问

VPN问题

SSL VPN

2020-09-25提问

1关注
1收藏，1830浏览

zhiliao_zr5xu

zhiliao_zr5xu 一段

粉丝：0人关注：0人

问题描述：

社区的大神们，小弟我这几天碰到一个很奇怪的问题，本人是某市一局办单位的网管，本单位需要通过VPN和本市的国土局连接，办理相关业务。

关于VPN的具体配置为：vpn服务服务器在国土局，使用的是网神的防火墙的VPN功能，VPN的类型是SSLVPN，本单位如要使用VPN功能，先通过HTTPS的方式登录在国土局的防火墙的外网地址：https://172.23.XX.XX:64443,下载一个SSLVPN客户端（必须要下载）并安装好，同时电脑上会有一个虚拟网卡，双击安装好的客户端，输入用户名和密码，就连上VPN了，通是虚拟网卡也分配到了IP地址，到这里都是正常的。

然后问题来了，既然连上VPN了，就开始访问位于国土局的内网地址（OA）以及打开位于本单位电脑上的档案查询软件（软件服务器在国土局的内网上），但是访问速度非常慢，打开OA网址要十几分钟，软件更是打不开，一开始还以为是国土局那边的VPN没配好，打电话过去问，得知其他的局办单位都是正常了，没有出现说是速度慢的情况，然后怀疑是账号权限问题，但是让其他局办单位的小兄弟用我的账号登录他那边的VPN，一切正常，访问OA和软件一切正常，速度很快。在然后我们试了一下另一种情况，就是插路由器WAN口的网线直接插电脑了，电脑网卡配路由器外网接口（这样电脑网卡上实际上配的是公网地址），然后奇迹出现了，VPN访问很正常了，有点也不卡了。到这里，可能会有大神就会说，那可能是我们内部网络有问题了，但是我们单位的外网上网很正常，访问外网网页速度也很好。就是连上VPN后，访问不了国土局的内部资源。其他局办单位都正常，就我们单位不正常。另外关于VPN在客户端的配置，其他访问正常的局办单位，也和我们一样，先用网址登陆VPN服务器（实际是网神防火墙的外网接口地址），然后跳出一个下载SSL客户端的网页，下载客户端，按提示安装好，打开客户端，输入账号密码，连上VPN，其他也不用配的。

本单位的核心交换机用的是S7500系列核心交换机，核心交换机上插着一块防火墙板卡，路由器是H3CSR6604，访问外网做NAT转换

社区上大神们，能不能帮我分析一下，是哪里出的问题，谢谢了

组网及组网描述：

5 个回答

按时间按赞数

已采纳

寂东

寂东九段

粉丝：225人关注：3人

你比较下各接口的MTU和tcp mss 参数是否一致，

sunny

sunny 八段

粉丝：9人关注：0人

那你可以这样试试，电脑直接接路由器试试，如果可以，然后再接交换机上试试看

试过了，没用，还是一样的

zhiliao_zr5xu 发表时间：2020-09-25

回复zhiliao_zr5xu:

是不是路由器上配置了什么限速的功能啊

sunny 发表时间：2020-09-25

回复sunny:

