隧道上的交通不被视为有趣

网络工程 虚拟专用网 思科-ios 网络安全
2021-07-21 21:37:40

我遇到了交通不再通过隧道的问题。

以下是我的配置,由于不允许,我无法访问另一端。我只需要确保我的配置是正确的,以便其他人继续看着他们。

当我执行以下操作时:

show crypto isakmp sa 

我得到:

peer peer QM_IDLE 2019 ACTIVE

crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
crypto isakmp key 12345678 address 111.111.111.111

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
mode tunnel
crypto ipsec df-bit clear

crypto map SDM_CMAP_1 1 ipsec-isakmp 
description Tunnel to 111.111.111.111
set peer 111.111.111.111
set transform-set ESP-3DES-SHA 
match address 100

interface Vlan1
description $FW_INSIDE$
ip address 192.168.0.1 255.255.255.0
no ip redirects
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1412

interface Dialer0
description $FW_OUTSIDE$
ip address negotiated
no ip redirects
ip mtu 1452
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap callin
ppp chap hostname me@direct.telstra.net
ppp chap password 0 123456
crypto map SDM_CMAP_1

ip nat inside source route-map SDM_RMAP_1 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0 permanent

access-list 1 permit 192.168.0.0 0.0.0.255
access-list 100 permit ip 192.168.0.0 0.0.0.255 192.168.173.0 0.0.0.255
route-map SDM_RMAP_1 permit 1

当流量落在访问列表的范围内时,我只是看不到我缺少什么,但是当我执行 show ip access=list 时,计数器不会增加。

我无法访问 192.168.173.0 网络有什么想法吗?

1个回答

好的,所以我怀疑是 NAT 问题,因为 192.168.173.0 的流量正在进入互联网。

这是确保 VPN 流量未经过 NATTED 的额外代码。

access-list 101 deny   ip 192.168.0.0 0.0.0.255 192.168.173.0 0.0.0.255
access-list 101 permit ip 192.168.0.0 0.0.0.255 any
!
route-map SDM_RMAP_1 permit 1
 match ip address 101