设备为：pix515E（申请加精）
. I% g X) X) e: _( g$ Q, x$ _ E2 yinside接192内网，outside接外网，e2接10专网；* @, h2 j j5 O9 k, L# q; X
问题是通过vpn client拨号后，能访问192内网段，但不能访问10网段(注：192内网段可正常访问10网段)，static后还是不行。请各位高手帮忙查下原因，谢谢！* Y6 S1 m/ _! w, T6 {( s
个人认为，问题可能出在vpn拨号上来没有网关，不知道是不是？如是，请问怎样设置增加vpn的网关，谢谢！; M, M6 d: K- e, X% e4 O
配置如下：
0 o6 R9 ]7 P5 R' `! ^ P2 ^# dPIX Version 6.3(5)125. O' h0 z3 M5 @- r6 \
interface ethernet0 auto' @5 y2 r# N* @! b
interface ethernet1 auto
5 K8 Q' p; [" l3 Cinterface ethernet2 auto) G, g+ e) N0 e( A1 l1 c
interface ethernet3 auto shutdown
9 n Q/ b: i9 @" y3 X- o, C: q( D) Binterface ethernet4 auto shutdown) ?. |8 Q U' `! e8 ~7 e+ W, `
interface ethernet5 auto shutdown1 L# |% i I$ t) S' P
nameif ethernet0 outside security0* m7 v! j" v1 |, D( ]6 X3 e
nameif ethernet1 inside security100
; n3 u0 A0 Y, g% G b+ j" unameif ethernet2 intf2 security99- l$ O' G( d/ n7 r0 e0 `. X1 s
nameif ethernet3 intf3 security15' z! A! c9 c2 g. j/ M2 N, A
nameif ethernet4 intf4 security201 a/ k! [4 t6 L) J" @" Y7 Z
nameif ethernet5 intf5 security25, w* K- e/ s' J. q
enable password rEDUoAN/yFojuZRu encrypted
0 i `4 J9 \) Q K9 A6 D Apasswd 75UYEXo172hNDVOX encrypted( U% ?9 U: t6 r8 v# P+ ~
hostname zhongchuang& k }* r1 q% r) c* i
fixup protocol dns maximum-length 512
) g1 Z, C9 c. t* Sfixup protocol ftp 21
4 q' v+ o3 x7 W1 Y/ h) vfixup protocol h323 h225 1720% a$ D E# z. |- ~1 ?6 {' u2 l
fixup protocol h323 ras 1718-1719# N8 [' u4 ]3 _) K
fixup protocol http 80
8 @7 w# v( {; |3 K x. n r9 c. p& g3 ofixup protocol ils 3897 Y6 v! V* C4 ]* L* x
fixup protocol rsh 514
+ }# U3 V& g$ d* sfixup protocol rtsp 554) Q. `; w2 z- _ z r8 X
fixup protocol sip 5060- G) k2 Q \1 j3 H7 a- E
fixup protocol sip udp 5060
6 n" \1 p4 _! d! {fixup protocol skinny 20005 f" D" M1 Y+ R! j& f _
fixup protocol smtp 25 c3 W* E5 O3 n5 [9 w
fixup protocol sqlnet 1521& K. e/ c6 E* `7 U N# U3 B V
fixup protocol tftp 69
/ v0 y6 D+ [+ K" v- l' a) Onames
$ @+ T5 c6 I. @# l. Q8 }# vaccess-list vpn permit ip 192.168.0.0 255.255.255.0 172.16.0.0 255.255.255.0
! G8 a7 u7 ^) J- Daccess-list vpn permit ip 10.0.0.0 255.0.0.0 172.16.0.0 255.255.255.0
$ b8 M' T, V6 H( baccess-list intf2 permit ip any any . D& {# L5 U% f8 N) }) j
pager lines 246 {* f1 P5 [6 C& j
mtu outside 1500
% w7 g+ d% l# bmtu inside 1500
6 E2 u# z4 r; L& r& s8 Lmtu intf2 1500
' k, P& [" P* N# }5 k: ]mtu intf3 1500* {) Q2 C$ _) _" r* F# v
mtu intf4 1500
8 S( L3 u- e& m7 X6 |5 h+ b" G6 Gmtu intf5 1500. R9 x2 l: x' S$ I" N
ip address outside 221.181.162.210 255.255.255.0+ z9 e& U9 d! ~/ X& H
