求助：EasyVPN 问题

请各位帮忙看看，以下是3725 和877 的配置文件， 在877 上如何设置才能保证跟3725的内网组播通信，同时连接在877上的PC又可以访问互联网。多谢。
8 W4 s* \2 W1 Z- F5 L
3725 show conf

3 c9 P- O; B. z- ~version 12.4
service tcp-keepalives-in
service timestamps debug datetime msec
2 O' q4 l* w8 g6 r# R# d+ Vservice timestamps log datetime msec
4 C; r& _8 g4 w1 M4 O2 Sservice password-encryption
!
0 K( y  ^0 d' l1 l4 n* Hhostname xxxxx
9 J: E3 Y1 U4 Q3 b1 V!
" Z9 k1 c! ]+ Rboot-start-marker
" \7 |& w8 b9 f5 L- P( W6 O5 eboot-end-marker
" E$ z4 t7 P4 y7 d1 U) L!
# e9 Z5 {7 X* {1 l% p7 g' T7 nlogging buffered 131072
enable secret 5 xxxx
9 {) J2 o" \- T  z, `1 H!
9 R# n9 [, [; Maaa new-model
!
- Z$ b- P; |6 e6 T!
  B6 _; r7 J3 a7 v. N! q; Uaaa authentication login userauthen local
aaa authentication ppp default local
8 E; S* C* `( f* i8 X7 caaa authorization network default local
aaa authorization network groupauthor local
* |& }+ }" ^9 H$ }!
% r/ F" P" a/ {5 p- Y5 ^!
aaa session-id common
memory-size iomem 25
clock timezone gmt -5
3 K: r$ ]2 U' z+ eclock summer-time edt recurring
6 u; s* F0 f$ u5 yno network-clock-participate wic 0
( ^- `9 Z% V8 ^7 f# Sip cef
2 b3 Q( }9 l$ D!
!
no ip dhcp use vrf connected
ip dhcp excluded-address 10.10.170.1
) S4 c5 e& b% P+ J/ Uip dhcp excluded-address 10.10.170.9
# F; r8 o; F8 O!
ip dhcp pool tj3-pool
network 10.10.170.0 255.255.255.192
domain-name xxxxxxxx.com
; I5 C" J  A: i3 t& R/ J' [) Qdns-server 10.10.90.31 192.0.39.96 192.0.39.38
netbios-name-server 10.10.90.31 192.0.39.38
default-router 10.10.170.1
!
4 ^/ L$ z) H! e8 S! `; Z/ o!
* ]( F( a1 C! I" rip multicast-routing
" Y9 u0 J6 j$ |6 ]$ {4 |- i4 k!
multilink bundle-name authenticated
: G" A% Q5 |% K9 J/ T!
# x5 ]! F- L6 W2 Z5 G6 x8 a!
% ^" b% _1 x" j  _" }7 \!
!
$ L. k4 Y1 ~6 [% {) Q4 S/ F!
!
!
) m8 S3 K; Q& r% L/ D# Y!
7 d9 y* F3 E0 V0 N" @!
!
  {2 J3 F3 _/ O: n4 R  m: K8 v  ?!
!
" q5 J- e1 s# L3 T!
5 l- |; B0 |- {" z4 A* P2 a!
, W( N) c5 n+ Z) c: |!
. P7 j  J* _1 c!
9 t* f, S0 `) ?3 f1 q0 s!
!
* \- G& y6 [) `) O!
!
, ^( ]0 \2 Z; G5 k( husername xxx privilege 15 password 7 xxxx
2 W! m9 o* b1 T4 A) Y* |username xxx password 7 xxxx
# t3 }' w6 R% c" ]. X9 }archive
log config
hidekeys
!
! M/ C& R% l; ^7 S!
crypto isakmp policy 3
( o( K3 ^5 ?7 k( Z  uencr 3des
authentication pre-share
group 2
2 w- j, {- j2 r!
crypto isakmp client configuration group vpnclient
" n  ]5 a7 ^# F& [key cisco123
dns 10.10.90.31 192.0.39.96
wins 10.10.90.31 192.0.39.38
domain xxxxxx.com
/ `* r5 M$ a1 wpool ippool
acl 111
7 d; Q, }& }6 O( w# J7 H# s- _" Jnetmask 255.255.255.240
!
