pix做vpn，vpn client拨入后不能访问内网

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        帮顶.  同样的问题                                                                                                                inside访问vpn地址nonat掉

做了no nat的 还是不行

引用:                                                                                                                                作者: thescofield                                                                                                                                                                                                        做了no nat的 还是不行                                                                                                                配置贴上来看看

ASA Version 7.0(8)
!
+ _6 w$ T2 |6 _1 Shostname ciscoasa
domain-name default.domain.invalid
enable password 8Ry2YjIyt7RRXU24 encrypted
5 O5 B6 q2 v: Q/ X" H& z7 ?passwd 2KFQnbNIdI.2KYOU encrypted
2 B$ g8 `9 v$ O2 W7 znames
- U5 [9 {4 Q" ndns-guard
!
' \( k) K1 I/ I. Y2 i: I" n$ T. zinterface Ethernet0/0
nameif inside
# F1 A2 ?: _$ D security-level 100
, Q  g  M+ ~+ G; _6 E6 J ip address 192.168.0.1 255.255.255.0
" d7 ]2 Y. d# s3 ^1 [) `  h!
2 O( h3 D) u# l, F2 P# R$ ]) einterface Ethernet0/1
% V' M+ b8 b% l! X, u/ u/ P8 s nameif outside
6 V; H3 _4 J6 t% a5 [" D security-level 0
8 a% l2 g* P3 f6 M# \$ x ip address 222.178.X.X 255.255.255.252
! V% a5 w& _& u8 R& [8 [* V!
interface Ethernet0/2
0 I" F: ?. s* l+ \( `. v1 K% |! y shutdown
/ J0 X1 A% e" g: d no nameif
no security-level
) J1 W5 D# ~( p" d; F no ip address
!
2 g/ _+ x& F9 c$ M  {! z- c* Vinterface Management0/0
nameif management
security-level 100
. Y; O1 E& f9 A, e ip address 192.168.1.1 255.255.255.0
& o4 d' d8 y6 m+ { management-only
!
ftp mode passive
same-security-traffic permit intra-interface
# G$ }6 A8 ]; a  g  t* e6 faccess-list 111 extended permit ip any any
, ^( M. h7 |6 h# Vaccess-list no-nat extended permit ip 192.168.0.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list vpnclient_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
! e  _! j; S6 \  n8 w" u9 umtu management 1500
ip local pool vpnpool 192.168.10.100-192.168.10.199 mask 255.255.255.0
6 a$ O+ K6 L' Q9 A) Oasdm image disk0:/asdm-508.bin
7 p5 Q2 Q) _+ o5 F# O( \no asdm history enable
arp timeout 14400
global (outside) 1 interface
8 `2 S( y9 k) ]6 E0 X* Z1 Znat (inside) 0 access-list no-nat
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface 5900 192.168.0.210 5900 netmask 255.255.255.255
( F- z$ G4 S# k* ?; K5 n3 [' jstatic (inside,outside) tcp interface 1433 192.168.0.143 1433 netmask 255.255.255.255
static (inside,outside) tcp interface 1434 192.168.0.143 1434 netmask 255.255.255.255
4 |; m# L  g* O1 z5 Mstatic (inside,outside) tcp interface 2425 192.168.0.143 2425 netmask 255.255.255.255
static (inside,outside) tcp interface 2426 192.168.0.143 2426 netmask 255.255.255.255
static (inside,outside) tcp interface 2427 192.168.0.143 2427 netmask 255.255.255.255
+ R) K, I; n1 x  y+ @" gstatic (inside,outside) tcp interface 2428 192.168.0.143 2428 netmask 255.255.255.255
