f100-c-g3 v7 sslvpn通过inode访问不了资源
- 0关注
- 1收藏，961浏览
问题描述：
设置列表
- 有序列表
- 无序列表
对齐方式
- 靠左
- 居中
- 靠右
v7 sslvpn，inode 连接成功并获得虚拟IP地址(10.5.2.2)，但ping不通内网资源10.200.49.193，在v7上用ping -a 10.5.2.1 10.200.49.193 ,是可以ping通的.
#
version 7.1.064, Release 9524P33
#
sysname H3C
#
clock timezone Beijing add 08:00:00
clock protocol none
#
context Admin id 1
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
password-recovery enable
#
vlan 1
#
vlan 43
#
vlan 230
#
controller Cellular1/0/0
#
interface NULL0
#
interface Vlan-interface43
ip address 10.200.43.251 255.255.255.0
#
interface Vlan-interface230
ip address 10.200.230.251 255.255.255.0
#
interface GigabitEthernet1/0/0
port link-mode route
combo enable copper
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet1/0/1
port link-mode route
combo enable fiber
#
interface GigabitEthernet1/0/2
port link-mode route
ip address 10.200.47.251 255.255.255.0
gateway 10.200.47.253
#
interface GigabitEthernet1/0/3
port link-mode route
ip address 10.200.210.101 255.255.255.0
#
interface GigabitEthernet1/0/8
port link-mode route
#
interface GigabitEthernet1/0/9
port link-mode route
#
interface GigabitEthernet1/0/10
port link-mode route
#
interface GigabitEthernet1/0/11
port link-mode route
#
interface GigabitEthernet1/0/4
port link-mode bridge
port access vlan 43
#
interface GigabitEthernet1/0/5
port link-mode bridge
port access vlan 43
#
interface GigabitEthernet1/0/6
port link-mode bridge
port access vlan 230
#
interface GigabitEthernet1/0/7
port link-mode bridge
port access vlan 230
#
interface SSLVPN-AC1
ip address 10.5.2.1 255.255.255.0
#
security-zone name Local
#
security-zone name Trust
import interface GigabitEthernet1/0/1
import interface GigabitEthernet1/0/3
import interface GigabitEthernet1/0/8
import interface GigabitEthernet1/0/9
import interface GigabitEthernet1/0/10
import interface GigabitEthernet1/0/11
import interface NULL0
import interface Vlan-interface43
import interface Vlan-interface230
#
security-zone name DMZ
#
security-zone name Untrust
#
security-zone name Management
import interface GigabitEthernet1/0/0
import interface GigabitEthernet1/0/2
#
scheduler logfile size 16
#
line class aux
user-role network-operator
#
line class console
authentication-mode scheme
user-role network-admin
#
line class usb
user-role network-admin
#
line class vty
user-role network-operator
#
line aux 0
user-role network-admin
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-admin
#
ip route-static 0.0.0.0 0 Vlan-interface43 10.200.43.253
ip route-static 10.200.43.0 24 Vlan-interface43 10.200.43.253
#
info-center source FILTER logfile deny
#
ssh server enable
#
acl advanced 3000
rule 0 permit ip
#
radius scheme radius
primary authentication 10.200.49.190 key cipher $c$3$P9G92KU3YfJcVuTyOCP0K7QUpn2O4FKqUA==
key authentication cipher $c$3$bSEeT5XcFSoPYh/2ity+Tnj8v0sTaAIO8w==
user-name-format without-domain
nas-ip 10.200.43.251
#
domain sslisp
authorization-attribute user-group segroup
authentication sslvpn radius-scheme radius
authorization sslvpn radius-scheme radius
accounting sslvpn none
#
domain system
#
domain default enable sslisp
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group segroup