9 i$ v& M9 k% r" @# N' Zcrypto isakmp client configuration group mcast_client
/ U- m9 Y% M9 L( J5 e" {  ~key cisco
pool ippool
8 |+ f; }2 D4 Bsave-password
9 R! F) i/ ~- j) P0 u* L% E4 L, qcrypto isakmp profile vpn1-ra
match identity group mcast_client
client authentication list userauthen
isakmp authorization list groupauthor
client configuration address respond
virtual-template 1
!
7 g$ b5 O, b' b!
crypto ipsec transform-set myset esp-des esp-md5-hmac
# N6 F1 Y# a, c- v4 a/ l  b, O!
crypto ipsec profile test-vti1
set transform-set myset
!
!
crypto dynamic-map dynmap 10
, o* g9 T  w6 ?* G( Lset transform-set myset
reverse-route
!
' k' G  b" T0 [. J* P!
crypto map clientmap client authentication list userauthen
crypto map clientmap isakmp authorization list groupauthor
; i4 A0 f  ^" {" N, Tcrypto map clientmap client configuration address respond
4 s6 c2 a# v" Z$ q2 I" i! k$ pcrypto map clientmap 10 ipsec-isakmp dynamic dynmap
* x3 z) x4 D- z$ n!
!
: Z/ q; h  O3 V* }% H9 q!
controller E1 0/0
, M) u" W6 ~- J& ~$ V9 x3 R* I# Nframing NO-CRC4
, O3 F" k  Q, X3 t. d9 B! m2 {channel-group 0 timeslots 1-31
!
5 x0 M4 @; l% g1 M4 c  y0 V' Fcontroller E1 0/1
, k# v4 m  }" S/ X9 x5 @2 N* i!
ip tcp mss 1436
buffers small permanent 5500
buffers small max-free 6500
buffers small min-free 1000
buffers middle permanent 6000
4 Y6 ?5 K9 C# B& R: D, [buffers middle max-free 6500
buffers middle min-free 1500
' [6 A, b: T$ b4 L; T6 J6 _% ^" {buffers big permanent 1200
buffers big max-free 1700
buffers big min-free 500
buffers verybig permanent 200
buffers verybig max-free 500
buffers verybig min-free 100
/ f- E, q* q( I/ e3 j9 Cbuffers large permanent 80
buffers large max-free 200
buffers large min-free 10
  s8 p( T; Q( }$ v( Zbuffers huge permanent 50
' G! D, O$ J  [, X+ k* ]1 i1 ^buffers huge max-free 100
buffers huge min-free 10
/ S' ?2 C* c3 w; s/ `* L!
/ D$ Y7 @  m6 j  c!
  w) x, j6 S: Y' D( P: }/ r!
" a* @% j9 e5 `! D5 u!
interface Loopback0
ip address 10.10.170.241 255.255.255.255
!
interface Tunnel103
ip address 10.8.7.50 255.255.255.252
- O0 m% w) c# I8 \# I: [5 C6 ~ip pim sparse-mode
ip tcp adjust-mss 1436
load-interval 30
tunnel source FastEthernet0/0
tunnel destination xxx.xxx.xxx.xxx
hold-queue 4096 in
hold-queue 4096 out
!
