问

F100-C80防火墙，开启L2TP，客户端连接后，无法ping通内网服务器地址

L2TP VPN

2024-01-21提问

0关注
0收藏，587浏览

小霸王无敌啊

小霸王无敌啊零段

粉丝：0人关注：0人

问题描述：

F100-C80防火墙，开启L2TP，客户端（192.168.44.11）连接后，无法ping通内网服务器（192.168.33.254）地址

但内网服务器（192.168.33.254）地址可以ping通客户端的IP（192.168.44.11）

这个是什么问题？

最佳答案

zhiliao_p9QVR

zhiliao_p9QVR 九段

粉丝：32人关注：3人

接口是否加入安全域，安全策略是否放通

如果都没有问题，就debug看一下

4 个回答

按时间按赞数

zhiliao_sEUyB

zhiliao_sEUyB 九段

粉丝：237人关注：8人

路由应该没问题，检查下防火墙策略问题吧，可以tracert确认下路径

object-policy ip 1701 rule 0 pass service 1701 # object-policy ip Local-Trust rule 0 pass # object-policy ip Untrust-Local rule 0 pass # object-policy ip trust-local rule 0 pass # object-policy ip trust-untrust rule 0 pass # security-zone name Local # security-zone name Trust import interface GigabitEthernet1/0/8 # security-zone name DMZ # security-zone name Untrust import interface GigabitEthernet1/0/9 import interface Virtual-Template1 # security-zone name Management import interface GigabitEthernet1/0/0 import interface GigabitEthernet1/0/2 # zone-pair security source Local destination Trust object-policy apply ip Local-Trust # zone-pair security source Local destination Untrust object-policy apply ip 1701 # zone-pair security source Trust destination Local object-policy apply ip trust-local # zone-pair security source Trust destination Untrust object-policy apply ip trust-untrust # zone-pair security source Untrust destination Local object-policy apply ip Untrust-Local packet-filter 2000 # acl basic 2000 rule 0 permit 能帮忙看看是否有问题吗？

小霸王无敌啊发表时间：2024-01-21 更多>>

小霸王无敌啊发表时间：2024-01-21

小霸王无敌啊

小霸王无敌啊知了小白

粉丝：0人关注：0人

object-policy ip 1701
rule 0 pass service 1701
#
object-policy ip Local-Trust
rule 0 pass
#
object-policy ip Untrust-Local
rule 0 pass
#
object-policy ip trust-local
rule 0 pass
#
object-policy ip trust-untrust
rule 0 pass
#
security-zone name Local
#
security-zone name Trust
import interface GigabitEthernet1/0/8
#
security-zone name DMZ
#
security-zone name Untrust
import interface GigabitEthernet1/0/9
import interface Virtual-Template1
#
security-zone name Management
import interface GigabitEthernet1/0/0
import interface GigabitEthernet1/0/2
#
zone-pair security source Local destination Trust
object-policy apply ip Local-Trust
#
zone-pair security source Local destination Untrust
object-policy apply ip 1701
#
zone-pair security source Trust destination Local
object-policy apply ip trust-local
#
zone-pair security source Trust destination Untrust
object-policy apply ip trust-untrust
#
zone-pair security source Untrust destination Local
object-policy apply ip Untrust-Local
packet-filter 2000
#
acl basic 2000
rule 0 permit