VPN连接正常，总部无法访问分部资源，分部可以访问

原来公司只有一条专线，公网IP（1.1.5.2）vpn连接分部（2.2.51.2）互访正常的，后面我增加了一条ppoe宽带后，指定某些ip走ppoe线上网，VPN变得不正常了，分部可以访问总部，

总部访问不了分部，到底是哪出问题，是没有做安全策略的原因吗？

 

 

总部的防火墙设置

 

第一部分：

 

security-zone name Local

#

security-zone name Trust

 import interface Vlan-interface1000

 import interface GigabitEthernet1/0/12 vlan 1000

 attack-defense apply policy test

#

security-zone name DMZ

#

security-zone name Untrust

 import interface Dialer0

 import interface GigabitEthernet1/0/14

 import interface GigabitEthernet1/0/15

 attack-defense apply policy test

 

security-zone name Management

 import interface GigabitEthernet1/0/0

#

security-zone name SSLVPN

 import interface SSLVPN-AC1

#

zone-pair security source Local destination Trust

 packet-filter 3000

#

zone-pair security source Local destination Untrust

 packet-filter 3000

#

zone-pair security source Trust destination Local

 packet-filter 3000

#

zone-pair security source Trust destination Untrust

 packet-filter 3000

#

zone-pair security source Untrust destination Local

 packet-filter 3000

#

zone-pair security source Untrust destination Trust

 packet-filter 3000

 

 

 第二部分：

 

<Firewall>dis security-zone

Name: Local

Members:

  None

 

Name: Trust

Members:

  Vlan-interface1000

  GigabitEthernet1/0/12 in VLAN 1000

 

Name: DMZ

Members:

  None

 

Name: Untrust

Members:

  GigabitEthernet1/0/14

  GigabitEthernet1/0/15

  Dialer0

 

Name: Management

Members:

  GigabitEthernet1/0/0

 

VPN 连接成功：

分部PING总部192.168.1.X正常，

总部192.168.1.X段PING分部220-225的IP,不通

 

<Firewall>dis ipsec tunnel brief

----------------------------------------------------------------------------

Tunn-id   Src Address     Dst Address     Inbound SPI   Outbound SPI  Status

----------------------------------------------------------------------------

1            1.1.5.2             2.2.51.2   391981512     2852090387    Active

2            1.1.5.2             2.2.51.2   3767718891    1635401720    Active

4            1.1.5.2             2.2.51.2   2003696615    4212483329    Active

8            1.1.5.2             2.2.51.2  3313886591    522925553     Active

9            1.1.5.2             2.2.51.2   1224640206    1357012895    Active

 

 

<Firewall>dis acl 3002

Advanced IPv4 ACL 3002, 17 rules,

IPSEC

ACL's step is 5

 rule 20 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.222.0 0.0.0.255 (73417 times matched)

 rule 110 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.220.0 0.0.0.127 (969998 times matched)

 rule 111 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.221.0 0.0.0.255 (1179470 times matched)

 rule 112 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.223.0 0.0.0.127 (4032 times matched)

 rule 113 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.224.0 0.0.0.31 (556 times matched)

 

 

 

acl advanced 3001

 description NAT

 rule 20 deny ip source 192.168.1.0 0.0.0.255 destination 192.168.220.0 0.0.0.127

 rule 21 deny ip source 192.168.1.0 0.0.0.255 destination 192.168.221.0 0.0.0.255

 rule 22 deny ip source 192.168.1.0 0.0.0.255 destination 192.168.223.0 0.0.0.127

 rule 23 deny ip source 192.168.1.0 0.0.0.255 destination 192.168.224.0 0.0.0.31

 rule 23 deny ip source 192.168.1.0 0.0.0.255 destination 192.168.225.0 0.0.0.31

 rule 100 permit ip

 

 

interface GigabitEthernet1/0/14

 port link-mode route

 description ppoe

 ip address unnumbered interface Dialer0

 pppoe-client dial-bundle-number 0

 

interface GigabitEthernet1/0/15

 port link-mode route

 ip address 1.1.5.24 255.255.255.252

 nat outbound 3001

 ipsec apply policy test

 

 

ip route-static 0.0.0.0 0 1.1.5.1 preference 30

 ip route-static 0.0.0.0 0 Dialer0

 ip route-static 192.168.1.0 24 1.1.1.1

 

 

ipsec transform-set test

 esp encryption-algorithm des-cbc

 esp authentication-algorithm sha1

#

ipsec policy-template test 1

 transform-set test

 security acl 3002

 local-address 1.1.5.2

 ike-profile test

#

ipsec policy test 1 isakmp template test

#

nat server-group 3001