ASA 5505 升级后单向流量

网络工程 思科 防火墙 隧道 拆分隧道
2021-07-12 04:41:32

我希望有人能给我们一个指针，因为我们确信这是一个非常简单的错误。

我们最近在英国和美国的办公室之间使用 2 个 Cisco ASA 5505 运行 IPSec 站点到站点 VPN。两者都有 ASA 8.4.1。我们最初尝试直接升级到 9.1.5，但这导致了连接问题，我们回滚了版本和配置，并按照发行说明进行了分阶段升级。

升级前...

  • 使用 Anyconnect 远程访问美国 ASA 的美国员工。他们可以访问英国网络上的内容。英国员工从家里连接到英国 ASA 并可以访问美国网络。
  • 直接连接到英国网络的设备可以访问美国网络上的设备（通过相应 ASA 的适当静态路由位于每个设备上）。

这两款设备现在都在 9.1.5 上，但我们看到了问题。

  • UK Anyconnect 客户端和 UK 设备可以通过 VPN（ping、smtp、ssh 等）进行通信。
  • 美国 Anyconnect 客户端和美国设备可以相互通信，但不能与英国设备通信。连接只是超时。

我已经链接了下面的运行配置。感谢您提供的任何指示！

美国范围：192.168.0.0/16
英国范围：172.16.0.0/16

英国 VPN 运行配置：

!
ASA Version 9.1(5)
!
hostname ukvpn
domain-name inside.testco.com
names
ip local pool vpnips 172.16.200.151-172.16.200.200 mask 255.255.0.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
 switchport access vlan 12
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 172.16.254.7 255.255.0.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 29.135.92.8 255.255.254.0
!
interface Vlan12
 management-only
 no forward interface Vlan2
 nameif mgmt
 security-level 100
 ip address 10.0.0.35 255.0.0.0
!
boot system disk0:/asa915-k8.bin
boot system disk0:/asa913-k8.bin
ftp mode passive
clock timezone GMT/BST 0
clock summer-time GMT/BDT recurring last Sun Mar 1:00 last Sun Oct 2:00
dns domain-lookup inside
dns server-group DefaultDNS
 name-server 172.16.254.8
 name-server 192.168.254.111
 domain-name inside.testco.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj-172.16.0.0
 subnet 172.16.0.0 255.255.0.0
object network obj-192.168.0.0
 subnet 192.168.0.0 255.255.0.0
object network NETWORK_OBJ_172.16.200.128_25
 subnet 172.16.200.128 255.255.255.128
object network obj-45.99.208.8
 host 45.99.208.8
object network obj-172.16.254.8
 host 172.16.254.8
object-group network DM_INLINE_NETWORK_1
 network-object object obj-172.16.0.0
 network-object object obj-192.168.0.0
access-list outside_1_cryptomap extended permit ip 172.16.0.0 255.255.0.0 192.168.0.0 255.255.0.0
access-list outside_1_cryptomap extended permit icmp host 172.16.254.8 host 45.99.208.8
access-list outside_1_cryptomap extended permit ip host 172.16.254.8 host 65.99.209.9
access-list outside_1_cryptomap extended permit icmp host 29.135.92.8 host 192.168.254.111
access-list outside_1_cryptomap extended permit ip host 29.135.92.8 host 192.168.254.111
access-list outside_1_cryptomap extended permit ip 172.16.0.0 255.255.0.0 10.1.2.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 172.16.0.0 255.255.0.0 10.0.8.0 255.255.252.0
access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 192.168.0.0 255.255.0.0
access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 10.50.0.0 255.255.192.0
access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 10.1.2.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 10.0.8.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 172.16.0.0 255.255.0.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.101.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.102.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.105.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.200.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.254.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.50.0.0 255.255.192.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.53.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.54.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.250.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.49.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.50.0 255.255.254.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.52.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.56.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.106.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.60.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.1.2.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.140.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.141.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.8.0 255.255.252.0
access-list inside_access_in extended permit ip any4 any4
access-list inside_access_in extended permit icmp any4 any4
access-list outside_access_in extended permit ip any4 any4
access-list outside_access_in extended permit icmp any4 any4
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu mgmt 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
asdm image disk0:/asdm-733.bin
asdm location 10.0.0.0 255.0.0.0 inside
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static any any destination static NETWORK_OBJ_172.16.200.128_25 NETWORK_OBJ_172.16.200.128_25 no-proxy-arp route-lookup description mystery rule
nat (inside,any) source static obj-172.16.0.0 obj-172.16.0.0 destination static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 no-proxy-arp
!
object network obj-172.16.0.0
 nat (inside,outside) dynamic interface
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 29.135.92.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
 webvpn
  url-list value testco
  file-browsing enable
  file-entry enable
  http-proxy enable
  url-entry enable
aaa-server nt protocol nt
aaa-server nt (inside) host 172.16.254.8
 nt-auth-domain-controller dc-uk
aaa-server nt (outside) host 192.168.254.111
 nt-auth-domain-controller dc-us
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set isr-vpn-set esp-des esp-md5-hmac
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs group1
crypto map outside_map 1 set peer 45.99.208.8
crypto map outside_map 1 set ikev1 transform-set ESP-AES-256-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint ASDM_TrustPoint0
 enrollment self
 subject-name CN=ukvpn
 proxy-ldc-issuer
 crl configure
crypto ca trustpool policy
crypto ca certificate chain ASDM_TrustPoint0
 certificate aafb674d
    <removed>
  quit
crypto isakmp nat-traversal 10
crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
crypto ikev1 enable outside
crypto ikev1 ipsec-over-tcp port 10000
crypto ikev1 policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
vpn-sessiondb max-other-vpn-limit 10
vpn-sessiondb max-anyconnect-premium-or-essentials-limit 25

