取消
显示结果 
搜索替代 
您的意思是: 
cancel
3497
查看次数
5
有帮助
4
回复

anyconnect vpn无法访问外网,只能访问内网问题

wangzhifu60088
Spotlight
Spotlight

web vpn配置如下:

asa# show run tunnel-group
tunnel-group Anyconnect type remote-access
tunnel-group Anyconnect general-attributes
address-pool Anyconnect
authentication-server-group off
default-group-policy Anyconnect
tunnel-group Anyconnect webvpn-attributes
group-alias jiiov--(PWD) enable

tunnel-group Anyconnect-jiigan type remote-access
tunnel-group Anyconnect-jiigan general-attributes
address-pool Anyconnect-jiigan
authentication-server-group jiigan
default-group-policy Anyconnect-jiigan
tunnel-group Anyconnect-jiigan webvpn-attributes
group-alias jiigan--(PWD) enable

 

roup-policy Anyconnect-jiigan internal
group-policy Anyconnect-jiigan attributes
wins-server none
dns-server value 10.203.12.21 10.203.12.22
vpn-simultaneous-logins 4
vpn-idle-timeout 60
vpn-session-timeout 720
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelall
default-domain value jiigan.com
split-tunnel-all-dns enable
webvpn
anyconnect mtu 1360
group-policy Anyconnect internal
group-policy Anyconnect attributes
wins-server none
dns-server value 10.203.12.21 10.203.12.22
vpn-simultaneous-logins 2
vpn-idle-timeout 60
vpn-session-timeout 720
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelall
default-domain value jiiov.com
split-tunnel-all-dns enable
webvpn
anyconnect mtu 1360

asa# show run webvpn
webvpn
enable internet
enable Unicom
enable inside
hsts
enable
max-age 31536000
include-sub-domains
no preload
portal-access-rule 1 deny code 403 any
anyconnect-essentials
anyconnect enable
tunnel-group-list enable
cache
disable
cache-static-content enable
error-recovery disable

 

 

请哪位大佬帮忙看下 

4 条回复4

YilinChen
Spotlight
Spotlight

楼主是希望实现,拨了AnyConnect VPN后,终端电脑即可以访问VPN内网资源,同时还可以访问互联网吧?

 

如果要实现这个需求,需要配置隧道分离;在贴上的来配置中,只看到split-tunnel-policy tunnelall,但对应的用于指定内网地址段的ACL没有看到。

 

wangzhifu60088
Spotlight
Spotlight

对,但是我现在访问内网没问题,访问外网时快时慢,感觉是DNS问题 , udp没问题,tcp不行

如果是因为拨VPN后,推给你终端的DNS是非本地ISP的,也许会出现同一域名解析出来IP不一样,如果再跨ISP访问,那这种可能性下确实访问会出问题。

Rockyw
Spotlight
Spotlight

楼主不妨参考一下下面的文档

AnyConnect VPN 客户端故障排除指南 - 常见问题

https://www.cisco.com/c/zh_cn/support/docs/security/asa-5500-x-series-firewalls/212972-anyconnect-vpn-client-troubleshooting-gu.html

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Rockyw | If it solves your problem, please mark as answer. Thanks !
快捷链接