pix做vpn，vpn client拨入后不能访问内网

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        帮顶.  同样的问题                                                                                                                inside访问vpn地址nonat掉

做了no nat的 还是不行

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        做了no nat的 还是不行                                                                                                                配置贴上来看看

ASA Version 7.0(8)
!
' x& q7 @  s4 C4 Y# Thostname ciscoasa
$ O5 ?% \, X5 D: ldomain-name default.domain.invalid
enable password 8Ry2YjIyt7RRXU24 encrypted
; E2 F8 c9 j6 Kpasswd 2KFQnbNIdI.2KYOU encrypted
names
6 S  D4 T. _8 r7 |/ wdns-guard
. l" }* S# u0 U!
9 X, T/ \/ z2 A; M$ Iinterface Ethernet0/0
4 `! _+ X6 `" O( O( I! ^1 U nameif inside
% a! `/ F5 K0 d$ } security-level 100
ip address 192.168.0.1 255.255.255.0
0 y5 K" ?, F$ U!
interface Ethernet0/1
# U% {' A- o! O nameif outside
security-level 0
! x  C* Q8 D# h; O+ q+ t" [) m ip address 222.178.X.X 255.255.255.252
!
- O0 ^0 U8 B: z2 I4 p0 M/ ~interface Ethernet0/2
3 {3 @2 t0 U8 H6 q$ W shutdown
no nameif
no security-level
$ y2 E; G! t% T% w no ip address
3 [. }/ y- U- O; M. ?/ H!
  k$ |) _% j! b; G0 H; ^interface Management0/0
nameif management
& _* p; V1 x/ `" B! Q9 o# a) N security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
6 v* H5 E8 A/ ~1 T5 u0 u5 Kftp mode passive
4 }  e$ Z3 c1 G; `1 ~5 L- qsame-security-traffic permit intra-interface
* t% ^. p7 z" _+ M6 i4 x% y0 Caccess-list 111 extended permit ip any any
" Q1 T: G  Q* i& `access-list no-nat extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list vpnclient_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu management 1500
ip local pool vpnpool 192.168.10.100-192.168.10.199 mask 255.255.255.0
; u+ r* n: Z4 n* {; ]; [& zasdm image disk0:/asdm-508.bin
no asdm history enable
8 s( d4 s- G1 D7 Parp timeout 14400
global (outside) 1 interface
6 A' a: o( M+ V! dnat (inside) 0 access-list no-nat
nat (inside) 1 0.0.0.0 0.0.0.0
! v6 l! t! b/ s( B/ C8 N# c5 `static (inside,outside) tcp interface 5900 192.168.0.210 5900 netmask 255.255.255.255
/ r6 B0 b/ B* Y2 w8 {static (inside,outside) tcp interface 1433 192.168.0.143 1433 netmask 255.255.255.255
static (inside,outside) tcp interface 1434 192.168.0.143 1434 netmask 255.255.255.255
( S" \0 T4 |8 l9 E2 f7 V9 D+ p- ]static (inside,outside) tcp interface 2425 192.168.0.143 2425 netmask 255.255.255.255
static (inside,outside) tcp interface 2426 192.168.0.143 2426 netmask 255.255.255.255
static (inside,outside) tcp interface 2427 192.168.0.143 2427 netmask 255.255.255.255
+ Z- K" u! m7 Gstatic (inside,outside) tcp interface 2428 192.168.0.143 2428 netmask 255.255.255.255
/ L- a9 Y1 T9 b4 r2 K( ~static (inside,outside) tcp interface 2429 192.168.0.143 2429 netmask 255.255.255.255
9 n" V  ]% Q2 y" e2 n- d8 p2 ystatic (inside,outside) tcp interface 5800 192.168.0.210 5800 netmask 255.255.255.255
  [) w- ~: ^# n4 Maccess-group 111 in interface outside
6 A6 Y% b" Y) Y  ^6 l. [route outside 0.0.0.0 0.0.0.0 222.178.X.X 1
timeout xlate 3:00:00
: h4 M  m# B  T" z* b% Ztimeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
7 n4 X; W+ a; @0 y+ Rgroup-policy DfltGrpPolicy attributes
6 X4 R8 ~- i' s  }& H: B banner none
' z3 E) r: T) G6 n- i0 }! Y wins-server none
2 _) J' s, w* b5 Y0 b2 w# m; A dns-server none
dhcp-network-scope none
3 a( m, l6 c% R0 E0 s( x vpn-access-hours none
& |$ I2 y. F' P8 Y vpn-simultaneous-logins 3
9 o2 d9 h& h$ `' Y% C vpn-idle-timeout 30
. F2 [  R- W/ N8 j vpn-session-timeout none
vpn-filter none
! q( Q( F8 t0 \: }  p- M, g8 Z- w vpn-tunnel-protocol IPSec webvpn
password-storage disable
) L6 F, Y$ n7 `1 P/ X; g3 m5 U- S) [ ip-comp disable
re-xauth disable
# i8 ^2 e0 R  u- c! K8 { group-lock none
pfs disable
8 ]3 i. Q7 g4 X! i# w% v ipsec-udp disable
# Z+ {+ p9 q, J8 k8 \9 q1 q! J ipsec-udp-port 10000
split-tunnel-policy tunnelall
split-tunnel-network-list none
8 g9 x% Y" l0 N4 m+ C' ?) o0 P4 o* _ default-domain none
split-dns none
% K. C; u5 b* b) ~7 J- O& K. ~% | secure-unit-authentication disable
user-authentication disable
% j9 x: q. i+ b. E- z7 L user-authentication-idle-timeout 30
ip-phone-bypass disable
leap-bypass disable
9 H% I6 b2 {% r, V: t4 \ nem disable
$ J6 m4 ~! t' S- O, b: ~ backup-servers keep-client-config
