pix做vpn，vpn client拨入后不能访问内网

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        帮顶.  同样的问题                                                                                                                inside访问vpn地址nonat掉

做了no nat的 还是不行

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        做了no nat的 还是不行                                                                                                                配置贴上来看看

ASA Version 7.0(8)
7 b, S4 n: U4 d" ]( e& `( L!
hostname ciscoasa
domain-name default.domain.invalid
enable password 8Ry2YjIyt7RRXU24 encrypted
5 B# o9 K, M/ e5 }# h2 m' e- Gpasswd 2KFQnbNIdI.2KYOU encrypted
names
dns-guard
!
* H4 v) V/ U' v. D: n0 q, i5 |interface Ethernet0/0
) ?/ t% |0 o' y% B- M  o- V% ^ nameif inside
! w8 n/ o1 W& g2 Z' e. B: D security-level 100
ip address 192.168.0.1 255.255.255.0
6 Y/ z$ B  [" D0 x% L$ g!
interface Ethernet0/1
nameif outside
security-level 0
ip address 222.178.X.X 255.255.255.252
+ d( o# u1 m4 F( ~: [) @9 C!
4 v# e, Y0 m9 v  G! N' F9 _interface Ethernet0/2
% o, g5 ?, ]7 d" B3 T shutdown
5 ~9 o: [; h' g& Y& j5 [" f no nameif
* p) s' [. c2 ^& G no security-level
) r8 D# x' q- d  P5 u  }! f: U no ip address
5 t' q# H2 G" V; E- _!
6 s& W3 J4 Y! U! Rinterface Management0/0
5 E/ _3 B; s# k+ D2 X/ |- o nameif management
security-level 100
9 j6 z) }0 \) W# H3 I ip address 192.168.1.1 255.255.255.0
management-only
!
8 _: b- g8 ^- }. b$ Zftp mode passive
( q3 t% p% Z4 v0 [# Nsame-security-traffic permit intra-interface
' @0 l6 B' a  a0 caccess-list 111 extended permit ip any any
access-list no-nat extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
8 V" G, r$ k+ v4 M* I0 oaccess-list vpnclient_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
9 v1 q3 r5 Y3 ?; [* Z4 b1 Wpager lines 24
  b' D% H, i" i9 W! Xlogging asdm informational
# P  s2 M' j# }mtu inside 1500
mtu outside 1500
mtu management 1500
ip local pool vpnpool 192.168.10.100-192.168.10.199 mask 255.255.255.0
asdm image disk0:/asdm-508.bin
no asdm history enable
5 v  k9 h1 o" E6 [arp timeout 14400
global (outside) 1 interface
6 x! ~! w# d0 J  M! h- Z" v1 u/ vnat (inside) 0 access-list no-nat
8 Z9 h3 |- ^9 X4 snat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 5900 192.168.0.210 5900 netmask 255.255.255.255
) A7 ?2 O3 q* `1 n3 C  @. U- Tstatic (inside,outside) tcp interface 1433 192.168.0.143 1433 netmask 255.255.255.255
9 w. B) _2 ~4 _% b9 W" |1 Ostatic (inside,outside) tcp interface 1434 192.168.0.143 1434 netmask 255.255.255.255
9 G0 J& _  k* _( }) Estatic (inside,outside) tcp interface 2425 192.168.0.143 2425 netmask 255.255.255.255
static (inside,outside) tcp interface 2426 192.168.0.143 2426 netmask 255.255.255.255
static (inside,outside) tcp interface 2427 192.168.0.143 2427 netmask 255.255.255.255
: X! d4 Z, C/ y1 M' C- F4 Lstatic (inside,outside) tcp interface 2428 192.168.0.143 2428 netmask 255.255.255.255
