取消
显示结果 
搜索替代 
您的意思是: 
cancel
1561
查看次数
5
有帮助
2
回复

SSL VPN config

332953358
Spotlight
Spotlight

ciscoasa(config)# sh run
: Hardware: ASA5520-K8, 2048 MB RAM, CPU Pentium 4 Celeron 2000 MHz
ASA Version 9.1(6)
hostname ciscoasa
names
ip local pool ssl-pool 10.0.255.100-10.0.255.200 mask 255.255.255.0
!
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 122.122.122.50 255.255.255.248
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 192.168.88.1 255.255.255.0
!
ftp mode passive
same-security-traffic permit intra-interface
object network obj-ssl
subnet 10.0.255.0 255.255.255.0
object network local
subnet 192.168.88.0 255.255.255.0

nat (inside,outside) source static local local destination static obj-ssl obj-ssl
!
object network local
nat (inside,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 122.122.122.49 1

dhcpd address 192.168.88.100-192.168.88.200 inside
dhcpd dns 202.101.172.35 interface inside
dhcpd option 3 ip 192.168.88.1 interface inside
dhcpd enable inside
!
webvpn
enable outside
enable inside
anyconnect-essentials
anyconnect image disk0:/anyconnect-win-4.10.06079-webdeploy-k9.pkg 1
anyconnect image disk0:/anyconnect-macos-4.10.06079-webdeploy-k9.pkg 2
anyconnect enable
tunnel-group-list enable

group-policy ssl-policy internal
group-policy ssl-policy attributes
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelall

username test password t.ydfkL/SuCNgO.I encrypted

tunnel-group ssl-tunnel type remote-access
tunnel-group ssl-tunnel general-attributes
address-pool ssl-pool
default-group-policy ssl-policy

tunnel-group ssl-tunnel webvpn-attributes
group-alias TEST_GROUP enable

问题:内部访问internet正常,内部访问webvpn 正常,但是无法在internet上通过122.122.122.50访问webvpn,是哪里的问题?感谢!

1 个已接受解答

已接受的解答

ilay
VIP
VIP

你这个公网ip的443不会被封了吧?查ip归属地显示台湾是正常的吗?建议跟网络服务商确认一下端口的情况,或者自行调整一下webvpn的端口测试一下吧

webvpn

port 8443

!

在原帖中查看解决方案

2 条回复2

ilay
VIP
VIP

你这个公网ip的443不会被封了吧?查ip归属地显示台湾是正常的吗?建议跟网络服务商确认一下端口的情况,或者自行调整一下webvpn的端口测试一下吧

webvpn

port 8443

!

已调整,果然是电信的端口被封了。

快捷链接