* W4 X: Z( V. W# ninterface FastEthernet0/0
: ^7 s8 u& X1 T) b4 Cip address xxx.xxx.xxx.xxx 255.255.255.252
$ G+ \2 B$ x+ l7 R8 lip nat outside
7 g2 K5 V1 q; X1 E( ]3 ]" v  Z$ {ip virtual-reassembly
& M8 r5 o" ~* R5 jduplex auto
speed auto
# _; ]. w' m$ Lcrypto map clientmap
!
interface Serial0/0:0
no ip address
!
interface FastEthernet0/1
8 i8 J4 S" ]) H; h4 yip address 10.10.170.1 255.255.255.192
ip pim sparse-mode
: e: @( c' D9 q2 }- [ip nat inside
% j- B2 t9 ]7 X% o+ p; Xip virtual-reassembly
ip igmp static-group 224.1.8.94
, @' c8 y; g2 \( uip igmp static-group 224.3.8.94
ip igmp static-group 224.2.8.94
- \7 Z  _0 Y6 W+ d3 J: X2 Eip igmp access-group 20
speed 100
, D( X8 S3 p, F9 q: c/ f$ n0 Kfull-duplex
" H4 r; n- v/ T; _hold-queue 4096 in
hold-queue 4096 out
!
4 }0 Z5 M; v4 M, [" `interface Virtual-Template1 type tunnel
ip unnumbered Loopback0
ip mtu 1436
3 f/ Y+ P8 h0 V8 u- m# }; hip pim sparse-mode
, ?/ v, j+ U: z, n$ [ip nat inside
, u0 c. O! S" w6 d; N! jip virtual-reassembly
+ e/ h- B  }3 Xtunnel mode ipsec ipv4
tunnel protection ipsec profile test-vti1
, W2 Q4 m4 R0 I4 k!
2 G/ u) T/ x  _5 v" hip local pool ippool 10.10.170.251 10.10.170.254
" N) Z8 q& q# z& `3 t: I# gip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx
ip route 10.0.0.0 255.0.0.0 Null0
( E4 Y$ t  t. K+ Bip route 10.9.1.0 255.255.255.0 Tunnel103
ip route 10.10.12.0 255.255.255.0 Tunnel103
ip route 10.10.80.0 255.255.255.0 Tunnel103
6 y7 B, }4 ~0 g1 Q* uip route 10.10.90.0 255.255.255.0 Tunnel103
" e# a7 H9 i# t  }ip route 10.10.118.0 255.255.255.0 Tunnel103
' B' m9 j" \2 q- q7 qip route 10.20.17.0 255.255.255.0 Tunnel103
( Y5 }5 w1 g# a5 o" d1 g$ cip route 10.50.170.0 255.255.255.0 Tunnel103
ip route 172.16.0.0 255.240.0.0 Null0
( N4 E. d- N, Z7 G- H) cip route 172.16.90.0 255.255.255.0 Tunnel103
: ~$ R( V/ n1 C  ~0 X& Bip route 172.16.110.0 255.255.255.0 Tunnel103
5 K# b3 B# \# z  _ip route 192.0.39.0 255.255.255.0 Tunnel103
ip route 192.168.0.0 255.255.0.0 Null0
6 R1 _0 l/ o( b  C6 X6 [!
!
* P+ H4 a. [( I/ ]9 pip http server
ip http authentication local
no ip http secure-server
ip pim bidir-enable
ip pim rp-address 10.50.170.1 20 bidir
no ip nat service sip udp port 5060
9 F6 I% ^; U% j2 i- J# [ip nat inside source list 1 interface FastEthernet0/0 overload
. ^2 G6 @. e4 f+ ]( l0 F!