dhcpd address 172.16.254.100-172.16.254.150 inside
dhcpd dns 172.16.254.8 192.168.254.111 interface inside
dhcpd lease 14400 interface inside
dhcpd domain inside.testco.com interface inside
dhcpd option 3 ip 172.16.254.7 interface inside
dhcpd option 60 ip 172.16.254.11 interface inside
dhcpd enable inside
!
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ssl trust-point ASDM_TrustPoint0 inside
ssl trust-point ASDM_TrustPoint0 outside
webvpn
 enable inside
 enable outside
 anyconnect-essentials
 anyconnect image disk0:/anyconnect-win-3.1.06079-k9.pkg 1 regex "Windows NT"
 anyconnect image disk0:/anyconnect-macosx-i386-3.1.06079-k9.pkg 2 regex "Intel Mac OS X"
 anyconnect enable
 cache
  disable
group-policy DfltGrpPolicy attributes
 vpn-idle-timeout none
 vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless
 password-storage enable
 split-tunnel-network-list value testcostaffvpn_splitTunnelAcl
 webvpn
  hidden-shares visible
  activex-relay disable
  auto-signon allow uri * auth-type all
group-policy testcostaffvpn internal
group-policy testcostaffvpn attributes
 dns-server value 172.16.254.8 192.168.254.111
 vpn-access-hours none
 vpn-simultaneous-logins 4
 vpn-idle-timeout none
 vpn-session-timeout none
 vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless
 password-storage enable
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value testcostaffvpn_splitTunnelAcl
 default-domain value inside.testco.com
 split-dns value dfw1.rlocal lon1.rlocal testcopub.com testcopub.co.uk testco.com
 vlan none
 webvpn
  url-list value testco
  filter none
  http-proxy enable
  customization value DfltCustomization
  hidden-shares visible
  file-entry enable
  file-browsing enable
  url-entry enable
  auto-signon allow uri * auth-type all
tunnel-group DefaultWEBVPNGroup general-attributes
 address-pool vpnips
 authentication-server-group nt
 default-group-policy testcostaffvpn
tunnel-group testcostaffvpn type remote-access
tunnel-group testcostaffvpn general-attributes
 address-pool vpnips
 authentication-server-group nt
 default-group-policy testcostaffvpn
tunnel-group testcostaffvpn ipsec-attributes
 ikev1 pre-shared-key <removed>
 isakmp keepalive threshold 30 retry 2
tunnel-group testcostaffvpn ppp-attributes
 no authentication chap
 no authentication ms-chap-v1
 authentication ms-chap-v2
tunnel-group anyconnect type remote-access
tunnel-group anyconnect general-attributes
 address-pool vpnips
 authentication-server-group nt
 default-group-policy testcostaffvpn
tunnel-group 45.99.208.17 type ipsec-l2l
tunnel-group 45.99.208.17 ipsec-attributes
 ikev1 pre-shared-key <removed>
tunnel-group 45.99.208.8 type ipsec-l2l
tunnel-group 45.99.208.8 ipsec-attributes
 ikev1 pre-shared-key <removed>
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect rsh
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc 
  inspect xdmcp
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:838a16ab71a9de739edc27076262d7b6
: end