; [5 f- w! h. N, b" W$ D client-firewall none
6 u+ K# G6 P4 P8 p& X, O client-access-rule none
webvpn
  functions url-entry
  port-forward-name value Application Access
group-policy vpnclient internal
! a5 ?& y+ A+ C3 v0 dgroup-policy vpnclient attributes
dns-server value 61.128.128.67
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
8 g; n+ L6 Z) T# Q( v: ^ split-tunnel-network-list value vpnclient_splitTunnelAcl
webvpn
3 f2 E5 G, q4 ~# I7 ?username admin11 password 2oVCF4GkSvYRaajj encrypted
; U2 Y. ^+ {! I* ~8 ~9 lusername admin11 attributes
* Q, n+ z) d$ o. ] vpn-group-policy vpnclient
4 I1 R$ j- k! [, { webvpn
username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
  R  B3 Z/ C; kaaa authentication http console LOCAL
aaa authentication serial console LOCAL
- E) q2 e7 N3 v9 N5 l& haaa authentication telnet console LOCAL
http server enable
http 192.168.0.0 255.255.255.0 inside
7 ^1 }- z2 g( v+ [http 0.0.0.0 0.0.0.0 inside
. H: D; z8 b4 Chttp 0.0.0.0 0.0.0.0 outside
http 192.168.1.0 255.255.255.0 management
+ h9 h4 T# t1 wno snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set vpnset esp-des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
* y6 B  N1 Q' n) K5 L$ C+ P- S/ Fcrypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map outside-dyn-map 10 set transform-set vpnset
crypto dynamic-map outside-dyn-map 10 set security-association lifetime seconds 288000
crypto dynamic-map outside-dyn-map 10 set security-association lifetime kilobytes 4608000
crypto dynamic-map outside-dyn-map 10 set reverse-route
2 f& F8 d0 u* Y2 v, R4 F$ Jcrypto map outside_map 65535 set security-association lifetime seconds 28800
crypto map outside_map 65535 set security-association lifetime kilobytes 4608000
' ~0 m3 [4 c* y$ f% d' h" q) acrypto map ESP-DES-MD5 20 set security-association lifetime seconds 28800
crypto map ESP-DES-MD5 20 set security-association lifetime kilobytes 4608000
9 I% m, b/ Y9 H# ~! g5 a/ K5 }- `crypto map mymap 10 set security-association lifetime seconds 28800
7 a# X% M2 f5 I7 ?crypto map mymap 10 set security-association lifetime kilobytes 4608000
crypto map outside-map 10 ipsec-isakmp dynamic outside-dyn-map
crypto map outside-map interface outside
isakmp identity address
isakmp enable outside
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption des
isakmp policy 1 hash md5
isakmp policy 1 group 2
isakmp policy 1 lifetime 86400
0 N# _( w) n4 Q7 G3 O0 p1 Cisakmp nat-traversal  20
' r2 ?! ~- T4 t; xtunnel-group DefaultL2LGroup ipsec-attributes
* V/ i: V3 B& [7 p% O pre-shared-key *
tunnel-group vpnclient type ipsec-ra
tunnel-group vpnclient general-attributes
address-pool vpnpool
, D8 @5 }+ Q; k/ T default-group-policy vpnclient
tunnel-group vpnclient ipsec-attributes
pre-shared-key *
tunnel-group-map default-group cisco
telnet 192.168.0.0 255.255.255.0 inside
  C5 ~1 e5 V" x% h; ytelnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
; I! d( q. k) d' }& j0 _' _. e# zssh 0.0.0.0 0.0.0.0 outside
+ b. E) q6 c+ S+ C" Sssh timeout 60
+ C+ J, ?  v; c5 l' T, |. dconsole timeout 0
dhcpd address 192.168.0.2-192.168.0.254 inside
6 y+ y2 r4 X6 `: s' l% P1 @+ @3 {7 D; Tdhcpd address 192.168.1.2-192.168.1.254 management
) b9 e  R9 c- K0 E, W  l# c& ydhcpd dns 61.128.128.68 61.128.192.68
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable inside
dhcpd enable management
6 N3 h' `9 M! S7 ~!
% z! y* N5 Q3 D" ~9 J  N: O$ eclass-map inspection_default
match default-inspection-traffic
!
5 e8 s$ r7 q( |4 N5 ^+ g$ d!
policy-map global_policy
" Y1 \) L3 o; N& }+ W& t class inspection_default
  inspect dns maximum-length 512
+ O! @" B0 U1 J6 r' q( ?  inspect ftp
: s" F8 s/ x7 R, c" q  inspect h323 h225
9 i  t& K) w) W0 k  x9 S  inspect h323 ras
  inspect rsh
  inspect rtsp
3 p- {7 ]& V2 o3 N: V; M, z2 L7 a  inspect esmtp
  inspect sqlnet
  N- q6 I, Y- i! z6 p  inspect skinny
  inspect sunrpc
( D5 e/ [3 S- c" ^( `8 Z  inspect xdmcp
  inspect sip
" T% D% a3 _4 K6 N9 D. i# L9 y  inspect netbios
& Q* z, q8 n1 m1 b- y! x  inspect tftp
!
service-policy global_policy global
client-update enable
Cryptochecksum:aef2b202fd891d6f72ef70a222d07ad7
% P. G$ }# N* y! x- N  F: e! H7 r7 I: end
* u- `( D+ y, y& h. c- h5 F& {
+ ?# \7 L, t- C请问下楼上的师傅QQ号是多少. 能否找你私下聊一下, 主要就是这个VPN的问题个.

设置拨号连接参数，点击“属性”进入TCP/IP协议设置，勾选“在远程网络上使用默认网关”前面的勾。