/ I5 N4 a, ~  z- n4 h) D7 Nstatic (inside,outside) tcp interface 2429 192.168.0.143 2429 netmask 255.255.255.255
0 E/ R( m  r. g! ]  |3 y2 Mstatic (inside,outside) tcp interface 5800 192.168.0.210 5800 netmask 255.255.255.255
access-group 111 in interface outside
; D7 E3 B8 j( o3 W9 vroute outside 0.0.0.0 0.0.0.0 222.178.X.X 1
# m3 U3 h0 }* Y$ g7 etimeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
0 F6 `( a2 q0 ?; S* N( j3 q! D2 Utimeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
4 K& X8 Z5 b+ `9 y3 A8 _timeout uauth 0:05:00 absolute
group-policy DfltGrpPolicy attributes
# I$ O+ B5 Q- ^5 R0 ~% s banner none
8 m) o# A6 N' }, a1 Q0 D* o( | wins-server none
: W4 u9 j: K5 x. ^7 S3 z dns-server none
# Y7 d: k/ Y7 p; m& }% C dhcp-network-scope none
vpn-access-hours none
vpn-simultaneous-logins 3
vpn-idle-timeout 30
0 V( p7 P6 w, [& R; e vpn-session-timeout none
vpn-filter none
vpn-tunnel-protocol IPSec webvpn
) _  E: O; w; D password-storage disable
6 K: F$ |' k7 J( }" z# c ip-comp disable
re-xauth disable
, o$ g( N* e* z) b( ? group-lock none
5 T/ c( d) f6 G9 [ pfs disable
) Y* G( t  L. P$ w7 r! j ipsec-udp disable
ipsec-udp-port 10000
split-tunnel-policy tunnelall
9 f8 u0 `& v9 C2 Y5 y split-tunnel-network-list none
$ d8 Y* @! ~: C, |% h1 q; a default-domain none
split-dns none
3 p1 X5 Z- ~6 p/ h secure-unit-authentication disable
. ^, Y! X4 v1 ^6 c. K2 e user-authentication disable
/ Y4 ~, |  `; `  H! r7 ]% h user-authentication-idle-timeout 30
ip-phone-bypass disable
leap-bypass disable
1 ]8 V0 ?9 v) z) I5 o* b. U nem disable
backup-servers keep-client-config
client-firewall none
& O! d) |' I5 x7 a client-access-rule none
webvpn
  functions url-entry
  port-forward-name value Application Access
group-policy vpnclient internal
! q0 u8 I9 b$ H6 rgroup-policy vpnclient attributes
. e  M2 A( Y: S+ s, H dns-server value 61.128.128.67
vpn-tunnel-protocol IPSec
" r9 J7 s8 e0 G8 z split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnclient_splitTunnelAcl
webvpn
/ ~5 b* j0 i- t) w' i0 ^1 Q: u0 Nusername admin11 password 2oVCF4GkSvYRaajj encrypted
7 i( s1 ]; @9 M" Husername admin11 attributes
vpn-group-policy vpnclient
webvpn
" K9 B5 V6 ]4 musername cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
' G+ X7 K. D$ A( j7 Iaaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
3 C. C% o) v  _1 }2 T$ s4 Xaaa authentication http console LOCAL
. l+ [! E1 n9 ?5 H, zaaa authentication serial console LOCAL
, H7 j  w) k& N, K- ]& @aaa authentication telnet console LOCAL
http server enable
http 192.168.0.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 inside
http 0.0.0.0 0.0.0.0 outside
http 192.168.1.0 255.255.255.0 management
no snmp-server location
$ ?8 l5 n( ]; |0 |no snmp-server contact
0 J' ?7 Q# t. P( \snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set vpnset esp-des esp-md5-hmac
, ^8 u: R( s4 O  k$ Mcrypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