5 b* B' o5 c  o/ Naccess-list 1 permit 10.10.170.0 0.0.0.255
access-list 20 permit 224.2.8.94
# f  z% A5 F( R$ m& r: Iaccess-list 20 permit 224.3.8.94
2 X) s" ]) G( b, ]# Q& Vaccess-list 20 permit 224.1.8.94
access-list 98 permit 10.10.90.0 0.0.0.7
access-list 98 permit 10.10.12.32 0.0.0.3
- W8 q) z8 y; Z/ J) Xaccess-list 111 permit ip 10.10.170.0 0.0.0.240 10.10.170.240 0.0.0.15
access-list 111 permit ip 10.9.1.0 0.0.0.255 10.10.170.240 0.0.0.15
access-list 111 permit ip 10.10.12.0 0.0.0.255 10.10.170.240 0.0.0.15
access-list 111 permit ip 10.10.80.0 0.0.0.255 10.10.170.240 0.0.0.15
access-list 111 permit ip 10.10.90.0 0.0.0.255 10.10.170.240 0.0.0.15
access-list 111 permit ip 10.10.118.0 0.0.0.255 10.10.170.240 0.0.0.15
' d3 j. V9 G! g" j9 p! Oaccess-list 111 permit ip 10.20.17.0 0.0.0.255 10.10.170.240 0.0.0.15
9 ?( [! I- |$ P( b! Y+ `0 y: saccess-list 111 permit ip 10.50.170.0 0.0.0.255 10.10.170.240 0.0.0.15
access-list 111 permit ip 172.16.90.0 0.0.0.255 10.10.170.240 0.0.0.15
! H# T/ q1 z1 u* y! haccess-list 111 permit ip 172.16.110.0 0.0.0.255 10.10.170.240 0.0.0.15
access-list 111 permit ip 192.0.39.0 0.0.0.255 10.10.170.240 0.0.0.15
!
!
!
: i1 A, J$ i) k3 g( [2 t( z!
1 S) u  I( t8 W( s4 W+ K0 Z!
tftp-server nvram:startup-config
& ~/ B' J' h& s0 g/ R!
, Y9 J' Y2 j! r) h( Ocontrol-plane
+ P8 z, l2 S- _. _: a: g!
!
) p/ d) y6 x- B+ G- z5 t3 p!
!
7 [( V- ~+ C: h( g0 J/ M, `7 T!
1 {4 K" F, w9 v9 D! o( G: ^" I& l!
!
) M) Q  o, x; W$ d$ o4 k!
( C, Q" c7 C' V0 [!
!
4 x3 T8 s/ q5 x& g0 Z! @9 oline con 0
1 Q( W9 ?$ h1 tpassword 7 xxx
stopbits 1
! ]8 f0 v! I1 h0 l% [! y- ~line aux 0
7 P, g1 }# g# v% xpassword 7 xxx
5 {. Z+ v. r3 K/ J; [" H9 p, vstopbits 1
line vty 0
exec-timeout 0 0
- M) q; c2 s, o+ o! Lpassword 7 xxx
+ r" L9 W3 h% ]( e$ Mline vty 1 4
exec-timeout 0 0
* a8 H0 m& w; R6 V6 j( ?password 7 xxx
!
ntp clock-period 17180624
- Z& h1 Z1 U) t7 K$ s) w3 i6 pntp server 10.3.1.1
ntp server 10.10.80.65
!
end
2 ?: ?+ z) Z. w9 M9 L' w( Z7 k8 }
: P& O3 }3 V# w9 Z! `
- P9 _: B% n  p0 ?( P877 show conf
% T8 P7 j1 P" P0 x: Q
) P3 J! P! f2 {/ l( d2 ?8 \) Z, n/ V
* q$ k  q3 b' T( @5 Fversion 12.4
no service pad
: }0 n* }" M5 u' W/ O% z: uservice timestamps debug datetime msec
; W/ Z! h1 L! b. Q; y& \service timestamps log datetime msec
no service password-encryption
2 B4 B, z, U+ F8 }+ D& m! F2 N" k. x!
1 _2 J- \, q. N6 [, o! jhostname 877
!
boot-start-marker
boot-end-marker
!
  A: e3 @" b8 @+ klogging buffered 262144 debugging
enable secret 5 xxx
!
# o, d  X/ E- j& v' ~3 o2 z( W- pno aaa new-model
!
resource policy
! w: I3 f1 q% M7 Z7 r% T) h!
* \- r* S% S2 qip cef
& p" d+ H- T6 b0 E+ t!
!
no ip dhcp use vrf connected
$ ^* n9 }& l- I$ k# d: W8 Y2 hip dhcp excluded-address 10.10.170.129
!
ip dhcp pool c877-pool
network 10.10.170.128 255.255.255.248
domain-name xxx.com
' u1 {6 M$ A" x5 U% d0 a5 h9 r% Ydns-server 10.10.90.31 192.0.39.96 192.0.39.38
: p/ c6 Q8 T1 _9 @/ I$ Inetbios-name-server 10.10.90.31 192.0.39.38
: v: m/ o4 v5 ~2 b9 o: Jdefault-router 10.10.170.129
!
