cisco-2811 vpn设置求教

各位大侠，请帮我下，我用的是cisco-2811的SDM中的easy vpn server配置的vpn设置，现在用cisco client 能拨入116.224.131.50,但是我只能访问192.168.1.1,其余的10.16.118.xx访问不了，不知道如何解决，请大侠们帮助解决下，谢谢！
9 V! q2 ], {- D9 K当前的代码如下!
This is the running config of the router: 116.224.131.50
!----------------------------------------------------------------------------
!version 12.4
service timestamps debug datetime msec
) ^" r( M3 f/ V/ Y- yservice timestamps log datetime msec
no service password-encryption
. A: W7 e; X' F- J& U  d, G% J!
hostname cisco-2811
. \* ?% @% _3 M. d+ q3 C!
% c# ~4 f) m$ W# i6 cboot-start-marker
* Y/ S7 r4 ?0 {/ z; {2 p8 H! X' {boot system flash c2800nm-advsecurityk9-mz.124-3.bin
8 M. Q) ~2 R, `9 bboot-end-marker
- o, T6 X4 C5 t!
" {4 P: E# l9 D. S) f+ alogging buffered 51200 warnings
!
  v. s1 i( S. q% |" Baaa new-model
!
: M6 s" F: ~+ M6 d# @!
8 v9 u2 D4 |2 v$ O  ]aaa authentication login default local
aaa authentication login sdm_vpn_xauth_ml_1 local
0 s2 a0 R/ S" gaaa authorization exec default local
aaa authorization network sdm_vpn_group_ml_1 local
!
aaa session-id common
!
resource policy
!
1 d1 a: @) e! b: [' A' y; O# Iip subnet-zero
2 g; E6 H1 Z) l!
!
: a' ^7 L! _8 ^4 H1 a+ kip cef
! X/ G+ ?& ?( T; U6 C!
) @8 C9 b  |8 I( @9 j- j!
" g, e4 l* P3 S$ ]1 @% L3 M, ino ip domain lookup
ip domain name yourdomain.com
vpdn enable
!
!
' a0 k$ G2 S! m' E* Z!
!
!
username fuji privilege 15 secret 5 $1$uhpZ$y2QSd1CNbFQVzEVD/7455/
!
!
4 b- r) J6 m$ s0 j* J!
crypto isakmp policy 1
encr 3des
authentication pre-share
" U& P; u2 c) v; ^group 2
$ j. Z# j; y/ r( ~; Rcrypto isakmp xauth timeout 15
* S) w! |( p9 T, k; ^!
+ b' }$ h) D3 I9 S8 A; W7 y8 Rcrypto isakmp client configuration group fslvpn
. g- ]2 Y( d2 y8 ekey fslvpn
pool SDM_POOL_4
" e# F! k) p: d. c; _' Amax-users 10
netmask 255.255.255.0
!
!
crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
!
crypto dynamic-map SDM_DYNMAP_1 1
" j4 i* Y5 b4 P( f, @, _. ^" \set transform-set ESP-3DES-SHA1
reverse-route
% ^! \. y+ {; X!
!
crypto map SDM_CMAP_1 client authentication list default
crypto map SDM_CMAP_1 isakmp authorization list sdm_vpn_group_ml_1
crypto map SDM_CMAP_1 client configuration address respond
crypto map SDM_CMAP_1 65535 ipsec-isakmp dynamic SDM_DYNMAP_1
!
8 b: `, R& H2 @/ |* I1 l!
/ q. F- h* s* B( I!
interface FastEthernet0/0
& W* l. L/ \( H0 l& M3 O2 A9 Ldescription WAN$ETH-WAN$
: I  d! V+ ]/ L% tip address 116.224.131.50 255.255.255.224
ip nat outside
ip virtual-reassembly
duplex auto
+ l4 j. S6 r' ^& {- R, j5 Yspeed auto
crypto map SDM_CMAP_1
0 s# |2 F6 t  w!
interface FastEthernet0/1
# Z" }) m% [" I  c0 r  c" Edescription LAN
ip address 192.168.1.1 255.255.255.0
# @: P6 o- N& c7 P( Pip nat inside
# d: b1 k7 T( K' t1 F5 x$ i3 mip virtual-reassembly
5 J0 p9 \4 L) @) Dduplex auto
speed auto