" f* A! \2 ], w% Ncrypto dynamic-map outside-dyn-map 10 set transform-set vpnset
& f4 s* c/ B) N$ Q) J  a, Tcrypto dynamic-map outside-dyn-map 10 set security-association lifetime seconds 288000
crypto dynamic-map outside-dyn-map 10 set security-association lifetime kilobytes 4608000
crypto dynamic-map outside-dyn-map 10 set reverse-route
# z- e. c  L  d6 R. mcrypto map outside_map 65535 set security-association lifetime seconds 28800
crypto map outside_map 65535 set security-association lifetime kilobytes 4608000
crypto map ESP-DES-MD5 20 set security-association lifetime seconds 28800
crypto map ESP-DES-MD5 20 set security-association lifetime kilobytes 4608000
crypto map mymap 10 set security-association lifetime seconds 28800
crypto map mymap 10 set security-association lifetime kilobytes 4608000
! J/ W8 G# \, F1 Mcrypto map outside-map 10 ipsec-isakmp dynamic outside-dyn-map
crypto map outside-map interface outside
isakmp identity address
isakmp enable outside
isakmp policy 1 authentication pre-share
1 `, A8 H# t6 ?+ ?4 ^3 ~% Yisakmp policy 1 encryption des
isakmp policy 1 hash md5
isakmp policy 1 group 2
4 f; v& _# Z$ N) aisakmp policy 1 lifetime 86400
  B1 a* J. I# Y- kisakmp nat-traversal  20
( f& u/ x9 K& N' b, K3 htunnel-group DefaultL2LGroup ipsec-attributes
+ z" s, l" ^6 s' ~ pre-shared-key *
0 h4 h+ w$ E) r6 Q  L& Ttunnel-group vpnclient type ipsec-ra
tunnel-group vpnclient general-attributes
2 p7 @3 h, u9 ^' j, x. ]! i address-pool vpnpool
; U; E! v( L( q8 B default-group-policy vpnclient
tunnel-group vpnclient ipsec-attributes
0 k6 A- Y9 R% B0 [1 Q pre-shared-key *
# t7 U6 C( g) ?( r* y7 htunnel-group-map default-group cisco
( H- @- R7 v( i& g$ ]! b' W* _telnet 192.168.0.0 255.255.255.0 inside
, t, r9 V: E/ w7 i$ \2 s  [telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
! R( Y  b& F9 e8 R" P7 c! l$ mssh 0.0.0.0 0.0.0.0 outside
ssh timeout 60
console timeout 0
6 h( L8 X& p/ [* |, Z3 U1 V' r0 mdhcpd address 192.168.0.2-192.168.0.254 inside
dhcpd address 192.168.1.2-192.168.1.254 management
$ `) H8 L# d' ]. o! u# [8 Bdhcpd dns 61.128.128.68 61.128.192.68
- \8 z; f6 X5 T$ s0 ldhcpd lease 3600
dhcpd ping_timeout 50
( p. J5 ^% t4 V) Fdhcpd enable inside
9 b* E% @9 Z7 a5 B" W: L! edhcpd enable management
5 z/ F: n3 D. c7 |- v1 ?!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
& M2 k. `3 O; q+ i5 C  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
3 s: z- u* }6 k  B' l  inspect h323 ras
9 X+ ?, n. `4 A& a+ W8 R  inspect rsh
; q/ b7 T; Q. K. |- h" `3 Q  B  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
9 Y. q" `( v' z- I+ Z  inspect sunrpc
  inspect xdmcp
- u) {. g* q! A4 z* u  inspect sip
  inspect netbios
  inspect tftp
8 B/ G* F1 C8 K! r( S! g!
service-policy global_policy global
% R" A, {3 s; U- |, Gclient-update enable
Cryptochecksum:aef2b202fd891d6f72ef70a222d07ad7
: end
  g; E0 S7 {" n) b  v- h
请问下楼上的师傅QQ号是多少. 能否找你私下聊一下, 主要就是这个VPN的问题个.

设置拨号连接参数，点击“属性”进入TCP/IP协议设置，勾选“在远程网络上使用默认网关”前面的勾。