!
5 S/ Q* }! Z1 G( e8 I  Ono ip domain lookup
ip multicast-routing
vpdn enable
!
!
!
1 g( m* |) |  t4 J0 @0 h# x6 n!
!
!
!
' q2 o& }2 N* t* D1 `!
!
!
. `8 H( W* B( \. e$ \2 v; m8 J!
crypto ipsec client ezvpn CLIENT
connect auto
* d; l7 v3 X: f6 P6 R. pgroup mcast_client key cisco
9 {6 T5 ?" l4 Z8 {. `mode network-extension
peer xxx.xxx.xxx.xxx
acl 100
virtual-interface 1
username xxx password xxx
+ E4 E7 }' H' U! S2 z1 v. R; Wxauth userid mode local
7 ?  u+ H$ e; N. G, }!
!
7 O, x! h8 \( M* a!
!
7 p; C/ Y* x* {' R9 B/ t!
) o6 D0 F; S5 Y+ g* Einterface Loopback0
no ip address
!
interface ATM0
no ip address
no atm ilmi-keepalive
pvc 0/35
: U( _4 g. D2 p8 Y6 v; }: Mpppoe-client dial-pool-number 1
!
" p! y! Q; g) E, R5 ibundle-enable
dsl operating-mode auto
hold-queue 224 in
) P  P( e* t$ k3 W2 S!
interface ATM0.1 point-to-point
8 f" e) K6 i, |) C* dno snmp trap link-status
; P  b* _" @! n: d0 e, q!
4 `8 h+ g/ Z% v+ O; o2 N- w8 h2 Pinterface FastEthernet0
; \2 n, I" }5 a: c0 _switchport access vlan 2
crypto ipsec client ezvpn CLIENT inside
% V7 x+ R2 x0 d+ x6 C+ _!
4 y/ `& |, `3 v2 p% e- C5 V6 ninterface FastEthernet1
$ n3 n" M- N; oswitchport access vlan 2
crypto ipsec client ezvpn CLIENT inside
- x) d; i9 l, J6 w, r0 |' b) `8 {!
7 x8 @4 D3 c' b, c! Qinterface FastEthernet2
switchport access vlan 2
8 n/ B8 j( E) Y4 _7 Kcrypto ipsec client ezvpn CLIENT inside
3 n% u3 Y1 J: F" i7 H! ]9 H- k) w!
2 F( c; z# Y6 y* Ginterface FastEthernet3
2 x5 x, F3 i" kswitchport access vlan 2
crypto ipsec client ezvpn CLIENT inside
# h1 D2 T/ d+ {( j+ K!
0 a4 x% w: H* Iinterface Virtual-Template1 type tunnel
( U" H0 r% i5 h/ M- x8 N) nno ip address
6 n1 T2 B' U9 \( Jip mtu 1436
: K, X; K9 Q7 R/ U' `  Dip pim sparse-mode
!
3 Z+ {% i/ T* W5 e, ?8 m& S* Iinterface Vlan1
9 p! b0 ^( }) b# g  bno ip address
9 U) x% c! `/ ]/ C: G* A- dip pim sparse-mode
. ^. t9 p0 T" k+ N( u, Bip igmp join-group 224.1.8.94
ip igmp join-group 224.2.8.94
) l' a) F5 |4 h' ]ip igmp join-group 224.3.8.94
crypto ipsec client ezvpn CLIENT inside
: R2 }. N9 |: q; y0 ?!
interface Vlan2
ip address 10.10.170.129 255.255.255.248
' J: z7 m! @2 ^0 |' o# Q3 pip pim sparse-mode
8 @1 P6 X7 k, C6 H& K+ L  zip igmp join-group 224.1.8.94
# t4 A  P" R, ^* D) j" uip igmp join-group 224.2.8.94
! P  ]- J- H3 zip igmp join-group 224.3.8.94
ip igmp static-group 224.1.8.94
ip igmp static-group 224.3.8.94
ip igmp static-group 224.2.8.94
  ~  B# c, `: x6 j7 ~ip igmp access-group 20
crypto ipsec client ezvpn CLIENT inside
. H' R# _8 N6 G, L5 v! \) t8 t!
interface Dialer1
ip address negotiated
9 V% g" w6 |; M/ `1 {$ u' {% S* Hip mtu 1492
5 J4 F6 {( g7 A" m& E: @! ~encapsulation ppp
dialer pool 1
, ?* c: I) n5 I0 U+ H2 c6 e7 Jppp authentication chap callin
ppp chap hostname xxxx
3 [- k. [, k* A- xppp chap password 0 xxxxx
) ~" \& [' }4 j1 mppp pap sent-username xxxx password 0 xxxx
% Y' ?6 Z" d9 E! ~* Pcrypto ipsec client ezvpn CLIENT
9 o% H4 E3 c$ E: _) v0 K!
/ r+ ^' @2 F; k- @, {$ `. aip route xxx.xxx.xxx.xxx 255.255.255.255 Dialer1
!
8 W/ C3 [2 K/ v5 c, j!
no ip http server
no ip http secure-server
ip pim bidir-enable
ip pim rp-address 10.50.170.1 20 bidir
ip nat inside source list 1 interface Dialer1 overload
! [) b$ Q+ s! \7 w, E7 D!
access-list 1 permit 10.92.1.0 0.0.0.255
# |. r" @: X* S3 e6 \access-list 20 permit 224.2.8.94
access-list 20 permit 224.3.8.94
access-list 20 permit 224.1.8.94
access-list 100 permit ip 10.10.170.128 0.0.0.7 any
access-list 101 permit ip 10.10.170.128 0.0.0.7 10.9.1.0 0.0.0.255
access-list 101 permit ip 10.10.170.128 0.0.0.7 10.10.12.0 0.0.0.255
access-list 101 permit ip 10.10.170.128 0.0.0.7 10.10.80.0 0.0.0.255
access-list 101 permit ip 10.10.170.128 0.0.0.7 10.10.90.0 0.0.0.255
access-list 101 permit ip 10.10.170.128 0.0.0.7 10.10.118.0 0.0.0.255
9 W1 l$ @( P, I! d& i2 |0 zaccess-list 101 permit ip 10.10.170.128 0.0.0.7 10.20.17.0 0.0.0.255
  i' x; W( i8 I" J6 X) maccess-list 101 permit ip 10.10.170.128 0.0.0.7 10.50.170.0 0.0.0.255
access-list 101 permit ip 10.10.170.128 0.0.0.7 172.16.90.0 0.0.0.255
/ M7 q, L2 b. _- _) q# R' I' X% Q* Caccess-list 101 permit ip 10.10.170.128 0.0.0.7 172.16.110.0 0.0.0.255
access-list 101 permit ip 10.10.170.128 0.0.0.7 192.0.39.0 0.0.0.255
dialer-list 1 protocol ip permit
!
!
!
$ o- D& V5 I8 x2 S!
control-plane
8 ?$ i/ g0 [9 q- _!
, |/ w: u3 ~" N8 h7 m!
line con 0
  o& _! a( `! C$ \0 z+ c4 m1 u& }+ Wno modem enable
) P% H8 Q4 h$ y% g; j' ]line aux 0
2 D0 P8 a- H4 E2 @7 b' v0 t7 vline vty 0 4
password xxx
1 K8 G9 R+ z; I. z) Ilogin
!
scheduler max-task-time 5000
ntp clock-period 17180579
ntp server 10.3.1.1
ntp server 10.10.80.65
end

在PC上面添加一条默认路由

相当不错，感谢无私分享精神！

学习了，不错，讲的太有道理了

看帖回帖是美德！:lol

不知该说些什么。。。。。。就是谢谢

小手一抖，金币到手！

路过，支持一下啦