美国 VPN 运行配置： 

!
ASA Version 9.1(5)
!
hostname usvpn
domain-name inside.testco.com
names
ip local pool vpnips 192.168.200.151-192.168.200.200 mask 255.255.0.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
 switchport access vlan 3
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
 switchport access vlan 12
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.254.107 255.255.0.0
 ospf cost 10
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 45.99.208.8 255.255.255.224
 ospf cost 10
!
boot system disk0:/asa915-k8.bin
boot system disk0:/asa913-k8.bin
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns domain-lookup inside
dns server-group DefaultDNS
 name-server 192.168.254.111
 name-server 172.16.254.8
 domain-name inside.testco.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj-192.168.0.0
 subnet 192.168.0.0 255.255.0.0
object network obj-172.16.0.0
 subnet 172.16.0.0 255.255.0.0
object network obj-192.168.200.192
 subnet 192.168.200.192 255.255.255.224
object network NETWORK_OBJ_192.168.254.128_25
 subnet 192.168.254.128 255.255.255.128
object network obj-29.135.92.8
 host 29.135.92.8
object network obj-192.168.254.111
 host 192.168.254.111
object network obj-192.168.254.200
 host 192.168.254.200
object network obj-10.1.2.0
 subnet 10.1.2.0 255.255.255.0
object network obj-10.0.250.0
 subnet 10.0.250.0 255.255.255.0
object network obj-10.0.0.0
 subnet 10.0.0.0 255.0.0.0
 description http://www.cisco.com/en/US/docs/security/asa/asa83/upgrading/migrating.html#wp97481
object network intra
object-group network DM_INLINE_NETWORK_1
 network-object object obj-172.16.0.0
 network-object object obj-192.168.0.0
 network-object object obj-10.1.2.0
 network-object object obj-10.0.250.0
 network-object object obj-10.0.0.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 172.16.0.0 255.255.0.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 10.50.0.0 255.255.192.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 10.0.250.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 192.168.0.0 255.255.0.0 172.16.0.0 255.255.0.0
access-list outside_1_cryptomap extended permit icmp host 45.99.208.8 host 172.16.254.8
access-list outside_1_cryptomap extended permit ip host 45.99.208.8 host 172.16.254.8
access-list outside_1_cryptomap extended permit icmp host 192.168.254.111 host 29.135.92.8
access-list outside_1_cryptomap extended permit ip host 192.168.254.111 host 29.135.92.8
access-list outside_1_cryptomap extended permit ip 192.168.0.0 255.255.0.0 10.1.2.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 192.168.0.0 255.255.0.0 10.0.250.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 172.16.0.0 255.255.0.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.50.0.0 255.255.192.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.101.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.102.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.105.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.200.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.254.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.53.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.54.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.250.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.49.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.50.0 255.255.254.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.52.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.56.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.106.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.60.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.1.2.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.140.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.8.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.55.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.16.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.253.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.141.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.23.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.0.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.24.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.32.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.250.0 255.255.255.0
access-list inside_access_in extended permit ip any4 any4
access-list inside_access_in extended permit icmp any4 any4
access-list outside_access_in extended permit ip any4 any4
access-list outside_access_in extended permit icmp any4 any4
pager lines 24
logging enable
logging console warnings
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-733.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,any) source static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 destination static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 no-proxy-arp
!
object network obj-192.168.0.0
 nat (inside,outside) dynamic interface
object network obj-10.0.0.0
 nat (inside,outside) dynamic interface
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 45.99.208.1 1
route inside 10.0.0.0 255.0.0.0 192.168.49.3 1
route inside 10.0.0.0 255.255.252.0 192.168.49.3 1
route inside 10.0.8.0 255.255.252.0 192.168.49.3 1
route inside 10.0.16.0 255.255.252.0 192.168.49.3 1
route inside 10.0.24.0 255.255.252.0 192.168.49.3 1
route inside 10.0.32.0 255.255.252.0 192.168.49.3 1
route inside 10.1.2.0 255.255.255.0 192.168.49.3 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
 webvpn
  file-browsing enable
  file-entry enable
  http-proxy enable
  url-entry enable
aaa-server domain protocol nt
aaa-server domain (inside) host 192.168.254.111
 timeout 5
 nt-auth-domain-controller dc-us
aaa-server domain (outside) host 172.16.254.8
 nt-auth-domain-controller dc-uk
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA mode transport
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set isr-vpn-set esp-des esp-md5-hmac
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-256-SHA ESP-3DES-SHA
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs group1
crypto map outside_map 1 set peer 29.135.92.8
crypto map outside_map 1 set ikev1 transform-set ESP-AES-256-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint ASDM_TrustPoint0
 enrollment self
 subject-name CN=usvpn
 proxy-ldc-issuer
 crl configure
crypto ca trustpool policy
crypto ca certificate chain ASDM_TrustPoint0
 certificate f8674d
    <removed>
  quit
crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
crypto ikev1 enable outside
crypto ikev1 ipsec-over-tcp port 10000
crypto ikev1 policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
vpn-sessiondb max-anyconnect-premium-or-essentials-limit 25

dhcpd address 192.168.200.100-192.168.200.150 inside
dhcpd dns 192.168.254.111 172.16.254.8 interface inside
dhcpd lease 14400 interface inside
dhcpd domain inside.testco.com interface inside
dhcpd option 3 ip 192.168.254.107 interface inside
dhcpd option 60 ip 192.168.254.130 interface inside
dhcpd enable inside
!
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ssl trust-point ASDM_TrustPoint0 inside
ssl trust-point ASDM_TrustPoint0 outside
webvpn
 enable inside
 enable outside
 anyconnect-essentials
 anyconnect image disk0:/anyconnect-dart-win-2.5.6005-k9.pkg 1 regex "Windows NT"
 anyconnect image disk0:/anyconnect-macosx-i386-2.5.6005-k9.pkg 2 regex "Intel Mac OS X"
 anyconnect enable
 tunnel-group-list enable
 cache
  disable
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless
group-policy GroupPolicy_anyconnect internal
group-policy GroupPolicy_anyconnect attributes
 wins-server none
 dns-server value 192.168.254.111 172.16.254.8
 vpn-tunnel-protocol ssl-client
 default-domain value inside.testco.com
group-policy testcostaffvpn internal
group-policy testcostaffvpn attributes
 wins-server none
 dns-server value 192.168.254.111 172.16.254.8
 vpn-access-hours none
 vpn-simultaneous-logins 2
 vpn-idle-timeout none
 vpn-session-timeout none
 vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value testcostaffvpn_splitTunnelAcl
 default-domain value inside.testco.com
 split-dns value dfw1.rlocal lon1.rlocal testcopub.com testcopub.co.uk testco.com
 vlan none
 webvpn
  url-list none
  filter none
  http-proxy enable
  customization value DfltCustomization
  hidden-shares none
  file-entry enable
  file-browsing enable
  url-entry enable
tunnel-group DefaultRAGroup ppp-attributes
 no authentication chap
 no authentication ms-chap-v1
 authentication ms-chap-v2
tunnel-group 29.135.92.8 type ipsec-l2l
tunnel-group 29.135.92.8 ipsec-attributes
 ikev1 pre-shared-key <removed>
tunnel-group testcostaffvpn type remote-access
tunnel-group testcostaffvpn general-attributes
 address-pool vpnips
 authentication-server-group domain
 default-group-policy testcostaffvpn
tunnel-group testcostaffvpn ipsec-attributes
 ikev1 pre-shared-key <removed>
 isakmp keepalive threshold 30 retry 2
tunnel-group testcostaffvpn ppp-attributes
 no authentication chap
 no authentication ms-chap-v1
 authentication ms-chap-v2
tunnel-group anyconnect type remote-access
tunnel-group anyconnect general-attributes
 address-pool vpnips
 authentication-server-group domain
 default-group-policy testcostaffvpn
tunnel-group anyconnect webvpn-attributes
 group-alias anyconnect enable
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
hpm topN enable
Cryptochecksum:d20c924a5c39211877c10cb6e61359fe
: end
1个回答

192.168.0.0/16 在美国直连，172.16.0.0/16 在英国直连。根据运行配置，站点到站点隧道允许在 192.168.0.0/16 和 172.16.0.0/16 之间传递流量。还允许相同安全级别之间的流量。此外，您在两个防火墙上都进行了手动身份 NAT 配置。Web-vpn 配置了隧道指定的拆分隧道，并且允许使用备用地址。路由配置也正确。

所以它应该可以完美运行。

你可以在下面检查，

  1. 在 vpn 客户端机器上打印路由以查看备用位置目的地是否仅通过隧道路由。

  2. 用户尝试连接时，防火墙会记录连接日志。

  3. 调试日志以查看尝试从 vpn 客户端计算机连接时发生的加密、解密。

  4. 既然是 9.X，你能通过欺骗 VPN 客户端 IP 地址作为源从一个防火墙到另一个防火墙目标来尝试 ping tcp 吗？

例子

从英国防火墙试试这个，

ping tcp 192.168.49.3 22 源 172.16.200.152 23423

其它你可能感兴趣的问题
上一篇ZyXEL USG40 是否可以将每个 vlan 分配给一个物理端口？ 下一篇ARP 目标地址（互联网）