static (inside,outside) tcp interface 2429 192.168.0.143 2429 netmask 255.255.255.255
static (inside,outside) tcp interface 5800 192.168.0.210 5800 netmask 255.255.255.255
access-group 111 in interface outside
) F# c' l6 d9 croute outside 0.0.0.0 0.0.0.0 222.178.X.X 1
" M* A) ?% k5 A! n/ otimeout xlate 3:00:00
1 C" x8 L5 Q0 c  g! T9 otimeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
- [. T8 B: m3 L6 {: i* Gtimeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
9 @. n2 P$ ]6 n5 N7 I5 [group-policy DfltGrpPolicy attributes
banner none
wins-server none
6 K/ R* N5 B1 I2 c+ L6 ^6 b+ m dns-server none
! r, k* e' i0 P& x5 @, Q- v/ s/ l dhcp-network-scope none
vpn-access-hours none
5 {. a5 y1 A! V0 x* x7 o vpn-simultaneous-logins 3
7 P2 k5 ~( l0 M2 B$ z: R, ]2 e3 |6 r vpn-idle-timeout 30
7 V7 c& K# C( Z$ I2 |- R vpn-session-timeout none
& k& ?8 u0 w3 ]: Z4 R' A) K/ o vpn-filter none
% S  F( d* B# H: v0 r7 o vpn-tunnel-protocol IPSec webvpn
. D0 A) g0 a" R password-storage disable
. d, u5 _8 z% w/ U) l- y ip-comp disable
& b- b9 @: G5 R' H/ ?; U re-xauth disable
group-lock none
- p& u- W+ k3 k4 k0 G' W pfs disable
7 ?0 c( N8 p0 B* j/ i: ]1 O; T# C ipsec-udp disable
ipsec-udp-port 10000
! u# ?. P, w6 L; A2 ^7 T  B( ^ split-tunnel-policy tunnelall
$ j2 m% H2 F. e1 A2 r* J split-tunnel-network-list none
. O) r( I! i) K" Z8 d# b6 @, y default-domain none
split-dns none
secure-unit-authentication disable
user-authentication disable
6 M, d& ^) U; A) i2 `2 _ user-authentication-idle-timeout 30
ip-phone-bypass disable
7 O! i: x$ m( e leap-bypass disable
$ F. I, C; \" I* Z/ u* Y; h nem disable
backup-servers keep-client-config
client-firewall none
( O6 J; y6 p! @ client-access-rule none
webvpn
4 S- [+ r$ r5 V' W1 [  functions url-entry
  port-forward-name value Application Access
group-policy vpnclient internal
3 b& O; E- A& H! M! S: M# Sgroup-policy vpnclient attributes
4 p) v1 X8 A. U, s. C1 ]) \ dns-server value 61.128.128.67
vpn-tunnel-protocol IPSec
: _1 C1 f5 ]+ J, j split-tunnel-policy tunnelspecified
' I% I5 J( z6 O$ k4 N split-tunnel-network-list value vpnclient_splitTunnelAcl
webvpn
) U  K* V1 x2 D5 ~+ v0 J7 N* Q0 cusername admin11 password 2oVCF4GkSvYRaajj encrypted
9 ?. l) X* ?8 a1 }$ `7 j1 d) e; @username admin11 attributes
vpn-group-policy vpnclient
webvpn
username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
' a0 y2 F! x) x, \/ [% [aaa authentication telnet console LOCAL
http server enable
; x8 t. {, g! F% O! d8 ?http 192.168.0.0 255.255.255.0 inside
4 [7 n/ R5 E9 ]  ohttp 0.0.0.0 0.0.0.0 inside
$ I/ J  y# t" E/ ohttp 0.0.0.0 0.0.0.0 outside
; s1 G$ F& l9 N. Ohttp 192.168.1.0 255.255.255.0 management
- ^% M; ]/ c$ l7 Xno snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
& }9 _+ h% |& Z! j8 P/ L1 R$ pcrypto ipsec transform-set vpnset esp-des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
$ `4 n0 ^6 ?& K  F" Ccrypto ipsec security-association lifetime kilobytes 4608000
7 s$ ?0 K: ^, L( w  |5 N: B) T6 ~crypto dynamic-map outside-dyn-map 10 set transform-set vpnset
crypto dynamic-map outside-dyn-map 10 set security-association lifetime seconds 288000
