Исходное сообщение
"VPN на Cisco PiX" Отправлено Roman, 25-Янв-09 11:56
>покажите весь конфиг. ! PIX Version 7.2(4) ! interface Ethernet0 nameif outside security-level 0 ip address 62.183.109.14 255.255.255.252 ospf network point-to-point non-broadcast ! interface Ethernet1 speed 100 duplex full nameif inside security-level 100 ip address 192.16.101.253 255.255.255.248 standby 192.16.101.252 ! boot system flash:/pix724.bin ftp mode passive dns server-group DefaultDNS domain-name mycompany.ru access-list nonat extended permit ip 10.10.16.0 255.255.255.0 any access-list nonat extended permit ip any 10.10.16.0 255.255.255.0 access-list split extended permit ip any 10.10.16.0 255.255.255.0 access-list outside extended permit icmp any any access-list outside extended permit ip 10.10.0.0 255.255.0.0 any access-list forNAT extended permit icmp any any pager lines 24 logging enable logging timestamp logging buffered alerts logging trap debugging logging history alerts logging asdm informational logging debug-trace logging flash-bufferwrap logging flash-minimum-free 1024 logging flash-maximum-allocation 512 mtu outside 1500 mtu inside 1500 ip local pool VPNPOOL 10.10.16.1-10.10.16.254 mask 255.255.255.0 ip verify reverse-path interface outside failover icmp unreachable rate-limit 1 burst-size 1 icmp permit any outside icmp permit any inside asdm image flash:/asdm-524.bin asdm history enable arp timeout 600 nat-control global (outside) 101 62.183.109.100-62.183.109.110 global (outside) 101 interface nat (inside) 0 access-list nonat nat (inside) 101 access-list forNAT access-group outside in interface outside route outside 0.0.0.0 0.0.0.0 62.183.109.13 1 route inside 10.0.0.0 255.0.0.0 192.16.101.254 1 route inside 192.168.0.0 255.255.0.0 192.16.101.254 1 ! router ospf XXXXXXXXXXXX router-id 62.183.109.14 log-adj-changes redistribute connected subnets redistribute static subnets ! timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute http server enable http 10.10.2.45 255.255.255.255 inside snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec transform-set vpn esp-des esp-md5-hmac crypto dynamic-map vpn 10 set transform-set vpn crypto map vpn 10 ipsec-isakmp dynamic vpn crypto map vpn interface outside crypto isakmp identity address crypto isakmp enable outside crypto isakmp policy 10 authentication pre-share encryption des hash md5 group 2 lifetime 86400 crypto isakmp policy 65535 authentication pre-share encryption des hash sha group 2 lifetime 86400 telnet 10.10.2.45 255.255.0.0 inside telnet timeout 5 ssh 10.10.2.45 255.255.255.255 inside ssh timeout 5 ssh version 1 console timeout 5 group-policy ciscovpn internal group-policy ciscovpn attributes dns-server value 10.10.1.14 split-tunnel-policy tunnelspecified split-tunnel-network-list value split split-dns value 10.10.1.14 msie-proxy server value 10.10.1.144:8080 username admintest password -------------- encrypted privilege 15 tunnel-group ciscovpn type ipsec-ra tunnel-group ciscovpn general-attributes address-pool VPNPOOL tunnel-group ciscovpn ipsec-attributes pre-shared-key ---------------- ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns MY_DNS_INSPECT_MAP parameters   message-length maximum 512 policy-map global_policy class inspection_default   inspect ftp   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny   inspect sunrpc   inspect xdmcp   inspect sip   inspect netbios   inspect tftp   inspect dns MY_DNS_INSPECT_MAP   inspect icmp   inspect pptp   inspect h323 h225   inspect h323 ras policy-map type inspect dns migrated_dns_map_1 parameters   message-length maximum 512 ! service-policy global_policy global prompt hostname context Cryptochecksum:35aac3bf4db320a7dac70c551a7fd4b1 : end

Ваше сообщение
Имя*:
EMail:	Для отправки новых сообщений в текущей нити на email укажите знак ! перед адресом, например, !user@host.ru (!! - не показывать email). Более тонкая настройка отправки ответов производится в профиле зарегистрированного участника форума.
