我有两个站点通过 Cisco 的站点到站点 VPN 连接。一个站点有 Cisco ASA 路由器，另一个站点有 Cisco 870 路由器
隧道已经建立，并且活跃，但是我无法通过该链接发送任何流量……
ASA 配置为：
ASA Version 8.0(2)
!
hostname ASA
enable password **** encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 172.16.10.5 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address x.x.x.x 255.255.255.248
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd **** encrypted
boot system disk0:/asa802-k8.bin
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
object-group service RDP tcp
port-object eq 3389
object-group network DM_INLINE_NETWORK_1
network-object 172.16.20.0 255.255.255.0
network-object 172.16.200.0 255.255.255.0
access-list 80 extended permit ip 172.16.10.0 255.255.255.0 object-group DM_INLINE_NETWORK_1
access-list 80 extended permit ip 172.16.10.0 255.255.255.0 172.16.20.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 172.16.10.0 255.255.255.0 172.16.20.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
asdm image disk0:/asdm-611.bin
no asdm history enable
arp timeout 14400
global (outside) 1 x.x.x.x-y.y.y.y netmask 255.0.0.0
global (outside) 1 interface
nat (inside) 0 access-list 80
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 z.z.z.z 1
route outside 172.16.20.0 255.255.255.0 a.a.a.a 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
http server enable
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set strong esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer a.a.a.a
crypto map outside_map 1 set transform-set ESP-DES-SHA
crypto map outside_map interface outside
crypto isakmp enable inside
crypto isakmp enable outside
crypto isakmp policy 8
authentication pre-share
encryption 3des
hash sha
group 2
lifetime none
crypto isakmp policy 30
authentication pre-share
encryption des
hash sha
group 1
lifetime 86400
no crypto isakmp nat-traversal
telnet 172.16.10.0 255.255.255.0 inside
telnet timeout 5
ssh 172.16.10.0 255.255.255.0 inside
ssh timeout 5
ssh version 2
console timeout 0
dhcpd auto_config outside
!
threat-detection basic-threat
threat-detection statistics access-list
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect pptp
!
service-policy global_policy global
tunnel-group a.a.a.a type ipsec-l2l
tunnel-group a.a.a.a ipsec-attributes
pre-shared-key *
prompt hostname context
Cryptochecksum:f9c4dfffca26f9975d64ad42a3a71452
: end
asdm image disk0:/asdm-611.bin
no asdm history enable
870配置为：
Current configuration : 3749 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
!
boot-start-marker
boot-end-marker
!
no logging buffered
enable secret 5 ****
!
aaa new-model
!
!
aaa authentication login default local
aaa authorization exec default local
!
!
aaa session-id common
dot11 syslog
ip cef
!
!
!
!
!
username Administrator view root secret 5 ****
!
!
crypto isakmp policy 1
encr 3des
authentication pre-share
group 2
!
crypto isakmp policy 2
authentication pre-share
crypto isakmp key * address x.x.x.x
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac
crypto ipsec transform-set ASA esp-des esp-sha-hmac
!
crypto map SDM_CMAP_1 1 ipsec-isakmp
description Tunnel tox.x.x.x
set peer x.x.x.x
set transform-set ASA
match address 102
!
archive
log config
hidekeys
!
!
controller DSL 0
line-term cpe
!
!
!
!
interface BRI0
no ip address
encapsulation hdlc
shutdown
!
interface FastEthernet0
!
interface FastEthernet1
switchport access vlan 2
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
ip address 172.16.20.6 255.255.255.0
!
interface Vlan2
ip address a.a.a.a 255.255.192.0
crypto map SDM_CMAP_1
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 b.b.b.b
!
no ip http server
ip http secure-server
!
access-list 102 remark CCP_ACL Category=4
access-list 102 remark IPSec Rule
access-list 102 permit ip 172.16.20.0 0.0.0.255 172.16.10.0 0.0.0.255
!
!
!
control-plane
!
!
line con 0
no modem enable
line aux 0
line vty 0 4
transport input ssh
transport output ssh
!
scheduler max-task-time 5000
end
其中aaaa是870路由器的外网ip，xxxx是ASA路由器的外网ip。有些部分省略了，密码也删掉了。
从任一网络中的任何主机 ping 另一个网络中的任何主机均不起作用。 RDP 会话、SSH 会话等也不起作用……（因此不仅仅是 ICMP）
答案1
从您的 ASA 中删除以下内容
route outside 172.16.20.0 255.255.255.0 a.a.a.a 1
通过此路由声明，ASA 将无法通过隧道发送或返回流量。
此外，您可以在加密图中引用的以下 ACL 中定义“要保护/有趣”的流量。
access-list outside_1_cryptomap extended permit ip 172.16.10.0 255.255.255.0 172.16.20.0 255.255.255.0
当查看上面的加密映射匹配 ACL 时，您的 nat 豁免/身份很有趣。
object-group network DM_INLINE_NETWORK_1
network-object 172.16.20.0 255.255.255.0
network-object 172.16.200.0 255.255.255.0
access-list 80 extended permit ip 172.16.10.0 255.255.255.0 object-group DM_INLINE_NETWORK_1
access-list 80 extended permit ip 172.16.10.0 255.255.255.0 172.16.20.0 255.255.255.0
nat (inside) 0 access-list 80
您的访问列表 80 中有冗余匹配。当对象组展开时，ACL 的第 1 行将与 ACL 的第 2 行匹配。冗余，可能应该修复，但不太可能是此处出现任何问题的原因。