本帖最后由 xzmchina 于 2014-6-23 11:42 编辑
我使用Cisco 2801作为EzVPN Server。当使用路由器作为EzVPN Client时,在网络扩展模式下,客户端的PC能够直接访问EzVPN Server端的公网地址,如Ping,端口映射,Telent, SSH等,但当使用ASA 5505作为EzVPN Client时,VPN通道是正常的,唯独无法直接访问EzVPN Server端的公网IP及其端口。检查二者区别,有如下不同:
ASA# sh crypto ipsec sa | include ident
local ident (addr/mask/prot/port): (60.10.61.110/255.255.255.255/0/0)
remote ident (addr/mask/prot/port): (116.247.110.22/255.255.255.255/0/0)
local ident (addr/mask/prot/port): (60.10.61.110/255.255.255.255/0/0)
remote ident (addr/mask/prot/port): (192.168.254.0/255.255.255.0/0/0)
local ident (addr/mask/prot/port): (60.10.61.110/255.255.255.255/0/0)
remote ident (addr/mask/prot/port): (192.168.167.0/255.255.255.0/0/0)
local ident (addr/mask/prot/port): (60.10.61.110/255.255.255.255/0/0)
remote ident (addr/mask/prot/port): (192.168.168.0/255.255.255.0/0/0)
local ident (addr/mask/prot/port): (60.10.61.110/255.255.255.255/0/0)
remote ident (addr/mask/prot/port): (192.168.166.0/255.255.255.0/0/0)
local ident (addr/mask/prot/port): (192.168.165.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.254.0/255.255.255.0/0/0)
local ident (addr/mask/prot/port): (192.168.165.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.166.0/255.255.255.0/0/0)
local ident (addr/mask/prot/port): (192.168.165.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.167.0/255.255.255.0/0/0)
local ident (addr/mask/prot/port): (192.168.165.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.168.0/255.255.255.0/0/0)
这个看到很多公网地址的,远端只能通过VPN Tunnel来访问总部服务器,无法直接通过关口映射访问。
Router#sh crypto ipsec sa | include ident
local ident (addr/mask/prot/port): (192.168.0.0/255.255.0.0/0/0)
remote ident (addr/mask/prot/port): (172.26.0.0/255.255.255.0/0/0)
local ident (addr/mask/prot/port): (192.168.0.0/255.255.0.0/0/0)
remote ident (addr/mask/prot/port): (172.26.1.0/255.255.255.0/0/0)
这个看不到任何公网IP信息,通信一切正常。
注,以上命令输出是不同公司的结果,一个使用ASA做客户端,一个使用Router做客户端,因此其输出数据不一致并非配置问题。