用cisco configuration professional 2.5配置了一个easy vpn server, 0 ^+ _. w4 F! }* \
f0/0 是外网 2.x.x.x
; t- i; T' p6 D8 V5 `f0/1 是内网 172.16.0.200% x5 A. h6 } i* t' R
给vpn client分配的是172.18.0.0/18
% ~* Q& F/ d' x, F% X$ P) ?, Z3 D4 ~+ d
, S. m y* t: x2 q6 H- E+ g已经添加了一条acl, 客户端能ping f0/1，但是无法ping通其他内网机器(172.16.0.0/18)
$ u; w5 f- ]5 z: N. ?9 A- j1 o1 z% M* ^% S* k
配置如下, 问题是出在哪里呢？谢谢！4 O+ d" ?5 _' M$ \
代码: service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname R2811!boot-start-markerboot system flash:c2800nm-advipservicesk9-mz.150-1.M4.binboot-end-marker!logging buffered 51200 warnings!aaa new-model!!aaa authentication login default localaaa authentication login ciscocp_vpn_xauth_ml_1 localaaa authorization exec default localaaa authorization network ciscocp_vpn_group_ml_1 local!!!!!aaa session-id common!!!clock timezone PCTime 8!dot11 syslogip source-route!!ip cef!!ip name-server 172.16.0.10ip name-server 172.16.0.11ip name-server 8.8.8.8no ipv6 cef!multilink bundle-name authenticated!!!!!!!!!!voice-card 0!!crypto pki trustpoint TP-self-signed-xxx enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-xxx revocation-check none rsakeypair TP-self-signed-xxx!!crypto pki certificate chain TP-self-signed-xxx certificate self-signed 01 30xxxxxx CA4C 11 quit!!license udi pid CISCO2811 sn xxarchive log config hidekeysusername user1 privilege 15 password 0 xxusername user2 secret 5 xx!redundancy!!!!crypto isakmp policy 1 encr 3des authentication pre-share group 2!crypto isakmp policy 2 encr aes hash md5 authentication pre-share group 2!crypto isakmp client configuration group gp2 key key111 dns 172.16.0.10 172.16.0.11 domain xxx.com pool SDM_POOL_1 acl 100 save-password include-local-lan max-users 30 netmask 255.255.192.0crypto isakmp profile ciscocp-ike-profile-1 match identity group gp2 client authentication list ciscocp_vpn_xauth_ml_1 isakmp authorization list ciscocp_vpn_group_ml_1 client configuration address respond virtual-template 1!!crypto ipsec transform-set aes esp-aes esp-md5-hmac comp-lzscrypto ipsec transform-set SDM_TRANSFORMSET_1 esp-3des esp-sha-hmac!crypto ipsec profile CiscoCP_Profile1 set transform-set aes set isakmp-profile ciscocp-ike-profile-1!!crypto dynamic-map crypto-map 1 set transform-set aes SDM_TRANSFORMSET_1 reverse-route!!!!!!!interface Loopback0 ip address 172.18.0.10 255.255.192.0 !!interface FastEthernet0/0 description $ETH-WAN$ ip address 2x.x.x.x 255.255.255.240 ip nat outside ip virtual-reassembly duplex auto speed auto !!interface FastEthernet0/1 ip address 172.16.0.200 255.255.192.0 ip nat inside ip virtual-reassembly duplex auto speed auto !!interface Virtual-Template1 type tunnel ip unnumbered Loopback0 tunnel mode ipsec ipv4 tunnel protection ipsec profile CiscoCP_Profile1 !!ip local pool SDM_POOL_1 172.18.0.20 172.18.0.50ip forward-protocol ndip http serverip http authentication localip http secure-server!!ip nat pool nat-pool-84 2x.x.x.x 2.x.x.x netmask 255.255.255.240ip nat inside source list 1 interface FastEthernet0/0 overloadip nat inside source list nat-list pool nat-pool-84ip route 0.0.0.0 0.0.0.0 FastEthernet0/0 permanentip route 172.16.0.0 255.255.192.0 FastEthernet0/1 permanentip route 172.18.0.0 255.255.192.0 Loopback0 permanent!ip access-list extended nat-list remark allow selected remark CCP_ACL Category=2 remark manage vm permit ip host 172.16.3.255 any!access-list 1 remark INSIDE_IF=FastEthernet0/1access-list 1 remark CCP_ACL Category=2access-list 1 permit 172.16.0.0 0.0.63.255access-list 100 remark CCP_ACL Category=4access-list 100 permit ip 172.16.0.0 0.0.63.255 anyaccess-list 100 permit ip 172.18.0.0 0.0.63.255 172.16.0.0 0.0.63.255!!!!route-map crypto-map permit 10!snmp-server community test RO!!control-plane !!!!mgcp fax t38 ecm!!!!!telephony-service no auto-reg-ephone max-ephones 42 max-dn 144 ip source-address 172.16.0.200 port 2000 time-zone 42 time-format 24 max-conferences 8 gain -6 web admin system name remit secret 5 $1$QCR4$lljrm5QZAevUt0yH4JMpZ1 transfer-system full-consult create cnf-files version-stamp 7960 Nov 04 2010 10:19:12!!line con 0line aux 0line vty 0 4 transport input telnet ssh!scheduler allocate 20000 1000end |
|
所有IT类厂商认证考试题库下载
【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集
【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课
原创_超融合自动化运维工具cvTools
重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）
链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享
某linux大佬，积累多年的电子书(约300本)
乾颐堂现任明教教主Python完整版
乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）
Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天
约21套Python视频合集 核心基础视频教程（共310G,已压缩）
最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程
最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器
[复制链接]