authorization-attribute sslvpn-policy-group segp
#
user-group system
#
local-user admin class manage
password hash $h$6$TAc2YqE44dNheERZ$TmnSmRaB22tBhMbnRNWlvvkPpliFj14PkQhi37kFAWfi8ghjxrsZjSKMKyRNAsNiDx4tEBJmDPsZ9RSkAZrbjw==
authorization-attribute user-role level-3
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
local-user yetech class manage
password hash $h$6$cuyH1+Pvj2qrtYKZ$aMv8MmKP4qw9Ac3izxitlYKZxf6jRdGce4TC6EDBW0Srx/xGv1B6grGbz3rlhXhocs9UAny50jXfGT99Mwa9pw==
service-type ssh terminal https
authorization-attribute work-directory slot1#flash:
authorization-attribute user-role network-admin
#
local-user hawk2 class network
password cipher $c$3$9Ygy+CBuClaktigSQRzqn4C5aratU3cKiyQ=
service-type sslvpn
group segroup
authorization-attribute user-role network-operator
#
pki domain yetsslvpn
undo crl check enable
#
ssl version ssl3.0 disable
#
ssl server-policy ssl
pki-domain yetsslvpn
#
ssl client-policy sslclient
pki-domain yetsslvpn
prefer-cipher dhe_rsa_aes_256_cbc_sha rsa_aes_256_cbc_sha dhe_rsa_aes_128_cbc_sha rsa_aes_128_cbc_sha rsa_3des_ede_cbc_sha exp_rsa_des_cbc_sha rsa_des_cbc_sha rsa_rc4_128_md5 rsa_rc4_128_sha exp_rsa_rc4_md5 exp_rsa_rc2_md5
prefer-cipher rsa_aes_128_cbc_sha256 rsa_aes_256_cbc_sha256 dhe_rsa_aes_128_cbc_sha256 dhe_rsa_aes_256_cbc_sha256 ecdhe_rsa_aes_128_cbc_sha256 ecdhe_rsa_aes_256_cbc_sha384 ecdhe_rsa_aes_128_gcm_sha256 ecdhe_rsa_aes_256_gcm_sha384 ecdhe_ecdsa_aes_128_cbc_sha256 ecdhe_ecdsa_aes_256_cbc_sha384 ecdhe_ecdsa_aes_128_gcm_sha256
prefer-cipher ecdhe_ecdsa_aes_256_gcm_sha384
undo server-verify enable
#
session synchronization enable
session synchronization http
#
ipsec logging negotiation enable
#
ike logging negotiation enable
#
ip https enable
#
inspect logging parameter-profile url_logging_default_parameter
#
loadbalance isp file flash:/lbispinfo_v1.5.tp
#
sslvpn ip address-pool userpool 10.5.2.2 10.5.2.200
#
sslvpn gateway sslvpngw
ip address 10.200.43.251
service enable
#
sslvpn context ctx1
gateway sslvpngw
ip-tunnel interface SSLVPN-AC1
ip-tunnel address-pool userpool mask 255.255.255.0
ip-tunnel log connection-close
ip-route-list 49193
include 10.200.49.193 255.255.255.255
policy-group segp
filter ip-tunnel acl 3000
filter web-access acl 3000
filter tcp-access acl 3000
ip-tunnel access-route force-all
ip-tunnel access-route ip-route-list 49193
ip-tunnel address-pool userpool mask 255.255.255.0
default-policy-group segp
aaa domain sslisp
log user-login enable
log resource-access enable
sms-imc address 10.200.49.190 port 8080
sms-imc enable
service enable
#
sslvpn log enable
#
security-policy ip
rule 0 name any-any
action pass
#
return
组网及组网描述：
- 2021-11-10提问
- 举报
-
(0)
最佳答案
AC口没加安全域，所以不通。SSLVPN可以理解成如下两个过程。
1.拨号过程，外网到网关接口的过程，策略是外网到本地也就是local就行。
2.访问内网过程，外网流量到本地进行封装，封装是在AC口操作，逻辑上可以认为这个报文是AC口进来，然后访问内网，因此要AC口到内网的策略放通。AC口也需要放入安全域。
- 2021-11-11回答
- 评论(1)
- 举报
-
(0)
就是这个原因，太感谢了！！！
看下终端路由是否下发成功了
- 2021-11-10回答
- 评论(4)
- 举报
-
(0)
那就终端带源去ping 看看到哪不通 看看能不能ping通内网资源的网关地址呢
路由下发是成功的，10.200.49.193 255.255.255.255 在链路上10.5.2.2
路由跟踪一下 看看到哪没了
那就终端带源去ping 看看到哪不通 看看能不能ping通内网资源的网关地址呢
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
就是这个原因，太感谢了！！！