobytes 4608000
# S0 L. y; _+ a0 q+ ncrypto dynamic-map outside-dyn-map 10 set reverse-route
crypto map outside_map 65535 set security-association lifetime seconds 28800
& O; g% ?' H  L  p4 _crypto map outside_map 65535 set security-association lifetime kilobytes 4608000
crypto map ESP-DES-MD5 20 set security-association lifetime seconds 28800
7 T. v9 d, x, T. W+ `, r9 Jcrypto map ESP-DES-MD5 20 set security-association lifetime kilobytes 4608000
( ~9 ^0 i& S. v% _crypto map mymap 10 set security-association lifetime seconds 28800
& ^! k6 k1 B% {crypto map mymap 10 set security-association lifetime kilobytes 4608000
3 ?9 k* z0 q- Q2 kcrypto map outside-map 10 ipsec-isakmp dynamic outside-dyn-map
crypto map outside-map interface outside
" U+ q* M, G  V/ q' H0 j$ Bisakmp identity address
isakmp enable outside
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption des
isakmp policy 1 hash md5
9 L2 b9 v6 H' {: Oisakmp policy 1 group 2
1 E$ V! k9 E  ?4 d0 W! Tisakmp policy 1 lifetime 86400
isakmp nat-traversal  20
* E, Z$ g/ x' e& `tunnel-group DefaultL2LGroup ipsec-attributes
. L/ [$ l% D: X: J3 `* l' v pre-shared-key *
tunnel-group vpnclient type ipsec-ra
/ ~- p% _! M6 |9 f. u. i+ etunnel-group vpnclient general-attributes
' f2 ?* P. l8 S- K+ `( | address-pool vpnpool
0 w3 {0 U8 _7 R/ W/ ^9 I& A; K* u default-group-policy vpnclient
tunnel-group vpnclient ipsec-attributes
pre-shared-key *
/ o9 C% t8 ?' i" C( w1 Y# s8 y8 Vtunnel-group-map default-group cisco
* R0 b' A# e+ \6 ~) etelnet 192.168.0.0 255.255.255.0 inside
) i: P$ i( l$ e+ v; B1 Ztelnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
$ l- I6 e, \' B& p, o9 _ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 60
console timeout 0
dhcpd address 192.168.0.2-192.168.0.254 inside
0 Y2 D- ~0 i4 ]1 Odhcpd address 192.168.1.2-192.168.1.254 management
0 X# I4 _1 Q0 Q% @3 fdhcpd dns 61.128.128.68 61.128.192.68
dhcpd lease 3600
8 [5 v3 P" r7 \! a0 ~) \dhcpd ping_timeout 50
" N( ]6 ]- u0 }+ Cdhcpd enable inside
2 a! j1 Q& x9 adhcpd enable management
* Q0 X" X, W. \5 Q!
4 l; {( y9 T, H8 x3 B2 zclass-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
6 a- y, L1 c7 Z( l0 V5 B class inspection_default
  inspect dns maximum-length 512
. J: y/ ?3 ^; @$ ?+ I5 T  inspect ftp
4 V+ ]3 h. i/ Q& Z  inspect h323 h225
1 X: A% d! ^: s0 ^  inspect h323 ras
; s5 G7 Z' l5 V' Y/ A; L  inspect rsh
  inspect rtsp
) j5 U2 z( m1 L: f# Z1 P$ b  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
2 ~9 d' T" T0 g. _" ?3 Y$ {+ kservice-policy global_policy global
* H8 A: H* A4 O/ E  K# d! G8 ^client-update enable
  V4 I/ G. j8 b  K$ A2 FCryptochecksum:aef2b202fd891d6f72ef70a222d07ad7
: z* V0 _8 `* ~: end

: V* L9 b, y- `9 w9 M) E! \请问下楼上的师傅QQ号是多少. 能否找你私下聊一下, 主要就是这个VPN的问题个.

设置拨号连接参数，点击“属性”进入TCP/IP协议设置，勾选“在远程网络上使用默认网关”前面的勾。