% ?, O  r3 L. f+ T!
& ~9 D1 ]! {. x. e7 tip local pool SDM_POOL_4 10.16.116.1 10.16.116.10
" j+ K: y0 O5 d6 B) {ip classless
ip route 0.0.0.0 0.0.0.0 116.224.131.33
!
ip http server
8 R4 |; q/ {6 j4 @/ Sip http access-class 23
ip http authentication local
ip http secure-server
/ y# u+ b& R, \3 Q5 nip http timeout-policy idle 60 life 86400 requests 10000
0 k2 K/ U+ j( W) x3 [: M6 Eip nat inside source route-map SDM_RMAP_2 interface FastEthernet0/0 overload
! s3 F8 j/ \+ c6 ]" x! d# ~ip nat inside source static 192.168.1.3 222.72.114.233 route-map SDM_RMAP_3
8 v  H1 }/ t1 Y% R4 l3 N# D/ j/ P!
9 I3 Q) i, h0 f2 f% y  A$ v8 Caccess-list 1 remark SDM_ACL Category=16
# t# g. A" t0 e7 C1 r" xaccess-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 permit 10.16.118.0 0.0.0.255
6 G% ^  \2 e& L4 C' V% Caccess-list 23 permit any
access-list 100 remark SDM_ACL Category=2
access-list 100 deny ip any host 10.16.116.1
; y: c% |# e2 n& U; D5 daccess-list 100 deny ip any host 10.16.116.2
access-list 100 deny ip any host 10.16.116.3
access-list 100 deny ip any host 10.16.116.4
access-list 100 deny ip any host 10.16.116.5
access-list 100 deny ip any host 10.16.116.6
access-list 100 deny ip any host 10.16.116.7
access-list 100 deny ip any host 10.16.116.8
access-list 100 deny ip any host 10.16.116.9
1 [1 e; K7 F2 i& _access-list 100 deny ip any host 10.16.116.10
- T8 [# _. u8 s0 b1 A0 c& ?access-list 100 deny ip host 192.168.1.3 any
0 z9 y1 `: H5 w& j+ X4 Haccess-list 100 permit ip 10.16.118.0 0.0.0.255 any
access-list 100 permit ip 192.168.1.0 0.0.0.255 any
access-list 101 remark SDM_ACL Category=2
access-list 101 deny ip host 192.168.1.3 host 10.16.116.10
access-list 101 deny ip host 192.168.1.3 host 10.16.116.9
access-list 101 deny ip host 192.168.1.3 host 10.16.116.8
( V3 [3 e, A$ M$ [6 o: j6 [0 oaccess-list 101 deny ip host 192.168.1.3 host 10.16.116.7
access-list 101 deny ip host 192.168.1.3 host 10.16.116.6
access-list 101 deny ip host 192.168.1.3 host 10.16.116.5
access-list 101 deny ip host 192.168.1.3 host 10.16.116.4
access-list 101 deny ip host 192.168.1.3 host 10.16.116.3
6 B3 _9 A# ^, w; daccess-list 101 deny ip host 192.168.1.3 host 10.16.116.2
: N5 T8 \* e: E9 ]. daccess-list 101 deny ip host 192.168.1.3 host 10.16.116.1
( a3 _: L3 L& I; o6 X0 Aaccess-list 101 permit ip host 192.168.1.3 any
route-map SDM_RMAP_2 permit 1
match ip address 100
!
route-map SDM_RMAP_3 permit 1
match ip address 101
!
!
6 Z* k" {( ?. [!
control-plane
6 E6 G- q2 r2 y" Y9 E! K: h!
!
!
line con 0
: l/ Q- j/ ^& Y" qline aux 0
; R, {  A7 O* N* R0 wline vty 0 4
& c; O: X5 n' maccess-class 23 in
* \+ K' F8 v% qtransport input telnet
- R/ N: U  c/ `- z% B% Y* j  R; \2 g6 wline vty 5 15
access-class 23 in
8 F( `$ [4 Q0 ^transport input telnet
!
scheduler allocate 20000 1000
!
end

