网络工程 - 如何在IOS路由器和Android手机之间配置Cisco远程访问IPSEC VPN - 吾爱随笔录

我有一个带有 IOS 15.4 的 C891FW 路由器，我正在尝试为 Android 的本机 VPN 客户端配置远程访问 VPN。我正在使用 RSA-Sig 和 XAUTH 进行身份验证。隧道形成，但我无法访问任何内部资源，也无法通过隧道访问Internet。任何可能出错的帮助将不胜感激！

我删除了我认为不相关或敏感的部分配置。

!
hostname Skynet
enable secret 5 xxxxx
!
aaa new-model
!
!
aaa authentication login local_auth local
aaa authentication login ClientAuth local
aaa authorization console
aaa authorization exec local_auth local
aaa authorization network local_auth local
aaa authorization network ClientAuth local
!
!
!
aaa session-id common
clock timezone CET 1 0
clock summer-time CET recurring last Sun Mar 2:00 last Sun Oct 3:00
!
crypto pki trustpoint vpn-tp
 usage ike
 revocation-check none
 rsakeypair vpn-tp
!
!
crypto pki certificate chain vpn-tp
 certificate 01
          xxx
quit
 certificate ca 00EC7044BAD01A044F
          xxx
quit
no ip source-route
no ip gratuitous-arps
!
!
!
ip cef
!
!
!
username jimmy privilege 15 secret 5 xxxx
username vpnuser privilege 0 secret 5 xxxx
!
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
ip ssh dh min size 4096
!
!
crypto isakmp policy 3
 encr aes
 group 2
crypto isakmp identity dn
!
crypto isakmp client configuration group <group>
 key <secret key>
 dns y.y.y.y
 pool dynpool
 include-local-lan
 netmask 255.255.255.0
crypto isakmp profile IKE-PROFILE
   ca trust-point vpn-tp
   match identity group <group>
   client authentication list ClientAuth
   isakmp authorization list ClientAuth
   client configuration address initiate
   client configuration address respond
   virtual-template 1
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-aes 256 esp-sha-hmac
 mode tunnel
!
crypto ipsec profile IPSEC_PROFILE1
 set transform-set ESP-3DES-SHA
 set isakmp-profile IKE-PROFILE
!
!
interface GigabitEthernet8
 ip address dhcp client-id FastEthernet0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nbar protocol-discovery
 ip nat outside
 ip virtual-reassembly in
 ip verify unicast source reachable-via rx allow-default 100
 duplex auto
 speed auto
 no cdp enable
!
interface Virtual-Template1 type tunnel
 ip unnumbered GigabitEthernet8
 no ip unreachables
 ip nat inside
 ip virtual-reassembly in
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile IPSEC_PROFILE1
!
interface Vlan1
 ip address 10.0.0.1 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat inside
 ip virtual-reassembly in
!
!
ip local pool dynpool 192.168.0.100 192.168.0.101 recycle delay 1
!
!
ip pim bidir-enable
ip nat inside source list NAT2 interface GigabitEthernet8 overload
ip route 0.0.0.0 0.0.0.0 GigabitEthernet8
!
ip access-list standard ANY
 permit any
ip access-list standard Deny_RFC1918
 deny   10.0.0.0 0.255.255.255
 deny   172.16.0.0 0.15.255.255
 deny   192.168.0.0 0.0.255.255
 permit any
!
ip access-list extended NAT2
 deny   ip 10.0.0.0 0.0.0.255 host 192.168.0.100
 deny   ip 10.0.0.0 0.0.0.255 host 192.168.0.101
 permit ip 10.0.0.0 0.0.0.255 any
 permit ip 192.168.0.0 0.0.0.255 any

!