pix做vpn，vpn client拨入后不能访问内网

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        帮顶.  同样的问题                                                                                                                inside访问vpn地址nonat掉

做了no nat的 还是不行

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        做了no nat的 还是不行                                                                                                                配置贴上来看看

ASA Version 7.0(8)
1 C0 |! ~  Y% U!
- E) g4 F/ O+ ?& M& jhostname ciscoasa
domain-name default.domain.invalid
- {2 G$ t# S* Z# i4 X' `enable password 8Ry2YjIyt7RRXU24 encrypted
7 E, @3 {* R+ L! @1 n  @passwd 2KFQnbNIdI.2KYOU encrypted
, @# {1 A7 C/ `& Lnames
dns-guard
, B2 `: C7 p8 P* A4 K+ C- f7 h!
- Y, s' X4 T, Z. linterface Ethernet0/0
# Y! u7 q+ P5 E  S5 l* h" G nameif inside
3 N/ z3 W2 v* K5 ]8 F! f% O! ? security-level 100
5 _& @$ Q: u5 K1 C2 H ip address 192.168.0.1 255.255.255.0
!
interface Ethernet0/1
nameif outside
security-level 0
& N- ?% O) t! g- ? ip address 222.178.X.X 255.255.255.252
!
interface Ethernet0/2
1 [; X8 ?5 R4 |+ ~; n shutdown
; J! @2 ~1 ~9 E6 Y' v* S no nameif
" j# I& U) X. O3 S3 R: Z& V no security-level
3 _8 a6 w5 z# c% ] no ip address
!
% I1 ^- Y$ ^! n& I7 k. Kinterface Management0/0
  T8 E3 @: T" ~6 j2 R nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
8 f# p9 g3 s% @9 u8 I  f$ n/ W8 q. L management-only
!
- K' k7 C  t& o& m$ _& L, Wftp mode passive
same-security-traffic permit intra-interface
& U/ i5 S3 }$ q) q' Z5 ?' laccess-list 111 extended permit ip any any
8 D" h4 e; _1 U4 z  daccess-list no-nat extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list vpnclient_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu management 1500
* u; L$ N1 R: Qip local pool vpnpool 192.168.10.100-192.168.10.199 mask 255.255.255.0
$ O: a* L5 d6 j5 B6 ?asdm image disk0:/asdm-508.bin
no asdm history enable
4 |3 T+ t' {, F' A! n/ e# |, Uarp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list no-nat
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 5900 192.168.0.210 5900 netmask 255.255.255.255
7 Z4 R, {1 `: Q" u+ I% Qstatic (inside,outside) tcp interface 1433 192.168.0.143 1433 netmask 255.255.255.255
static (inside,outside) tcp interface 1434 192.168.0.143 1434 netmask 255.255.255.255
& I. H: D1 e! n- v; ostatic (inside,outside) tcp interface 2425 192.168.0.143 2425 netmask 255.255.255.255
static (inside,outside) tcp interface 2426 192.168.0.143 2426 netmask 255.255.255.255
+ D: ?0 a, s7 }$ T/ o* u- D* sstatic (inside,outside) tcp interface 2427 192.168.0.143 2427 netmask 255.255.255.255
. T. @4 S) U1 V0 [! f, astatic (inside,outside) tcp interface 2428 192.168.0.143 2428 netmask 255.255.255.255
6 B: R. }- P0 Q( S4 |2 u7 fstatic (inside,outside) tcp interface 2429 192.168.0.143 2429 netmask 255.255.255.255
static (inside,outside) tcp interface 5800 192.168.0.210 5800 netmask 255.255.255.255
access-group 111 in interface outside
route outside 0.0.0.0 0.0.0.0 222.178.X.X 1
timeout xlate 3:00:00
; U5 R* m9 U1 L5 g8 Q+ Qtimeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
* j* K* s$ W. b4 [; G# x. htimeout uauth 0:05:00 absolute
group-policy DfltGrpPolicy attributes
banner none
' E" n' t% h% v# W- v$ C! g* h# ]9 Z wins-server none
# `# R( R9 }/ P" ~ dns-server none
dhcp-network-scope none
6 x0 c6 J) J# S) U' y vpn-access-hours none
9 ?' a$ l1 ?* q* Y7 s' N9 G vpn-simultaneous-logins 3
vpn-idle-timeout 30
/ O2 w4 Y: |- q8 g5 {. K4 Q, _ vpn-session-timeout none
vpn-filter none
vpn-tunnel-protocol IPSec webvpn
  n" w% K+ r/ G% S password-storage disable
ip-comp disable
re-xauth disable
1 d# f. S0 {2 W group-lock none
pfs disable
6 _6 H. v/ @1 [" P* E  C ipsec-udp disable
: s' M; K/ u9 \* r ipsec-udp-port 10000
; n) y9 L7 q, {: m3 h split-tunnel-policy tunnelall
1 }: a- A7 \1 T; ?. D. ] split-tunnel-network-list none
) F! _1 ~5 Z- n& ]' Q! C# W default-domain none
split-dns none
secure-unit-authentication disable
user-authentication disable
user-authentication-idle-timeout 30
ip-phone-bypass disable
leap-bypass disable
2 f. b# x4 V! G) M  h/ x; I: p$ f, W nem disable
backup-servers keep-client-config
client-firewall none
client-access-rule none
webvpn
  functions url-entry