ip address inside 192.168.0.1 255.255.255.0
% h _( w) W/ u/ vip address intf2 10.35.152.141 255.255.255.128
, s& D- X* j; ~ `3 O6 B. `ip address intf3 127.0.0.1 255.255.255.255 I# _0 Y3 R8 s7 T* b/ Y
no ip address intf4
8 @$ d4 i9 L6 ]3 M7 `9 u6 _" nno ip address intf5
3 ~7 _/ _& A+ xip audit info action alarm
4 a8 b& V( K. u4 V8 Y( Zip audit attack action alarm
& X9 v1 B8 a; c# n- R. Gip local pool gmvpn 172.16.0.10-172.16.0.502 I' K& R4 }. ^6 @
no failover
4 P$ L8 Z! `5 Dfailover timeout 0:00:00
3 r [+ e9 s0 z5 Ufailover poll 15
Q$ J4 T, N% ^no failover ip address outside* G0 J; z2 q: S# K5 u. {
no failover ip address inside) v0 _) ?0 Y" H( O
no failover ip address intf22 {+ v. d' m- N$ h4 h3 J% O4 b4 I
no failover ip address intf3
% X/ M0 i8 Z# ino failover ip address intf4
6 H/ g% Y2 q* H: N2 jno failover ip address intf58 f. M( E7 g2 r
pdm history enable) N/ }0 D) s/ ]1 \- G8 R: r
arp timeout 144004 d# U" P7 Y2 M, G, @
global (outside) 1 interface: a2 ~& X2 @) v( |
global (intf2) 1 interface: O9 B; s& \4 S- F' |' R! M N
nat (inside) 0 access-list vpn/ \4 i9 Y a, _ R
nat (inside) 1 0.0.0.0 0.0.0.0 0 0! H2 k7 I& x: ]9 I% n8 K
static (intf2,inside) 192.168.0.101 10.40.10.68 netmask 255.255.255.255 0 0 $ ~- C* [ v- v# Z; e
static (intf2,inside) 192.168.0.102 10.32.184.54 netmask 255.255.255.255 0 0
% x4 h3 K6 a, w8 b: T! Haccess-group intf2 in interface intf20 s/ ]( g: t V) | O2 i
route outside 0.0.0.0 0.0.0.0 221.181.162.1 1
; q! }3 |5 G+ K; v+ Iroute intf2 10.0.0.0 255.0.0.0 10.35.152.129 12 q2 o; i |' Z6 L( A7 X# _
timeout xlate 3:00:00
, |! |6 A; v( ^0 R7 u qtimeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00) U8 M6 U( F" x* Y/ Z/ K2 T
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
$ z+ ~. M) F( B! Ztimeout sip-disconnect 0:02:00 sip-invite 0:03:00
& M& X% S8 m9 E$ n$ q% ] y. E( Wtimeout uauth 0:05:00 absolute; }9 D2 U% n2 {6 Y: |
aaa-server TACACS+ protocol tacacs+
) |$ m$ D2 g! F8 Q( ~. v- Q) qaaa-server TACACS+ max-failed-attempts 3
- q ^* [ R& K( x( @aaa-server TACACS+ deadtime 10
& M1 h$ r9 d; h; k$ y7 V( e7 Y% @& baaa-server RADIUS protocol radius
: T. g5 K+ {, I8 t- n' T. s8 h- Eaaa-server RADIUS max-failed-attempts 3
! S& V3 W+ O8 t. Jaaa-server RADIUS deadtime 10
1 k8 C! l3 b9 naaa-server LOCAL protocol local ( M( A' ^5 T+ e1 D; U
no snmp-server location
+ o: S) {" {2 \$ I# V! P8 Gno snmp-server contact
1 q& X5 g. c3 K- Psnmp-server community public5 c) d, j9 v7 {6 A! ~2 B2 b
no snmp-server enable traps
# a& e$ o+ j2 i9 vfloodguard enable
4 M: ?! I/ p- _; `sysopt connection permit-ipsec
