防火墙sslvpn拨号成功,外网无法ping通内网地址
配置如下:
#
version 7.1.064, Alpha 7164
#
sysname H3C
#
context Admin id 1
#
telnet server enable
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
xbar load-single
password-recovery enable
lpu-type f-series
#
vlan 1
#
interface NULL0
#
interface GigabitEthernet1/0/0
port link-mode route
combo enable copper
#
interface GigabitEthernet1/0/1
port link-mode route
combo enable copper
ip address 192.168.0.44 255.255.255.0
#
interface GigabitEthernet1/0/2
port link-mode route
combo enable copper
#
interface GigabitEthernet1/0/3
port link-mode route
combo enable copper
ip address 172.16.1.1 255.255.255.0
#
interface GigabitEthernet1/0/4
port link-mode route
combo enable copper
#
interface SSLVPN-AC1
ip address 10.10.10.1 255.255.255.0
#
security-zone name Local
#
security-zone name Trust
import interface GigabitEthernet1/0/3
#
security-zone name DMZ
#
security-zone name Untrust
import interface GigabitEthernet1/0/1
import interface SSLVPN-AC1
#
security-zone name Management
#
zone-pair security source Any destination Any
packet-filter 3000
#
scheduler logfile size 16
#
line class aux
user-role network-operator
#
line class console
user-role network-admin
#
line class tty
user-role network-operator
#
line class vty
user-role network-operator
#
line aux 0
user-role network-admin
#
line con 0
authentication-mode scheme
user-role network-admin
#
line vty 0 4
authentication-mode scheme
user-role network-admin
#
line vty 5 63
user-role network-operator
#
info-center loghost 127.0.0.1 port 3301 format default
info-center source CFGLOG loghost level informational
#
acl advanced 3000
rule 0 permit ip
#
domain system
#
aaa session-limit ftp 16
aaa session-limit telnet 16
aaa session-limit ssh 16
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 rol
role name level-1
description Predefined level-1 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password hash $h$6$WblAckcja5HMJHge$iLRdhZyeKwTN3DDS6s89wFN2BEUApVOKReZbJW2jD3pFF6Ti4Qv1TTQx7E/VLlJHuO93KCCyjaUZAWdEF3EWzw==
service-type telnet terminal http https
authorization-attribute user-role level-3
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
local-user sslvpn class network
password cipher $c$3$RKDInb vg7tjttGitZ/ytHTvJsNQcg3Uq7hM6w==
service-type sslvpn
authorization-attribute acl 3000
authorization-attribute user-role network-operator
authorization-attribute sslvpn-policy-group sslvpnziyuan
#
ip http enable
ip https enable
#
sslvpn ip address-pool sslvpnpool 10.10.10.1 10.10.10.254
#
sslvpn gateway sslvpngw
ip address 192.168.0.44 port 2000
service enable
#
sslvpn context sslvpn
gateway sslvpngw
ip-tunnel interface SSLVPN-AC1
ip-tunnel address-pool sslvpnpool mask 255.255.255.0
ip-route-list list
include 172.16.0.0 255.255.255.0
policy-group sslvpnziyuan
ip-tunnel access-route ip-route-list list
ip-tunnel address-pool sslvpnpool mask 255.255.255.0
force-logout max-onlines enable
service enable
#
security-policy ip
rule 6 name any
action pass
source-zone Local
source-zone Trust
source-zone DMZ
source-zone Untrust
source-zone Management
destination-zone Local
destination-zone Trust
destination-zone DMZ
destination-zone Untrust
destination-zone Management
#
return