ご相談です。
Cisco 841Mを利用しており、今回VPNの設定を追加し外部からこのNWに入り、インターネットに出ていきたいです。
そこでVPN設定⇒ユーザ作成などを実施しました。
現状、このNWに外部から繋ぐことは出来るのですが、インターネットに出ていきません。
様々なサイトを参考にしたのですが変わらず。
下記configです。
どこを改善すれば外部NWからVPN経由でインターネット閲覧できるようになるかご教示いただけないでしょうか。
====================
hostname AAAAAAA
!
boot-start-marker
boot-end-marker
!
!
logging buffered 51200 warnings
!
aaa new-model
!
!
aaa authentication login local_access local
aaa authentication ppp default local
aaa authentication ppp VPDN_AUTH local
!
!
!
!
(省略)
!
!
ip dhcp excluded-address XXX.XXX.XXX.XXX
!
ip dhcp pool dev-team
import all
network XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX
default-router XXX.XXX.XXX.XXX
dns-server XXX.XXX.XXX.XXX YYY.YYY.YYY.YYY
lease 7
!
!
!
no ip domain lookup
ip domain name yourdomain.com
ip inspect log drop-pkt
ip inspect audit-trail
ip inspect name CBAC tcp
ip inspect name CBAC udp
ip inspect name CBAC ftp
ip cef
no ipv6 cef
!
!
flow record nbar-appmon
match ipv4 source address
match ipv4 destination address
match application name
collect interface output
collect counter bytes
collect counter packets
collect timestamp absolute first
collect timestamp absolute last
!
!
flow monitor application-mon
cache timeout active 60
record nbar-appmon
!
parameter-map type inspect global
log dropped-packets enable
max-incomplete low 18000
max-incomplete high 20000
nbar-classify
!
vpdn enable
!
vpdn-group L2TP
! Default L2TP VPDN group
accept-dialin
protocol l2tp
virtual-template 1
no l2tp tunnel authentication
!
license udi pid C841M-4X-JSECK9 sn FGL214890XK
!
!
object-group service INTERNAL_UTM_SERVICE
!
object-group network Others_dst_net
any
!
object-group network Others_src_net
any
!
object-group service Others_svc
ip
!
object-group network Web_dst_net
any
!
object-group network Web_src_net
any
!
object-group service Web_svc
ip
!
object-group network allapps_dst_net
any
!
object-group network allapps_src_net
any
!
object-group service allapps_svc
ip
!
object-group network local_cws_net
!
object-group network local_lan_subnets
192.168.0.0 255.255.255.0
!
object-group network vpn_dst_net
any
!
object-group network vpn_remote_subnets
any
!
object-group network vpn_src_net
any
!
object-group service vpn_svc
ip
!
username XXX privilege 0 password 0 XXXXX
!
redundancy
!
!
!
!
no cdp run
!
!
class-map type inspect match-any INTERNAL_DOMAIN_FILTER
match protocol msnmsgr
match protocol ymsgr
class-map type inspect match-any Others_app
match protocol https
match protocol smtp
match protocol pop3
match protocol imap
match protocol sip
match protocol ftp
match protocol dns
match protocol icmp
class-map type inspect match-all vpn
match access-group name vpn_acl
class-map type inspect match-any Web_app
match protocol http
class-map type inspect match-all allapps
match access-group name allapps_acl
class-map type inspect match-all Others
match class-map Others_app
match access-group name Others_acl
class-map type inspect match-all Web
match class-map Web_app
match access-group name Web_acl
!
policy-map type inspect LAN-WAN-POLICY
class type inspect allapps
inspect
class type inspect Web
inspect
class type inspect Others
inspect
class type inspect INTERNAL_DOMAIN_FILTER
inspect
class class-default
drop log
policy-map type inspect VPN-LAN-POLICY
class type inspect vpn
inspect
class type inspect INTERNAL_DOMAIN_FILTER
inspect
class class-default
drop log
!
zone security LAN
zone security WAN
zone security VPN
zone security DMZ
zone-pair security LAN-WAN source LAN destination WAN
service-policy type inspect LAN-WAN-POLICY
zone-pair security VPN-LAN source VPN destination LAN
service-policy type inspect VPN-LAN-POLICY
!
crypto keyring L2TP
pre-shared-key address 0.0.0.0 0.0.0.0 key 12345
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
lifetime 28800
crypto isakmp keepalive 3600
!
!
crypto ipsec transform-set TS1 esp-aes esp-sha-hmac
mode transport
!
!
!
crypto dynamic-map DYN_MAP 10
set nat demux
set transform-set TS1
!
!
crypto map CRYP_MAP 6000 ipsec-isakmp dynamic DYN_MAP
!
!
!
!
!
interface GigabitEthernet0
no ip address
!
interface GigabitEthernet1
no ip address
!
interface GigabitEthernet2
no ip address
!
interface GigabitEthernet3
no ip address
!
interface GigabitEthernet4
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet5
description PrimaryWANDesc_WAN
ip address XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX
ip nat outside
ip virtual-reassembly in
zone-member security WAN
duplex auto
speed auto
crypto map CRYP_MAP
!
interface Virtual-Template1
ip unnumbered GigabitEthernet5
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly in
load-interval 30
peer default ip address pool IGP-ENG-VPN
ppp mtu adaptive
ppp authentication ms-chap-v2 VPDN_AUTH
!
interface Vlan1
description LAN
ip address XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX
ip nbar protocol-discovery
ip flow monitor application-mon input
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly in
zone-member security LAN
ip tcp adjust-mss 1452
load-interval 30
!
ip local pool XXX-(VPN) XXX.XXX.XXX.200 XXX.XXX.XXX.220
ip forward-protocol nd
ip http server
ip http upload enable path flash:
ip http upload overwrite
ip http access-class 23
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
!
ip nat inside source list 23 interface GigabitEthernet5 overload
ip nat inside source list nat-list interface GigabitEthernet5 overload
ip route 0.0.0.0 0.0.0.0 XXX.XXX.XXX.XXX
!
ip access-list extended Others_acl
permit object-group Others_svc object-group Others_src_net object-group Others_dst_net
ip access-list extended Web_acl
permit object-group Web_svc object-group Web_src_net object-group Web_dst_net
ip access-list extended allapps_acl
permit object-group allapps_svc object-group allapps_src_net object-group allapps_dst_net
ip access-list extended nat-list
permit ip object-group local_lan_subnets any
deny ip object-group local_lan_subnets object-group vpn_remote_subnets
permit ip any any
deny ip any any
ip access-list extended vpn_acl
permit object-group vpn_svc object-group vpn_src_net object-group vpn_dst_net
!
!
!
access-list 23 permit 192.168.0.0 0.0.0.255
!
!
!
!
line con 0
login authentication local_access
no modem enable
line vty 0 4
access-class 23 in
privilege level 15
login authentication local_access
transport input telnet ssh
line vty 5 15
access-class 23 in
privilege level 15
transport input telnet ssh
!
end
==============================
