ASA 5505 接在内网启ipsec vpn 网关

/yl/yl

ciscoasa# show run

: Saved

:

ASA Version 8.2(5)

!

hostname ciscoasa

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface Ethernet0/0

!

interface Ethernet0/1

shutdown

!

interface Ethernet0/2

shutdown

!

interface Ethernet0/3

shutdown

!

interface Ethernet0/4

shutdown

!

interface Ethernet0/5

shutdown

!            

interface Ethernet0/6

shutdown

!

interface Ethernet0/7

shutdown

!

interface Vlan1

nameif inside

security-level 100

ip address 192.168.0.X 255.255.255.0

!

ftp mode passive

access-list no-nat extended permit ip 192.168.1.0 255.255.255.0 10.10.10.0 255.255.255.0

access-list TunnelAcl extended permit ip 192.168.1.0 255.255.255.0 any

pager lines 24

mtu inside 1500

ip local pool testpool 10.10.10.1-10.10.10.100 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

route inside 0.0.0.0 0.0.0.0 192.168.0.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set myset esp-des esp-md5-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map dyn1 10 set transform-set myset

crypto dynamic-map dyn1 10 set reverse-route

crypto dynamic-map remote-dyn-map 10 set security-association lifetime seconds 288000

crypto map mymap 10 ipsec-isakmp dynamic dyn1

crypto map mymap interface inside

crypto isakmp enable inside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash md5

group 2

lifetime 86400

crypto isakmp policy 65535

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh timeout 5

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

group-policy mis internal

group-policy mis attributes

dns-server value 202.106.0.20

vpn-tunnel-protocol IPSec

split-tunnel-policy tunnelspecified

split-tunnel-network-list value

default-domain value cisco.com.cn

username remote password Rhp7E2Qx4Uj4kyVK encrypted

username remote attributes

vpn-group-policy mis

username cisco password 3USUcOPFUiMCO4Jk encrypted

tunnel-group mis type remote-access

tunnel-group mis general-attributes

address-pool testpool

default-group-policy mis

tunnel-group mis ipsec-attributes

pre-shared-key *****

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny  

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip  

  inspect xdmcp

!

service-policy global_policy global

prompt hostname context

call-home reporting anonymous prompt 2

call-home

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:be9b3ac2862b8087cfd35a6473b59eeb

: end         

外网能拨上vpn 但是不能访问内网的服务器

lvzhe1216

lvzhe1216

lvzhe1216