1、添加一条access-list 199 permit ip 10.16.116.0 0.0.0.255 any
6 }. m0 w/ z3 m+ Z2、在crypto isakmp client configuration group fslvpn内加上：acl 199
1 k& a+ s; p; t! ~+ W个人怀疑是客户端没有10.16.116.**的路由，在配置客户端时通过acl注入看看。

第2句的语句如何写呢，请大侠帮忙指点下

引用:                                                                                                                                作者: elthanhr                                                                                                                                                                                                        第2句的语句如何写呢，请大侠帮忙指点下                                                                                                                crypto isakmp client configuration group fslvpn
key fslvpn
, r7 ~/ P6 K/ v4 N$ Opool SDM_POOL_4
: q$ I: I" S1 C* Gmax-users 10
1 t# e6 D; ?; ?' E: Mnetmask 255.255.255.0
acl 199

设置后，192.168.1.1却无法访问了，10.16.118.xx也无法访问
$ ?+ L( P& A- p/ |
1 K$ T' q* f, `4 g, t) I: wp nat inside source route-map SDM_RMAP_2 interface FastEthernet0/0 overload
ip nat inside source static 192.168.1.3 222.72.114.233 route-map SDM_RMAP_3
!
access-list 1 remark SDM_ACL Category=16
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 permit 10.16.118.0 0.0.0.255
. J4 {3 _( V* b5 k) V) Qaccess-list 23 permit any
access-list 100 remark SDM_ACL Category=2
: f9 M0 E: A4 f6 v3 @1 N7 ]3 ]; Saccess-list 100 deny ip any host 10.16.116.1
: y- M3 z3 p4 K2 A* Taccess-list 100 deny ip any host 10.16.116.2
access-list 100 deny ip any host 10.16.116.3
2 `7 }3 P% e& i# O8 Xaccess-list 100 deny ip any host 10.16.116.4
access-list 100 deny ip any host 10.16.116.5
+ }! h4 r1 e7 N* G- q& A$ D1 qaccess-list 100 deny ip any host 10.16.116.6
5 p0 s% ~) q- F+ }! o1 Uaccess-list 100 deny ip any host 10.16.116.7
access-list 100 deny ip any host 10.16.116.8
- n! N% f' V2 Q. A, Gaccess-list 100 deny ip any host 10.16.116.9
7 a  ?* N3 F( H, i0 }$ m* kaccess-list 100 deny ip any host 10.16.116.10
- c" T7 L" B# V/ x/ }  ]access-list 100 deny ip host 192.168.1.3 any
access-list 100 permit ip 10.16.118.0 0.0.0.255 any
' e- ?; E3 }( [) ~7 O* Paccess-list 100 permit ip 192.168.1.0 0.0.0.255 any
access-list 101 remark SDM_ACL Category=2
$ H/ S" \5 g4 C$ qaccess-list 101 deny ip host 192.168.1.3 host 10.16.116.10
access-list 101 deny ip host 192.168.1.3 host 10.16.116.9
access-list 101 deny ip host 192.168.1.3 host 10.16.116.8
access-list 101 deny ip host 192.168.1.3 host 10.16.116.7
access-list 101 deny ip host 192.168.1.3 host 10.16.116.6
; d7 R1 o  ^; S$ _access-list 101 deny ip host 192.168.1.3 host 10.16.116.5
6 J' c: g. X9 d, R! Z0 faccess-list 101 deny ip host 192.168.1.3 host 10.16.116.4
access-list 101 deny ip host 192.168.1.3 host 10.16.116.3
( C+ G- A! C  q8 z3 y( ]access-list 101 deny ip host 192.168.1.3 host 10.16.116.2
access-list 101 deny ip host 192.168.1.3 host 10.16.116.1
access-list 101 permit ip host 192.168.1.3 any
access-list 199 permit ip 10.16.116.0 0.0.0.255 any

route-map SDM_RMAP_2 permit 1
match ip address 100
" d+ \2 K/ _2 J: b3 ]5 w!
, a- W4 K9 f' k2 M: `" `; c) J- `route-map SDM_RMAP_3 permit 1
match ip address 101


是不是后面也要加上 route-map SDM_RMAP_4 permit 1
8 _+ _5 K3 Z7 t7 P1 Nmactch ip address 199

你的ezvpn server上10.16.118.xx接在哪里呢？
在server上show ip route 有10.16.118.xx/24吗？

sdm配置出来的命令，看起来还真痛苦

……

不好意思，acl写错了，应该是
7 o# H7 N( x" Y/ `3 t: Jaccess-list 199 permit ip 10.16.118.0 0.0.0.255 any

加上去的效果是vpn能拨通，但是连192.168.1.1都不能连通了，其他的也不行