crypto dynamic-map outside-dyn-map 10 set security-association lifetime kilobytes 4608000
crypto dynamic-map outside-dyn-map 10 set reverse-route
crypto map outside_map 65535 set security-association lifetime seconds 28800
crypto map outside_map 65535 set security-association lifetime kilobytes 4608000
- O3 j9 J7 V- T: p. |5 ncrypto map ESP-DES-MD5 20 set security-association lifetime seconds 28800
( m: e, l) `, t5 g) @crypto map ESP-DES-MD5 20 set security-association lifetime kilobytes 4608000
crypto map mymap 10 set security-association lifetime seconds 28800
crypto map mymap 10 set security-association lifetime kilobytes 4608000
crypto map outside-map 10 ipsec-isakmp dynamic outside-dyn-map
, o+ R5 u0 t' {5 a/ c" `) x/ o" j7 Pcrypto map outside-map interface outside
isakmp identity address
. l2 I0 F# O4 X7 |9 r  [4 sisakmp enable outside
/ N  Q1 v( m3 W& ?$ i2 k' l+ Visakmp policy 1 authentication pre-share
' M8 J2 E; F- X3 `" O/ }9 G9 @0 i' e  Hisakmp policy 1 encryption des
isakmp policy 1 hash md5
isakmp policy 1 group 2
isakmp policy 1 lifetime 86400
4 r+ q6 c7 C. s& q" [isakmp nat-traversal  20
tunnel-group DefaultL2LGroup ipsec-attributes
pre-shared-key *
- Z, ^7 {6 B/ c0 W  j8 x, c8 Atunnel-group vpnclient type ipsec-ra
. ]: ^( S$ }( i9 A- o4 X0 `tunnel-group vpnclient general-attributes
! |' s4 r7 f0 N% q. Q' h address-pool vpnpool
8 D1 ^6 @8 L0 t* S default-group-policy vpnclient
tunnel-group vpnclient ipsec-attributes
' a" L& a5 P0 r, S pre-shared-key *
tunnel-group-map default-group cisco
telnet 192.168.0.0 255.255.255.0 inside
telnet timeout 5
- }2 @/ q# n* Hssh 0.0.0.0 0.0.0.0 inside
( X+ i8 X- X" l/ }/ _& A( rssh 0.0.0.0 0.0.0.0 outside
. O9 L" t, F' f% j# S5 `, [6 x0 @ssh timeout 60
console timeout 0
dhcpd address 192.168.0.2-192.168.0.254 inside
dhcpd address 192.168.1.2-192.168.1.254 management
/ i5 m( h9 Z* C1 \/ @" h  Sdhcpd dns 61.128.128.68 61.128.192.68
3 `& F+ L: Z& C/ z4 _% Ddhcpd lease 3600
4 h; D; w! z8 P/ ndhcpd ping_timeout 50
/ n1 J. z2 x# \& {% Cdhcpd enable inside
dhcpd enable management
) C' O1 |7 w: h!
% F, E9 P  q% kclass-map inspection_default
' _! j% E+ A& x. O: I2 T match default-inspection-traffic
; [, X! s( G  K; ^!
, m, t7 t  V7 U9 Z" c9 e, Z!
2 P2 j8 {7 F! Q- V7 k3 npolicy-map global_policy
' y  |* w( k3 z! i  e) ? class inspection_default
8 W6 w( |' z7 {* F/ _+ h3 d  inspect dns maximum-length 512
  inspect ftp
" D4 h( k- g. p9 G* n$ _6 N  inspect h323 h225
0 w4 D2 u! ?6 M0 d* V) D. x  inspect h323 ras
* T9 u, ]# @7 Q* p7 b$ i" j$ c1 @  inspect rsh
  inspect rtsp
" C! g! r1 G( q  inspect esmtp
  inspect sqlnet
# V3 p9 E1 i; E: \  inspect skinny
4 \3 f# C& }) l! I% _& ^6 Y$ U  inspect sunrpc
# U7 K* s, i$ w  inspect xdmcp
  inspect sip
1 l; d/ V$ W0 Y* e2 ^  inspect netbios
  inspect tftp
0 P- _& H. A$ y2 U) i' Q' S!
* E! |5 n3 ^8 Z% Lservice-policy global_policy global
3 F, k: O$ E/ c1 B7 Z8 Zclient-update enable
Cryptochecksum:aef2b202fd891d6f72ef70a222d07ad7
: end
6 c7 I2 U& z5 R& p9 N. e- O- f( D
' ]% N# Y2 ~; |* \( o% c请问下楼上的师傅QQ号是多少. 能否找你私下聊一下, 主要就是这个VPN的问题个.

设置拨号连接参数，点击“属性”进入TCP/IP协议设置，勾选“在远程网络上使用默认网关”前面的勾。