网络工程 - ASA anyconnect VPN 无法访问远程 LAN（内部）网络 - 吾爱随笔录

我已经为 cisco anyconnect VPN 设置了 ASA5506，我能够连接 VPN，但无法 ping 或 ssh 或任何设备到远程 lan（内部）网络 10.0.10.x/24 上的任何设备

下面是网络图：

配置：

ASA Version 9.8(2)
!
hostname asa0
enable password <secret>
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
names
ip local pool ANYCONNECT-POOL 10.0.11.1-10.0.11.254 mask 255.255.255.0

!
interface GigabitEthernet1/1
 nameif inside
 security-level 100
 ip address 10.0.10.1 255.255.255.0
!
interface GigabitEthernet1/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/6
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/7
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/8
 description Internet-ISP
 nameif outside
 security-level 0
 ip address 71.100.102.210 255.255.255.0
!
interface Management1/1
 management-only
 shutdown
 no nameif
 security-level 100
 no ip address
!
boot system disk0:/asa982-lfbff-k8.SPA
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup inside
dns server-group DefaultDNS
 name-server 10.0.10.10
 name-server 10.0.10.11
object network VPN-ANYCONNECT-SUBNET
 subnet 10.0.11.0 255.255.255.0
object-group network NET-SITE0-SUBNETS
 network-object 10.0.10.0 255.255.255.0
 network-object 10.0.11.0 255.255.255.0
object-group network NET-VPN-POOL
 network-object 10.0.11.0 255.255.255.0
access-list ANYCONNECT-ROUTES-FOO-EMPLOYEE standard permit 10.0.0.0 255.0.0.0
access-list OUTSIDE_IN extended permit icmp any any
pager lines 24
logging enable
logging timestamp
logging buffer-size 16384
logging buffered informational
logging asdm errors
mtu inside 1500
mtu outside 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 10 burst-size 5
icmp permit any outside
asdm image disk0:/asdm-741.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 32768
nat (any,outside) source static NET-VPN-POOL NET-VPN-POOL destination static NET-SITE0-SUBNETS NET-SITE0-SUBNETS
!
nat (any,outside) after-auto source dynamic NET-SITE0-SUBNETS interface
access-group OUTSIDE_IN in interface outside
route outside 0.0.0.0 0.0.0.0 71.100.102.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:01:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication login-history
http server enable
no snmp-server location
no snmp-server contact
sysopt connection tcpmss 1379
service sw-reset-button
crypto ca trustpoint FOO_Wildcard_2016
 keypair FOO_Wildcard_2016
 crl configure
crypto ca trustpoint CA_Bundle
 enrollment terminal
 crl configure
crypto ca trustpool policy
crypto ca certificate chain FOO_Wildcard_2016
 certificate 25e70b9d51d92b2c
    3082051c 30820404 a0030201 02020825 e70b9d51 d92b2c30 0d06092a 864886f7
    …
   <output omitted>
    …
    469628ad a1267d0a 09a72e04 a38dbcf8 bc043001
  quit
telnet timeout 5
ssh stricthostkeycheck
ssh 10.0.0.0 255.0.0.0 inside
ssh timeout 15
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
management-access inside

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point FOO_Wildcard outside
webvpn
 enable outside
 anyconnect image disk0:/anyconnect-win-4.5.01044-webdeploy-k9.pkg 1
 anyconnect image disk0:/anyconnect-macos-4.5.01044-webdeploy-k9.pkg 2
 anyconnect image disk0:/anyconnect-linux64-4.5.01044-webdeploy-k9.pkg 3
 anyconnect enable
 tunnel-group-list enable
 cache
  disable
 error-recovery disable
group-policy GroupPolicy_ANYCONNECT-FOO-EMPLOYEE internal
group-policy GroupPolicy_ANYCONNECT-FOO-EMPLOYEE attributes
 dns-server value 10.0.10.1 10.0.10.10
 vpn-tunnel-protocol ssl-client
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value ANYCONNECT-ROUTES-FOO-EMPLOYEE
 default-domain value FOO.com
dynamic-access-policy-record DfltAccessPolicy
tunnel-group FOO-EMPLOYEE type remote-access
tunnel-group FOO-EMPLOYEE general-attributes
 address-pool ANYCONNECT-POOL
 default-group-policy GroupPolicy_ANYCONNECT-FOO-EMPLOYEE
tunnel-group FOO-EMPLOYEE webvpn-attributes
 group-alias FOO-EMPLOYEE enable
!
class-map inspection_default
 match default-inspection-traffic
class-map NOTIMEOUT_class
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
policy-map global_policy
 class inspection_default
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
  inspect dns preset_dns_map
  inspect icmp
policy-map type inspect dns migrated_dns_map_1
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
!
service-policy global_policy global
prompt hostname context
: end

ASA anyconnect VPN 无法访问远程 LAN（内部）网络

解决方案