Заголовок*:
Сообщение*:	>>покажите весь конфиг. > ! > PIX Version 7.2(4) > ! > interface Ethernet0 > nameif outside > security-level 0 > ip address 62.183.109.14 255.255.255.252 > ospf network point-to-point non-broadcast > ! > interface Ethernet1 > speed 100 > duplex full > nameif inside > security-level 100 > ip address 192.16.101.253 255.255.255.248 standby 192.16.101.252 > ! > boot system flash:/pix724.bin > ftp mode passive > dns server-group DefaultDNS > domain-name mycompany.ru > access-list nonat extended permit ip 10.10.16.0 255.255.255.0 any > access-list nonat extended permit ip any 10.10.16.0 255.255.255.0 > access-list split extended permit ip any 10.10.16.0 255.255.255.0 > access-list outside extended permit icmp any any > access-list outside extended permit ip 10.10.0.0 255.255.0.0 any > access-list forNAT extended permit icmp any any > pager lines 24 > logging enable > logging timestamp > logging buffered alerts > logging trap debugging > logging history alerts > logging asdm informational > logging debug-trace > logging flash-bufferwrap > logging flash-minimum-free 1024 > logging flash-maximum-allocation 512 > mtu outside 1500 > mtu inside 1500 > ip local pool VPNPOOL 10.10.16.1-10.10.16.254 mask 255.255.255.0 > ip verify reverse-path interface outside > failover > icmp unreachable rate-limit 1 burst-size 1 > icmp permit any outside > icmp permit any inside > asdm image flash:/asdm-524.bin > asdm history enable > arp timeout 600 > nat-control > global (outside) 101 62.183.109.100-62.183.109.110 > global (outside) 101 interface > nat (inside) 0 access-list nonat > nat (inside) 101 access-list forNAT > access-group outside in interface outside > route outside 0.0.0.0 0.0.0.0 62.183.109.13 1 > route inside 10.0.0.0 255.0.0.0 192.16.101.254 1 > route inside 192.168.0.0 255.255.0.0 192.16.101.254 1 > ! > router ospf XXXXXXXXXXXX > router-id 62.183.109.14 > log-adj-changes > redistribute connected subnets > redistribute static subnets > ! > timeout xlate 3:00:00 > timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 > timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 > timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 > timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute > http server enable > http 10.10.2.45 255.255.255.255 inside > snmp-server location > no snmp-server contact > snmp-server enable traps snmp authentication linkup linkdown coldstart > crypto ipsec transform-set vpn esp-des esp-md5-hmac > crypto dynamic-map vpn 10 set transform-set vpn > crypto map vpn 10 ipsec-isakmp dynamic vpn > crypto map vpn interface outside > crypto isakmp identity address > crypto isakmp enable outside > crypto isakmp policy 10 > authentication pre-share > encryption des > hash md5 > group 2 > lifetime 86400 > crypto isakmp policy 65535 > authentication pre-share > encryption des > hash sha > group 2 > lifetime 86400 > telnet 10.10.2.45 255.255.0.0 inside > telnet timeout 5 > ssh 10.10.2.45 255.255.255.255 inside > ssh timeout 5 > ssh version 1 > console timeout 5 > group-policy ciscovpn internal > group-policy ciscovpn attributes > dns-server value 10.10.1.14 > split-tunnel-policy tunnelspecified > split-tunnel-network-list value split > split-dns value 10.10.1.14 > msie-proxy server value 10.10.1.144:8080 > username admintest password -------------- encrypted privilege 15 > tunnel-group ciscovpn type ipsec-ra > tunnel-group ciscovpn general-attributes > address-pool VPNPOOL > tunnel-group ciscovpn ipsec-attributes > pre-shared-key ---------------- > ! > class-map inspection_default > match default-inspection-traffic > ! > ! > policy-map type inspect dns MY_DNS_INSPECT_MAP > parameters > message-length maximum 512 > policy-map global_policy > class inspection_default > inspect ftp > inspect rsh > inspect rtsp > inspect esmtp > inspect sqlnet > inspect skinny > inspect sunrpc > inspect xdmcp > inspect sip > inspect netbios > inspect tftp > inspect dns MY_DNS_INSPECT_MAP > inspect icmp > inspect pptp > inspect h323 h225 > inspect h323 ras > policy-map type inspect dns migrated_dns_map_1 > parameters > message-length maximum 512 > ! > service-policy global_policy global > prompt hostname context > Cryptochecksum:35aac3bf4db320a7dac70c551a7fd4b1 > : end
	Введите код, изображенный на картинке: