在线等，求助VPN问题

大家好，请教一下，我这边用cisco 5505 配置了一个vpn 然后现在发现，使用client能正常拨入公司网络，但是客户机不能上互联网了，不晓得是什么原因，谢谢大家啦！配置如下
! o6 Z1 E1 c* W6 `! D4 Q
7 Z$ [. S* S3 ]$ ?/ UASA5505# sho run
& L8 l9 p; r, `+ y4 `) ~9 t: Saved
:
" l9 x7 l1 s. D+ ?( WASA Version 8.2(1)
  W( ~) V, H5 r8 a4 d: o!
* ^' A5 f& e- `! [hostname ASA5505
: w. v* F5 @! [) q0 Yenable password u2sZfN.nFilnS5wX encrypted
passwd u2sZfN.nFilnS5wX encrypted
* U3 m+ @, D6 jnames
!
interface Vlan1
8 V  [$ a8 G. a+ X: Y$ L" t7 A3 l5 u+ _) n nameif inside
security-level 100
  z* R' i) i$ K ip address 192.168.1.1 255.255.255.0
!
$ s9 C, u2 Q# L) {& B, @interface Vlan2
nameif outside
security-level 0
- O& z- G8 L1 f3 j0 U5 H1 h5 D ip address 211.99.9.246 255.255.255.128
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
- x1 z0 M& q' o( K* E/ c- ]) e; _!
interface Ethernet0/2
3 a( [5 `+ `. @1 q!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
, A# @/ m+ U6 d8 |!
9 ]7 ~; S6 r& \6 _. \interface Ethernet0/7
5 \0 i: e+ E# ?+ ^4 o!
4 N# R4 ^1 {2 R3 w( G# vftp mode passive
7 X/ ]$ b9 u( i! Oclock timezone CST 8
1 [% [( n3 S* }1 }3 Daccess-list no-nat extended permit ip 192.168.1.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list per_icmp extended permit icmp any any
access-list 100 extended permit tcp any host 211.99.9.246 eq smtp
access-list 100 extended permit tcp any host 211.99.9.246 eq pop3
pager lines 24
' h' Y0 w1 U9 L1 ]' m" f, Rlogging asdm informational
3 D; }( B# y; {% K7 o$ [mtu inside 1500
: R1 z/ v2 ]2 [& [mtu outside 1500
ip local pool VPNpool 192.168.1.100-192.168.1.200
+ t( _( l: L- p0 C9 v7 eicmp unreachable rate-limit 1 burst-size 1
* I3 R* t1 p9 s. w' w- l) _no asdm history enable
) v/ \( l$ ~) w) {arp timeout 14400
global (outside) 1 interface
; [' j) |3 M5 `8 v& E) H2 M0 Wnat (inside) 0 access-list no-nat
6 {7 ?; y- Q0 _$ w/ K( [6 f! xnat (inside) 1 0.0.0.0 0.0.0.0
8 }% x9 E& b' Q+ P$ C% B! ostatic (inside,outside) tcp interface smtp 192.168.1.88 smtp netmask 255.255.255.255
  F/ U$ z. H* xstatic (inside,outside) tcp interface pop3 192.168.1.88 pop3 netmask 255.255.255.255
access-group 100 in interface outside
  `) m- A* @) {" n. N; Iroute outside 0.0.0.0 0.0.0.0 211.99.9.129 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
9 {) B4 g+ q1 P/ G% ytimeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
, Z! [: j( A1 `- I4 Xtimeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
9 W5 }9 h4 @. u0 u5 J1 Q/ |& B, whttp server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
5 B7 w3 [3 f/ w% C! ]% hcrypto ipsec transform-set TranSet esp-3des esp-md5-hmac
- @9 L' r$ g+ A1 Ocrypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map dyn1 1 set transform-set TranSet
crypto dynamic-map dyn1 1 set reverse-route
) g2 V, k$ o; w, B0 d1 A  pcrypto map mymap 1 ipsec-isakmp dynamic dyn1
2 p) }8 C+ H# J" O  {4 Lcrypto map mymap interface outside
crypto isakmp enable outside
* ?) O: Q5 \4 h7 Ocrypto isakmp policy 1
) T$ O" u7 J0 S, [: d; Q authentication pre-share
+ }- A, u3 e  m! P encryption 3des
3 T! J4 w7 S3 w! [ hash sha
3 C  T3 L# B" ?7 T. o group 2
5 @, T5 _0 z' ]9 w  h' j# q! I lifetime 43200
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 outside
# P6 Q# q& `2 x' W9 r2 cssh timeout 5
console timeout 0
dhcpd dns 202.106.0.20 219.141.136.10
dhcpd auto_config outside
9 o; V9 e- L: o* ?!
, a& B2 g8 e: J: @% p- a7 Jdhcpd address 192.168.1.2-192.168.1.99 inside
dhcpd enable inside
% c$ p6 ^) z! M!

+ Z- Z5 U* Z$ B; s0 Othreat-detection basic-threat
threat-detection statistics access-list
( p* U. _$ Z- p- ^no threat-detection statistics tcp-intercept
" k4 o6 m& K* }. @% h/ \2 S# Kwebvpn
username yinbin.wei password LP.6xEmPfbaW7vOU encrypted
username xin.meng password 4K/R640Cy6rniQN. encrypted
' y: w2 b( U: J8 k4 ?6 Uusername duo.xu password jszrg6J8Qyz5TQUg encrypted
( ~1 G- E2 t2 h8 u, X5 W7 ~username xin.zhou password LcbaOY75jxbi4Obb encrypted
' O5 `/ H2 l5 y4 Busername guang.chen password cPWFSFk6L7Nfp4nu encrypted
' F- o, Z  o9 dusername jia.you password 0lK2vtU4iyd4rxfz encrypted
9 j6 c1 F2 \- P, h* U4 _username michael.bo password lB/q1rJle4e8d991 encrypted
+ p6 `- X$ S$ V: c6 d. C! Susername yanxiu.li password GiF7Q.vqfUR5bO8I encrypted
0 R) ?. S8 e: K/ cusername dolby password SfEkTLTdhMmZJ2NB encrypted
) ?2 L4 r- U+ N8 m( E$ Nusername xuefeng.wang password ciMb/gpmtn/o1k.e encrypted
) P2 H1 p- ~( j: v" iusername ygds password L7lB8F6PS7TdgCHU encrypted
tunnel-group VPNgroup type remote-access
tunnel-group VPNgroup general-attributes
( X+ j4 e7 l" _3 H* ? address-pool VPNpool
2 y$ Q/ ^' h0 L% o! O- N7 f, n6 Stunnel-group VPNgroup ipsec-attributes
pre-shared-key *
!
!
# n/ V+ d! M% Y+ Z* J  j5 c( |prompt hostname context
/ O4 p) T  T5 l* x( {Cryptochecksum:216114785cc29d8b1fcd28edbc171aab
, u9 O4 x) N: P9 g" l5 A+ v: end
ASA5505#

大家好，请教一下，我这边用cisco 5505 配置了一个vpn 然后现在发现，使用client能正常拨入公司网络，但是客户机不能上互联网了，不晓得是什么原因，谢谢大家啦！配置如下
3 \! f1 b5 i, g; m( E' ?, u. N
ASA5505# sho run
: Saved
0 u- {! t* i3 ^:
ASA Version 8.2(1)
!
hostname ASA5505
enable password u2sZfN.nFilnS5wX encrypted
1 K. n1 c' p; @" C" Cpasswd u2sZfN.nFilnS5wX encrypted
5 j9 ~0 j% w) S, J# hnames
!
# m- `. F5 ^/ z; A/ ?2 a  b* _4 @interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
% Y9 j! ]& @7 H/ R) m!
+ P1 M6 a$ {% q8 i) a$ a. Vinterface Vlan2
nameif outside
security-level 0
3 M0 J/ K% e+ @* V ip address 211.99.9.246 255.255.255.128
' V) D7 }) ?' _9 w!
) X: p1 k# Z) w8 C: Vinterface Ethernet0/0
* e- L* l7 P" O4 ]- H: { switchport access vlan 2
* I- m! @1 ^( j: v# `/ B5 O0 P# b!
interface Ethernet0/1
7 \3 C5 V" N# ^% B  t" }!
& L: a7 V; k$ ?$ a2 I" R. {interface Ethernet0/2
/ K8 r3 _# x/ G& c( v$ {* B!
; [, s, v2 G8 w. a2 J; V! l6 r  r9 linterface Ethernet0/3
!
interface Ethernet0/4
!
1 F( q. }* W5 T9 n& }3 Rinterface Ethernet0/5
& N& D4 \5 c. m# j!
" R( U0 e1 O( H6 R) R2 v/ A2 ~  B& ?interface Ethernet0/6
$ t/ ]9 N* \. ]! o!
interface Ethernet0/7
7 q- s6 h! [# ^! R- z!
ftp mode passive
clock timezone CST 8
access-list no-nat extended permit ip 192.168.1.0 255.255.255.0 192.168.1.0 255.255.255.0
) F  v( h+ @" I, Kaccess-list per_icmp extended permit icmp any any
5 R* e% w3 o! F& baccess-list 100 extended permit tcp any host 211.99.9.246 eq smtp
access-list 100 extended permit tcp any host 211.99.9.246 eq pop3
pager lines 24
logging asdm informational
mtu inside 1500
2 \' e1 @4 K& Pmtu outside 1500
ip local pool VPNpool 192.168.1.100-192.168.1.200
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
% _: f: ^, L' P! @arp timeout 14400
1 _/ i8 X( v1 }  l# ^9 J6 }global (outside) 1 interface
7 r9 h& Y! x+ ]. Enat (inside) 0 access-list no-nat
, U7 p5 I$ @+ C% R0 qnat (inside) 1 0.0.0.0 0.0.0.0
. s0 p1 s! ^" dstatic (inside,outside) tcp interface smtp 192.168.1.88 smtp netmask 255.255.255.255
static (inside,outside) tcp interface pop3 192.168.1.88 pop3 netmask 255.255.255.255
' f, y& k% w& ~, maccess-group 100 in interface outside
  i. P4 l8 n1 d- |' Z( X' U9 Oroute outside 0.0.0.0 0.0.0.0 211.99.9.129 1
) t2 b8 Y$ Z, [4 I+ k& N8 ~timeout xlate 3:00:00
- w/ y6 U7 k0 v8 V+ |- H3 ~; @timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
' P* t" h, c1 `! x6 ctimeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
+ E! A9 E: g/ xtimeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
! Q$ G6 C3 G3 R% Z9 ]8 s. ]timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
9 r  i: I7 N3 q$ v* I9 Lhttp 192.168.1.0 255.255.255.0 inside
no snmp-server location
, |$ b. C$ x% Y7 ]( ~0 P, v) c7 a( Gno snmp-server contact
6 W- S1 `% s$ d% q+ Csnmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set TranSet esp-3des esp-md5-hmac
( O# ~  T% h: E( _crypto ipsec security-association lifetime seconds 28800
) W$ ?% z/ p5 c6 a, _& U. @' z) K/ Q, U6 Tcrypto ipsec security-association lifetime kilobytes 4608000
) l9 i; S! i1 S" R( g  o% `crypto dynamic-map dyn1 1 set transform-set TranSet
crypto dynamic-map dyn1 1 set reverse-route
" V# u. B$ G* u. w* V( A# X3 q" pcrypto map mymap 1 ipsec-isakmp dynamic dyn1
crypto map mymap interface outside
) ]) ~) [5 z2 ]8 o: kcrypto isakmp enable outside
crypto isakmp policy 1
authentication pre-share
encryption 3des
  s; q2 H9 q7 L- Z; Y6 _3 y- n hash sha
group 2
lifetime 43200
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
4 E) K* u! L) E' m$ w7 ~ssh 0.0.0.0 0.0.0.0 outside
, z3 S) s1 F0 a4 lssh timeout 5
console timeout 0
dhcpd dns 202.106.0.20 219.141.136.10
dhcpd auto_config outside
$ H; Q- P$ h) y2 |8 e8 l: m4 |!
dhcpd address 192.168.1.2-192.168.1.99 inside
dhcpd enable inside
!

threat-detection basic-threat
threat-detection statistics access-list
8 B; X9 k9 E0 R$ r5 o( Qno threat-detection statistics tcp-intercept
- f! U* }/ ]; S) k+ l% f9 d9 T0 lwebvpn
username yinbin.wei password LP.6xEmPfbaW7vOU encrypted
& i* c7 y" ]# L4 u; ~- @- n8 susername xin.meng password 4K/R640Cy6rniQN. encrypted
username duo.xu password jszrg6J8Qyz5TQUg encrypted
9 L0 Q" Y+ }2 Y4 t) I; E0 ?7 P% Busername xin.zhou password LcbaOY75jxbi4Obb encrypted
/ x# z) s2 z, {3 k' D3 p4 lusername guang.chen password cPWFSFk6L7Nfp4nu encrypted
4 p# B- x. |, t- V. Fusername jia.you password 0lK2vtU4iyd4rxfz encrypted
2 `$ |# |0 a6 cusername michael.bo password lB/q1rJle4e8d991 encrypted
3 O( K9 y; p" L6 G# j/ B7 Iusername yanxiu.li password GiF7Q.vqfUR5bO8I encrypted
7 j% j/ m) J$ dusername dolby password SfEkTLTdhMmZJ2NB encrypted
/ A3 D7 n/ N* e+ s  vusername xuefeng.wang password ciMb/gpmtn/o1k.e encrypted
) s5 r4 P7 e$ g6 o: e7 Iusername ygds password L7lB8F6PS7TdgCHU encrypted
tunnel-group VPNgroup type remote-access
tunnel-group VPNgroup general-attributes
address-pool VPNpool
tunnel-group VPNgroup ipsec-attributes
pre-shared-key *
!
& b( V. G% r9 ?1 r3 q!
prompt hostname context
Cryptochecksum:216114785cc29d8b1fcd28edbc171aab
: end
8 C& Y2 M; u% |& Z# @% PASA5505#

看不懂呀。

加个隧道分离技术，就可以解决你这个问题

你做的是ipsec vpn吧，这样的话只有手动的在电脑里面添加路由表

默认情况下! 你电脑如果用普通的vpn拨号进入.所有路由会指向新的vpn网关

那么意味着.你的vpn网关不能上网.那么你的客户机就不能上网!
5 j$ f& l6 j, ~9 j- \# Y
还有.你的vpn设备有没有分配地址给客户端.分配的地址是否做过nat 这都是影响你拨入后能不能上网的因素

学习了，谢谢分享、、、

没看完~~~~~~ 先顶，好同志

不错不错，楼主您辛苦了。。。