6 F& Z, R  D2 {2 D  r' x& K  port-forward-name value Application Access
1 T. C0 p9 U; Ggroup-policy vpnclient internal
group-policy vpnclient attributes
9 k& |6 x# X4 S- f dns-server value 61.128.128.67
+ Z4 Y- j% Z7 @' ]9 N6 D+ h7 x vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpnclient_splitTunnelAcl
& U% h( C- d' ]5 M9 W' u2 s1 p webvpn
username admin11 password 2oVCF4GkSvYRaajj encrypted
username admin11 attributes
+ M3 B6 C" o, b1 z8 X5 L. t+ p, Q vpn-group-policy vpnclient
* ?; y: V; O5 Y* D& R' w webvpn
" e( q+ U5 y. ^- Y0 u  \3 Gusername cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
+ k  _3 J+ |; [1 Gaaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
0 m! O; Q" H. P; qaaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication telnet console LOCAL
6 F! }6 @' \7 ~) c4 G2 I9 ^: o  \http server enable
! \4 Z; i: r6 \- bhttp 192.168.0.0 255.255.255.0 inside
http 0.0.0.0 0.0.0.0 inside
0 m. Z, u6 Y9 ~. Ahttp 0.0.0.0 0.0.0.0 outside
4 _0 W2 s+ b% N9 a' xhttp 192.168.1.0 255.255.255.0 management
/ `  H' Y) `/ N; j1 Pno snmp-server location
no snmp-server contact
1 Y. k& I% r$ ]5 Y. r8 E' Y9 N" Csnmp-server enable traps snmp authentication linkup linkdown coldstart
$ a4 ^) P, U3 B0 y) Fcrypto ipsec transform-set vpnset esp-des esp-md5-hmac
5 k1 n4 u. c% g% k1 r% ~crypto ipsec security-association lifetime seconds 28800
6 ?; O% a. n% E8 A9 B/ d4 Ocrypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map outside-dyn-map 10 set transform-set vpnset
# v3 \+ T6 L* f6 G7 P- E4 Zcrypto dynamic-map outside-dyn-map 10 set security-association lifetime seconds 288000
crypto dynamic-map outside-dyn-map 10 set security-association lifetime kilobytes 4608000
crypto dynamic-map outside-dyn-map 10 set reverse-route
8 L9 B$ P' K" n. w4 d1 G; ?crypto map outside_map 65535 set security-association lifetime seconds 28800
crypto map outside_map 65535 set security-association lifetime kilobytes 4608000
0 i, n  h9 T9 q( a, mcrypto map ESP-DES-MD5 20 set security-association lifetime seconds 28800
) y) a7 X( k3 v! M2 Scrypto map ESP-DES-MD5 20 set security-association lifetime kilobytes 4608000
crypto map mymap 10 set security-association lifetime seconds 28800
crypto map mymap 10 set security-association lifetime kilobytes 4608000
1 `- _; b3 \% P3 B% N. Vcrypto map outside-map 10 ipsec-isakmp dynamic outside-dyn-map
& D: A7 W! g- Y  u' Ccrypto map outside-map interface outside
isakmp identity address
isakmp enable outside
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption des
isakmp policy 1 hash md5
3 T% i/ B% ?9 gisakmp policy 1 group 2
isakmp policy 1 lifetime 86400
) P# r8 C3 b) r$ A+ _( S# bisakmp nat-traversal  20
tunnel-group DefaultL2LGroup ipsec-attributes
pre-shared-key *
tunnel-group vpnclient type ipsec-ra
1 \) m3 s  c! m: Ztunnel-group vpnclient general-attributes
4 s( C; h+ x6 M5 p' D. X$ F address-pool vpnpool
7 k" r, V, H/ P- E default-group-policy vpnclient
4 Z0 Q; G% t' ~* Xtunnel-group vpnclient ipsec-attributes
pre-shared-key *
tunnel-group-map default-group cisco
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
9 I. A; F; r% j0 k7 @ssh 0.0.0.0 0.0.0.0 inside
. t- j" l# B0 a$ essh 0.0.0.0 0.0.0.0 outside
3 U8 o) }' I0 i6 x2 wssh timeout 60
* I( U& {& j# n; rconsole timeout 0
% M" |: {9 K( idhcpd address 192.168.0.2-192.168.0.254 inside
dhcpd address 192.168.1.2-192.168.1.254 management
" }3 w" y8 }6 w& [dhcpd dns 61.128.128.68 61.128.192.68
8 n% ]1 q" Q! }7 q1 E' Wdhcpd lease 3600
) x: Q) N! L0 x$ s2 s% q8 A! a5 T! Ydhcpd ping_timeout 50
& r* O3 e# Q) l% Bdhcpd enable inside
# z' Q2 l! V9 c* x( j3 w+ Ldhcpd enable management
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
+ \& s1 T. C$ K3 k6 z6 ?  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
5 k1 P5 F5 z* W7 l) x! J4 t  inspect rtsp
) O- x7 Z- Y9 W& ~" X9 c  inspect esmtp
& \5 k# ~2 X# r5 r  inspect sqlnet
  inspect skinny
# I4 D% Y: z+ n  inspect sunrpc
2 |, F$ N# R  \9 ]  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
, W* L1 g3 E7 l6 t5 \!
/ N; `9 Z" e. u+ bservice-policy global_policy global
client-update enable
9 H$ c( ~( z1 ?5 UCryptochecksum:aef2b202fd891d6f72ef70a222d07ad7
: end
- Y4 W+ g& s0 |
请问下楼上的师傅QQ号是多少. 能否找你私下聊一下, 主要就是这个VPN的问题个.

设置拨号连接参数，点击“属性”进入TCP/IP协议设置，勾选“在远程网络上使用默认网关”前面的勾。