>Конфиг можно посмотреть? PIX Version 7.0(4)
!
names
!
interface Ethernet0
speed 100
duplex full
nameif outside
security-level 0
ip address WAN_IF_IP 255.255.255.248
!
interface Ethernet1
nameif inside
security-level 100
ip address LAN_IF_IP 255.255.255.0
!
interface Ethernet2
nameif dmz
security-level 50
ip address DMZ_IF_IP 255.255.255.0
!
passwd xxxxx encrypted
...
same-security-traffic permit intra-interface
object-group service PORTS_MAIL tcp
...
object-group service PORTS_WEB tcp
...
object-group network NET_IP_SEC
network-object 10.1.1.0 255.255.255.0
network-object 10.2.2.0 255.255.255.0
network-object 10.3.3.0 255.255.255.0
object-group protocol PROTO_DMZ
protocol-object icmp
protocol-object tcp
protocol-object ip
object-group protocol PROTO_LAN
protocol-object icmp
protocol-object tcp
protocol-object ip
access-list ACL_WAN_IN extended permit icmp any any
access-list ACL_WAN_IN extended permit tcp any host WAN_IP_1 object-group PORTS_MAIL
access-list ACL_WAN_IN extended permit tcp any host WAN_IP_2 object-group PORTS_WEB
access-list ACL_NO_NAT extended permit ip LAN_NET.0 255.255.255.0 DMZ_NET.0 255.255.255.0
access-list ACL_NO_NAT extended permit ip LAN_NET.0 255.255.255.0 object-group NET_IP_SEC
access-list ACL_NO_NAT extended permit ip DMZ_VPN.0 255.255.255.0 object-group NET_IP_SEC
access-list ACL_IP_SEC extended permit ip LAN_NET.0 255.255.255.0 object-group NET_IP_SEC
access-list ACL_IP_SEC extended permit ip DMZ_VPN.0 255.255.255.0 object-group NET_IP_SEC
access-list ACL_DMZ_IN extended permit object-group PROTO_DMZ any any
access-list ACL_LAN_IN extended permit object-group PROTO_LAN any any
access-list outside_cryptomap_dyn_20 extended permit ip any DMZ_VPN.0 255.255.255.0
pager lines 50
ip local pool RA_1 DMZ_VPN.17-DMZ_VPN.22 mask 255.255.255.248
ip local pool RA_2 DMZ_VPN.2-DMZ_VPN.14 mask 255.255.255.240
ip verify reverse-path interface inside
ip verify reverse-path interface dmz
icmp permit any outside
icmp permit any inside
icmp permit any dmz
...
global (outside) 1 interface
nat (inside) 0 access-list ACL_NO_NAT
nat (inside) 1 LAN_NET.0 255.255.255.0
nat (dmz) 1 DMZ_NET.0 255.255.255.0
...
access-group ACL_WAN_IN in interface outside
access-group ACL_LAN_IN in interface inside
access-group ACL_DMZ_IN in interface dmz
route outside 0.0.0.0 0.0.0.0 WAN_UP_ADDR 1
...
group-policy RA_2 internal
group-policy RA_2 attributes
dns-server value WAN_DNS_ADDR
group-policy RA_1 internal
group-policy RA_1 attributes
vpn-simultaneous-logins 2
username ra_hw_mss_2 password xxxxx encrypted privilege 7
username ra_hw_mss_2 attributes
vpn-group-policy RA_1
username ra_hw_mss_1 password xxxxx encrypted privilege 7
username ra_hw_mss_1 attributes
vpn-group-policy RA_1
...
sysopt noproxyarp inside
no service password-recovery
...all crypto & isakmp command ripped...
tunnel-group IPSEC_OTHER_SIDE_ADDR type ipsec-l2l
tunnel-group IPSEC_OTHER_SIDE_ADDR ipsec-attributes
pre-shared-key xxxxx
tunnel-group RA_2 type ipsec-ra
tunnel-group RA_2 general-attributes
address-pool RA_2
default-group-policy RA_2
tunnel-group RA_2 ipsec-attributes
pre-shared-key xxxxx
tunnel-group RA_1 type ipsec-ra
tunnel-group RA_1 general-attributes
address-pool RA_1
default-group-policy RA_1
tunnel-group RA_1 ipsec-attributes
pre-shared-key xxxxx
telnet LAN_NET.0 255.255.255.0 inside
telnet timeout 20
ssh timeout 5
console timeout 0
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect pptp
!
service-policy global_policy global
: end
Добавление в листы ниже команд для пропускания icmp трафика в туннель не помогло (
access-list ACL_NO_NAT extended permit icmp DMZ_VPN.0 255.255.255.0 object-group NET_IP_SEC
access-list ACL_IP_SEC extended permit icmp DMZ_VPN.0 255.255.255.0 object-group NET_IP_SEC