****************************************************************************** * Copyright (c) 2004-2010 Hangzhou H3C Tech. Co., Ltd. All rights reserved. * * Without the owner's prior written consent, * * no decompiling or reverse-engineering shall be allowed. * ****************************************************************************** Login authentication Username:h3c Password: <jhxq-route>dis cu # version 5.20, Release 2420P03 # sysname jhxq-route # ike local-name guotuVPN # domain default enable system # telnet server enable # ip ttl-expires enable # mirroring-group 1 local # acl number 3000 rule 0 permit ip source 10.128.0.0 0.0.255.255 rule 5 deny ip acl number 3004 rule 0 permit ip source 10.128.0.0 0.0.0.255 destination 172.23.215.0 0.0.0.255 # vlan 1 # domain system access-limit disable state active idle-cut disable self-service-url disable # ike peer guotu remote-name guotu remote-address 172.23.226.130 nat traversal # ipsec proposal guotu # user-group system # local-user h3c password simple h3c authorization-attribute level 3 service-type telnet # interface NULL0 # interface GigabitEthernet3/0/0 port link-mode route # interface GigabitEthernet3/0/1 port link-mode route # interface GigabitEthernet3/1/0 port link-mode route nat outbound 3000 nat server protocol tcp global 60.190.213.154 443 inside 10.128.35.100 443 # interface GigabitEthernet3/1/1 port link-mode route description to zhengwuwang nat outbound 3000 ip address 172.23.226.130 255.255.255.0 # interface GigabitEthernet3/1/2 port link-mode route ip address 10.128.253.254 255.255.255.0 # interface GigabitEthernet3/1/3 port link-mode route ip address 10.128.252.1 255.255.255.0 # interface GigabitEthernet3/1/4 port link-mode route # interface GigabitEthernet3/1/5 port link-mode route # interface GigabitEthernet3/1/6 port link-mode route # interface GigabitEthernet3/1/7 port link-mode route # interface M-GigabitEthernet0/0/0 # ip route-static 0.0.0.0 0.0.0.0 172.23.226.129 ip route-static 10.128.1.0 255.255.255.0 10.128.252.2 ip route-static 10.128.11.0 255.255.255.0 10.128.253.253 ip route-static 10.128.12.0 255.255.255.0 10.128.253.253 ip route-static 10.128.13.0 255.255.255.0 10.128.253.253 ip route-static 10.128.14.0 255.255.255.0 10.128.253.253 ip route-static 10.128.15.0 255.255.255.0 10.128.253.253 ip route-static 10.128.16.0 255.255.255.0 10.128.253.253 ip route-static 10.128.17.0 255.255.255.0 10.128.253.253 ip route-static 10.128.18.0 255.255.255.0 10.128.253.253 ip route-static 10.128.19.0 255.255.255.0 10.128.253.253 ip route-static 10.128.20.0 255.255.255.0 10.128.253.253 ip route-static 10.128.21.0 255.255.255.0 10.128.253.253 ip route-static 10.128.22.0 255.255.255.0 10.128.253.253 ip route-static 10.128.23.0 255.255.255.0 10.128.253.253 ip route-static 10.128.24.0 255.255.255.0 10.128.253.253 ip route-static 10.128.25.0 255.255.255.0 10.128.253.253 ip route-static 10.128.26.0 255.255.255.0 10.128.253.253 ip route-static 10.128.27.0 255.255.255.0 10.128.253.253 ip route-static 10.128.28.0 255.255.255.0 10.128.253.253 ip route-static 10.128.30.0 255.255.255.0 10.128.253.253 ip route-static 10.128.31.0 255.255.255.0 10.128.253.253 ip route-static 10.128.35.0 255.255.255.0 10.128.253.253 ip route-static 10.128.36.0 255.255.255.0 10.128.253.253 ip route-static 10.128.37.0 255.255.255.0 10.128.253.253 ip route-static 10.128.38.0 255.255.255.0 10.128.253.253 # snmp-agent snmp-agent local-engineid 800063A2000FE2D830916877 snmp-agent community read public snmp-agent community write private snmp-agent sys-info version all # user-interface con 0 1 user-interface aux 0 1 user-interface vty 0 4 authentication-mode scheme user privilege level 3 set authentication password cipher +S_`5<<MMX=KN"WZBTWP21!! # return <jhxq-route> <jhxq-route>dis ip rou <jhxq-route>dis ip routing-table Routing Tables: Public Destinations : 35 Routes : 35 Destination/Mask Proto Pre Cost NextHop Interface 0.0.0.0/0 Static 60 0 172.23.226.129 GE3/1/1 10.128.1.0/24 Static 60 0 10.128.252.2 GE3/1/3 10.128.11.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.12.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.13.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.14.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.15.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.16.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.17.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.18.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.19.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.20.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.21.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.22.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.23.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.24.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.25.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.26.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.27.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.28.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.30.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.31.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.35.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.36.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.37.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.38.0/24 Static 60 0 10.128.253.253 GE3/1/2 10.128.252.0/24 Direct 0 0 10.128.252.1 GE3/1/3 10.128.252.1/32 Direct 0 0 127.0.0.1 InLoop0 10.128.253.0/24 Direct 0 0 10.128.253.254 GE3/1/2 10.128.253.254/32 Direct 0 0 127.0.0.1 InLoop0 60.190.213.154/32 Static 1 0 0.0.0.0 NULL0 127.0.0.0/8 Direct 0 0 127.0.0.1 InLoop0 127.0.0.1/32 Direct 0 0 127.0.0.1 InLoop0 172.23.226.0/24 Direct 0 0 172.23.226.130 GE3/1/1 172.23.226.130/32 Direct 0 0 127.0.0.1 InLoop0 <jhxq-route>

zhiliao_zr5xu 发表时间：2020-09-25

回复sunny:

zhiliao_zr5xu 发表时间：2020-09-25

zhiliao_zr5xu

zhiliao_zr5xu 一段

粉丝：0人关注：0人

******************************************************************************
* Copyright (c) 2004-2010 Hangzhou H3C Tech. Co., Ltd. All rights reserved. *
* Without the owner's prior written consent, *
* no decompiling or reverse-engineering shall be allowed. *
******************************************************************************