& q* p2 f z. m4 X- e+ Pcrypto ipsec transform-set yzgmvpn esp-des esp-md5-hmac . D2 \- ^8 S5 \+ S; r
crypto dynamic-map chinayz 10 set transform-set yzgmvpn$ d3 \- Z* T5 J: Z6 t
crypto map yzgm 20 ipsec-isakmp dynamic chinayz' ]9 A7 L5 y" ~
crypto map yzgm client authentication LOCAL 9 Z7 A5 }! A/ ?0 ]
crypto map yzgm interface outside. d; @; R w" i0 m! Z% C9 T+ c
isakmp enable outside& S3 \, \7 u+ c( L* n, j
isakmp nat-traversal 100
/ M$ U# H, z6 t1 {6 F; R* Nisakmp policy 10 authentication pre-share8 q! X! Z. X' v5 V$ L1 G
isakmp policy 10 encryption des) i+ U& Q! N4 s9 l# L
isakmp policy 10 hash md5
/ X# N/ [/ u8 N1 S Gisakmp policy 10 group 2& r5 r; z3 [0 m
isakmp policy 10 lifetime 86400
1 a, p! y. f$ C" O7 Zvpngroup gmvpn address-pool gmvpn
! t' N: h! J. r' O! m: H# vvpngroup gmvpn split-tunnel vpn
5 ^$ X3 F( P0 Cvpngroup gmvpn idle-time 1800
& `2 G/ y- e7 C W/ b Y& h5 Uvpngroup gmvpn password ********
" r8 q; s9 C$ U* t7 Ytelnet 192.168.0.0 255.255.255.0 inside
: h& R! F& r8 {/ ~telnet timeout 5
( K1 G# R1 A, m) ]+ v; `ssh timeout 5$ z6 o& F" Q& Z0 }9 e N/ R
console timeout 0
* |/ v1 {: a& {; G- X0 bdhcpd address 192.168.0.10-192.168.0.50 inside
' M3 z4 {& E. P/ F" j! `+ T. wdhcpd dns 221.131.143.69 112.4.0.55
8 Z8 H1 U; i) x& ^4 r% B( o1 i* Odhcpd lease 360000( \' F8 ^3 X2 n% S, a
dhcpd ping_timeout 750
& Z7 W$ p9 b) ldhcpd enable inside) p: a- g% X5 q1 x
username zhongchuang015 password srI6zKtqf4nHu9Ma encrypted privilege 24 y3 B1 ~9 T( v4 s
username zhongchuang014 password 8dk7oqbV5dIBXx6e encrypted privilege 26 g9 g! Z' ?% i- t1 Y
username zhongchuang013 password rhi1utB5GXFuuJ6m encrypted privilege 2( Z7 \& r7 ^; x' ^; ^ v- u
username zhongchuang012 password bpQGsC6PBE/uelSQ encrypted privilege 2
: j6 L2 t0 Y- p+ u: l( O1 Kusername zhongchuang011 password wGg46la7QfoEN3HK encrypted privilege 2& x, o: W1 O( j, V& A0 ^
terminal width 80
5 f4 P; u8 f( U- jCryptochecksum:a915cbf2b6f8fedb476a02c0fe658c5c3 _) q* \8 k' v" t& h
: end |
|
所有IT类厂商认证考试题库下载
【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集
【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课
原创_超融合自动化运维工具cvTools
重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）
链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享
某linux大佬，积累多年的电子书(约300本)
乾颐堂现任明教教主Python完整版
乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）
Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天
约21套Python视频合集 核心基础视频教程（共310G,已压缩）
最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程
最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器
