Настройка Cisco оборудования - [119] :: В помощь системному администратору

Всем привет. В одну организацию поставили Cisco ASA 5505, настроили VPN, открыли нужные порты и вроде бы все хорошо. Но возникла проблема такого рода: пользователи из своей сети (172.31.1.0/24)хотят при переходе по внешнему IP (1.1.1.1), попадать на сервер (172.31.1.1). В интернет куча статей по этому вопросу, но к сожалению ни одна не помогла. Версия IOS - 8.2. Кто-нибудь сталкивался с подобными вещами?
Приведу часть конфигурации:!
interface Vlan1
nameif inside
security-level 100
ip address 172.31.1.5 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 1.1.1.1 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
same-security-traffic permit intra-interface
object-group network VPN-USERS
network-object 172.31.1.0 255.255.255.0
access-list ACL_WAN_IN extended permit icmp any any
access-list ACL_WAN_IN extended permit tcp any interface outside eq ftp
access-list ACL_WAN_IN extended permit tcp any interface outside eq ftp-data
access-list ACL_WAN_IN extended permit tcp any interface outside eq https
access-list ACL_WAN_IN extended permit tcp any interface outside eq smtp
access-list ACL_WAN_IN extended permit tcp any interface outside eq 2525
access-list ACL_WAN_IN extended permit tcp any interface outside eq www
access-list ACL_LAN_IN extended permit icmp any any
access-list ACL_LAN_IN extended permit tcp 172.31.1.0 255.255.255.0 any
access-list ACL_LAN_IN extended permit udp 172.31.1.0 255.255.255.0 any
access-list ACL_NO_NAT extended permit ip any object-group VPN-USERS
access-list MG_SPLIT standard permit 172.31.1.0 255.255.255.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool VPNCL 172.31.1.100-172.31.1.125 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
no asdm history enable
arp timeout 14400
global (inside) 1 interface
global (outside) 1 interface
nat (inside) 0 access-list ACL_NO_NAT
nat (inside) 1 172.31.1.0 255.255.255.0
static (inside,outside) tcp interface ftp 172.31.1.1 ftp netmask 255.255.255.255
static (inside,outside) tcp interface ftp-data 172.31.1.1 ftp-data netmask 255.255.255.255
static (inside,outside) tcp interface smtp 172.31.1.1 smtp netmask 255.255.255.255
static (inside,outside) tcp interface 2525 172.31.1.1 2525 netmask 255.255.255.255
static (inside,outside) tcp interface https 172.31.1.1 https netmask 255.255.255.255
static (inside,outside) tcp interface www 172.31.1.1 www netmask 255.255.255.255
static (inside,inside) 1.1.1.1 172.31.1.1 netmask 255.255.255.255
access-group ACL_WAN_IN in interface outside
route outside 0.0.0.0 0.0.0.0 1.1.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
http server enable
http 172.31.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set VPN-SET esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map VPN-CRYPTO 10 set transform-set VPN-SET
crypto map VPN-MAP 65535 ipsec-isakmp dynamic VPN-CRYPTO
crypto map VPN-MAP interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 172.31.1.0 255.255.255.0 inside
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy MG internal
group-policy MG attributes
dns-server value 172.31.1.1
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value MG_SPLIT

Вывод packet-tracer:

packet-tracer input inside tcp 172.31.1.10 ftp 1.1.1.1 ftp

Phase: 1
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow

Phase: 2
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
static (inside,inside) 1.1.1.1 172.31.1.1 netmask 255.255.255.255
match ip inside host 172.31.1.1 inside any
static translation to 1.1.1.1
translate_hits = 0, untranslate_hits = 114
Additional Information:
NAT divert to egress interface inside
Untranslate 1.1.1.1/0 to 172.31.1.1/0 using netmask 255.255.255.255

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: INSPECT
Subtype: inspect-ftp
Result: ALLOW
Config:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect ftp
service-policy global_policy global
Additional Information:

Phase: 6
Type: NAT-EXEMPT
Subtype:
Result: ALLOW
Config:
match ip inside any inside 172.31.1.0 255.255.255.0
NAT exempt
translate_hits = 244, untranslate_hits = 120
Additional Information:

Phase: 7
Type: NAT-EXEMPT
Subtype: rpf-check
Result: DROP
Config:
match ip inside any inside 172.31.1.0 255.255.255.0
NAT exempt
translate_hits = 244, untranslate_hits = 120
Additional Information:

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Модерирует : lynx, Crash_Master, dg, emx, ShriEkeR
Версия для печати • Подписаться • Добавить в закладки
Страницы: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169