Login authentication

Username:h3c
Password:
<jhxq-route>dis cu
#
version 5.20, Release 2420P03
#
sysname jhxq-route
#
ike local-name guotuVPN
#
domain default enable system
#
telnet server enable
#
ip ttl-expires enable
#
mirroring-group 1 local
#
acl number 3000
rule 0 permit ip source 10.128.0.0 0.0.255.255
rule 5 deny ip
acl number 3004
rule 0 permit ip source 10.128.0.0 0.0.0.255 destination 172.23.215.0 0.0.0.255
#
vlan 1
#
domain system
access-limit disable
state active
idle-cut disable
self-service-url disable
#
ike peer guotu
remote-name guotu
remote-address 172.23.226.130
nat traversal
#
ipsec proposal guotu
#
user-group system
#
local-user h3c
password simple h3c
authorization-attribute level 3
service-type telnet
#
interface NULL0
#
interface GigabitEthernet3/0/0
port link-mode route
#
interface GigabitEthernet3/0/1
port link-mode route
#
interface GigabitEthernet3/1/0
port link-mode route
nat outbound 3000
nat server protocol tcp global 60.190.213.154 443 inside 10.128.35.100 443
#
interface GigabitEthernet3/1/1
port link-mode route
description to zhengwuwang
nat outbound 3000
ip address 172.23.226.130 255.255.255.0
#
interface GigabitEthernet3/1/2
port link-mode route
ip address 10.128.253.254 255.255.255.0
#
interface GigabitEthernet3/1/3
port link-mode route
ip address 10.128.252.1 255.255.255.0
#
interface GigabitEthernet3/1/4
port link-mode route
#
interface GigabitEthernet3/1/5
port link-mode route
#
interface GigabitEthernet3/1/6
port link-mode route
#
interface GigabitEthernet3/1/7
port link-mode route
#
interface M-GigabitEthernet0/0/0
#
ip route-static 0.0.0.0 0.0.0.0 172.23.226.129
ip route-static 10.128.1.0 255.255.255.0 10.128.252.2
ip route-static 10.128.11.0 255.255.255.0 10.128.253.253
ip route-static 10.128.12.0 255.255.255.0 10.128.253.253
ip route-static 10.128.13.0 255.255.255.0 10.128.253.253
ip route-static 10.128.14.0 255.255.255.0 10.128.253.253
ip route-static 10.128.15.0 255.255.255.0 10.128.253.253
ip route-static 10.128.16.0 255.255.255.0 10.128.253.253
ip route-static 10.128.17.0 255.255.255.0 10.128.253.253
ip route-static 10.128.18.0 255.255.255.0 10.128.253.253
ip route-static 10.128.19.0 255.255.255.0 10.128.253.253
ip route-static 10.128.20.0 255.255.255.0 10.128.253.253
ip route-static 10.128.21.0 255.255.255.0 10.128.253.253
ip route-static 10.128.22.0 255.255.255.0 10.128.253.253
ip route-static 10.128.23.0 255.255.255.0 10.128.253.253
ip route-static 10.128.24.0 255.255.255.0 10.128.253.253
ip route-static 10.128.25.0 255.255.255.0 10.128.253.253
ip route-static 10.128.26.0 255.255.255.0 10.128.253.253
ip route-static 10.128.27.0 255.255.255.0 10.128.253.253
ip route-static 10.128.28.0 255.255.255.0 10.128.253.253
ip route-static 10.128.30.0 255.255.255.0 10.128.253.253
ip route-static 10.128.31.0 255.255.255.0 10.128.253.253
ip route-static 10.128.35.0 255.255.255.0 10.128.253.253
ip route-static 10.128.36.0 255.255.255.0 10.128.253.253
ip route-static 10.128.37.0 255.255.255.0 10.128.253.253
ip route-static 10.128.38.0 255.255.255.0 10.128.253.253
#
snmp-agent
snmp-agent local-engineid 800063A2000FE2D830916877
snmp-agent community read public
snmp-agent community write private
snmp-agent sys-info version all
#
user-interface con 0 1
user-interface aux 0 1
user-interface vty 0 4
authentication-mode scheme
user privilege level 3
set authentication password cipher +S_`5<<MMX=KN"WZBTWP21!!
#
return
<jhxq-route>
<jhxq-route>dis ip rou
<jhxq-route>dis ip routing-table
Routing Tables: Public
Destinations : 35 Routes : 35

Destination/Mask Proto Pre Cost NextHop Interface

0.0.0.0/0 Static 60 0 172.23.226.129 GE3/1/1
10.128.1.0/24 Static 60 0 10.128.252.2 GE3/1/3
10.128.11.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.12.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.13.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.14.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.15.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.16.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.17.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.18.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.19.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.20.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.21.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.22.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.23.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.24.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.25.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.26.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.27.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.28.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.30.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.31.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.35.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.36.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.37.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.38.0/24 Static 60 0 10.128.253.253 GE3/1/2
10.128.252.0/24 Direct 0 0 10.128.252.1 GE3/1/3
10.128.252.1/32 Direct 0 0 127.0.0.1 InLoop0
10.128.253.0/24 Direct 0 0 10.128.253.254 GE3/1/2
10.128.253.254/32 Direct 0 0 127.0.0.1 InLoop0
60.190.213.154/32 Static 1 0 0.0.0.0 NULL0
127.0.0.0/8 Direct 0 0 127.0.0.1 InLoop0
127.0.0.1/32 Direct 0 0 127.0.0.1 InLoop0
172.23.226.0/24 Direct 0 0 172.23.226.130 GE3/1/1
172.23.226.130/32 Direct 0 0 127.0.0.1 InLoop0

<jhxq-route>