Исходное сообщение
"VPN ASA 5510 + Cisco VPN Client (не ходят пакеты во внутрь)" Отправлено AlexeySV, 14-Ноя-08 11:31
Сильно не пинайте! Первый раз держу в руках данное железо. Схема такая:                             внешняя сеть                            /      внутренняя сеть                                                                        / [PC1: WinXP+Cisco VPN Client]-------         ------------[ASA]/---------   --[PC2: WinXP] дин.адрес от пров-ра yyy.yyy.yyy.yyy         xxx.xxx.xxx.xxx /10.0.0.144   10.0.0.143 адрес с дин.пула АСЫ 192.168.50.1                           / Ситуация такая: PC1 подключается к АСЕ через VPN клиента, получает адрес с динамического пула. Но пакеты не ходят даже на внутренний интерфейс АСЫ (10.0.0.144). Помогите разобраться. Заранее спасибо! ASA Version 8.0(3) ! hostname ASA-VPN-Srv domain-name test.db enable password rgsrgsrgsergsrg encrypted names name 192.168.50.0 RemoteUSER dns-guard ! interface Ethernet0/0 nameif inside security-level 100 ip address 10.0.0.144 255.255.255.0 no igmp ospf cost 10 ! interface Ethernet0/1 description VPN nameif outside security-level 0 ip address xxx.xxx.xxx.xxx no igmp ospf cost 10 ! passwd efsfeesfsefsefsef encrypted boot system disk0:/asa803-k8.bin ftp mode passive clock timezone BDT 6 dns server-group DefaultDNS domain-name test.db access-list inside_access_out extended permit object-group DM_INLINE_PROTOCOL_1 10.0.0.0 255.255.255.0 RemoteUSER 255.255.255.0 access-list outside_nat_static extended permit icmp RemoteUSER 255.255.255.0 10.0.0.0 255.255.255.0 access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_2 RemoteUSER 255.255.255.0 10.0.0.0 255.255.255.0 access-list outside_cryptomap_65535.65535 extended permit object-group DM_INLINE_PROTOCOL_5 any any pager lines 24 logging enable logging asdm informational mtu inside 1500 mtu outside 1500 mtu management 1500 ip local pool Remote-IP-POOL 192.168.50.1-192.168.50.50 mask 255.255.255.0 icmp unreachable rate-limit 1 burst-size 1 icmp permit any inside icmp permit any outside asdm image disk0:/asdm-603.bin no asdm history enable arp timeout 14400 global (inside) 1 interface static (outside,inside) 10.0.0.0  access-list outside_nat_static access-group inside_access_out out interface inside access-group outside_access_in in interface outside dynamic-access-policy-record DfltAccessPolicy aaa authentication ssh console LOCAL aaa authentication telnet console LOCAL http server enable no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 match address outside_cryptomap_65535.65535 crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-3DES-SHA ESP-3DES-MD5 ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-DES-SHA ESP-DES-MD5 TRANS_ESP_3DES_MD5 crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map outside_map interface outside crypto map ATM_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto map outside-ATM-INET_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP crypto ca server shutdown issuer-name CN = ASA-VPN-Srv.segment.dn crypto isakmp enable outside crypto isakmp policy 5 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 crypto isakmp policy 10 authentication pre-share encryption des hash sha group 2 lifetime 86400 crypto isakmp policy 20 authentication pre-share encryption aes hash sha group 2 lifetime 86400 crypto isakmp policy 30 authentication pre-share encryption 3des hash md5 group 2 lifetime 86400 no vpn-addr-assign aaa no vpn-addr-assign dhcp telnet timeout 5 ssh timeout 5 console timeout 0 threat-detection basic-threat threat-detection statistics ssl encryption des-sha1 rc4-md5 rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1 webvpn enable outside group-policy ATM internal group-policy ATM attributes vpn-tunnel-protocol IPSec password-storage enable group-lock value ATM pfs enable address-pools value Remote-IP-POOL username atmuser password jfsdkjfkfsdfs encrypted privilege 0 username atmuser attributes vpn-group-policy ATM tunnel-group DefaultRAGroup ipsec-attributes pre-shared-key * tunnel-group DefaultRAGroup ppp-attributes authentication pap authentication ms-chap-v2 authentication eap-proxy tunnel-group ATM type remote-access tunnel-group ATM general-attributes address-pool (outside) Remote-IP-POOL address-pool Remote-IP-POOL default-group-policy ATM tunnel-group ATM ipsec-attributes pre-shared-key *