因此，我有一个带有 2 个站点到站点 VPN 和一个远程访问 VPN 的 Cisco ASA 5505 设置，现在任何连接的东西（硬连线、S2S VPN 或 RA VPN）都可以毫无问题地相互通信。
问题是通过其中一个 S2S VPN 出现的，我有一个 Active Directory 设置，我正在尝试更改 RA VPN 以使用此 AS DS 提供的 LDAP 登录，但看起来 ASA 本身无法通过 S2S VPN 进行通信。
因此 AD DS 服务器位于 IP10.1.18.109
（ASA 运行的网络范围）
ASA is on 10.101.0.1/255.255.0.0
In Office (so Hardwired into ASA) is on 10.101.1.0/255.255.0.0
RA VPN is on 10.101.2.0/255.255.0.0
（通过 S2S VPN 连接网络）
S2S VPN Ireland is on 10.2.0.0/255.255.0.0
S2S VPN London is on 10.1.0.0/255.255.0.0
因此我需要 ASA 与 10.1.18.109 通信，目前它无法以任何方式与它通信，LDAP 只是连接超时，并且 ping 失败。
我尝试过
VPN 的所有 NAT 规则都已启用路由查找，并且已检查 ACL，因此应允许
我如何测试
我已经通过内部ping inside 10.1.18.109和外部VLAN 测试了 ping 操作ping outside 10.1.18.109
我认为错误
我不是最好的，所以我认为这与在 10.101.0.1 IP 地址上运行的 ASA 有关，并且不允许它访问 VPN
当前配置。
: Saved
:
ASA Version 9.1(1)
!
hostname ciscoasa
domain-name fabrikam.ltd
enable password xxxxxxxxxxxxxx encrypted
passwd xxxxxxxxxxxxxxxx encrypted
names
ip local pool OutOfOfficePool 10.101.2.1-10.101.2.254 mask 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
ip address 10.101.0.1 255.255.0.0
!
interface Vlan2
nameif outside
security-level 0
ip address y.y.y.y 255.255.255.248
!
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
name-server 10.1.18.109
domain-name fabrikam.ltd
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network inside
subnet 10.101.0.0 255.255.0.0
object network inside-subnet
subnet 10.101.0.0 255.255.0.0
object network obj-SrcNet
subnet 0.0.0.0 0.0.0.0
object network obj-amzn-lon
subnet 10.1.0.0 255.255.0.0
object network obj-amzn-ire
subnet 10.2.0.0 255.255.0.0
object network NETWORK_OBJ_10.101.2.0_24
subnet 10.101.2.0 255.255.255.0
object network inoffice
subnet 10.101.1.0 255.255.255.0
object network outoffice
subnet 10.101.2.0 255.255.255.0
object network 10.X.X.X
range 10.2.0.0 10.2.255.255
access-list outside_acl extended permit ip host x.x.x.x host y.y.y.y
access-list outside_acl extended permit ip host v.v.v.v host y.y.y.y
access-list outside_acl extended permit ip host m.m.m.m host y.y.y.y
access-list outside_acl extended permit ip host z.z.z.z host y.y.y.y
access-list acl-amzn-lon extended permit ip any 10.1.0.0 255.255.0.0
access-list IRELAND-135 extended permit ip host m.m.m.m host y.y.y.y
access-list IRELAND-159 extended permit ip host z.z.z.z host y.y.y.y
access-list IRELAND-LOCAL extended permit ip any4 10.2.0.0 255.255.0.0
access-list outside_access_in extended permit ip host x.x.x.x host y.y.y.y
access-list outside_access_in extended permit ip host v.v.v.v host y.y.y.y
access-list acl-amzn extended permit ip any4 10.1.0.0 255.255.0.0
access-list amzn-filter extended permit ip 10.1.0.0 255.255.0.0 10.101.0.0 255.255.0.0
access-list ireland-filter extended permit ip 10.2.0.0 255.255.0.0 10.101.0.0 255.255.0.0
access-list outside_cryptomap_2 extended permit ip any4 10.2.0.0 255.255.0.0
access-list outside_cryptomap_2 extended permit ip any 10.1.0.0 255.255.0.0
access-list outside_cryptomap_3 extended permit ip any 10.2.0.0 255.255.0.0
access-list outside_cryptomap_1 extended permit ip any 10.1.0.0 255.255.0.0
access-list tcp_bypass extended permit tcp 10.101.1.0 255.255.255.0 10.101.2.0 255.255.255.0
access-list tcp_bypass extended permit tcp 10.1.0.0 255.255.0.0 10.101.2.0 255.255.255.0
access-list tcp_bypass extended permit tcp 10.101.2.0 255.255.255.0 10.1.0.0 255.255.0.0
access-list tcp_bypass extended permit tcp 10.2.0.0 255.255.0.0 10.101.2.0 255.255.255.0
access-list tcp_bypass extended permit tcp 10.101.2.0 255.255.255.0 10.2.0.0 255.255.0.0
access-list inside_access_in extended permit ip any any
access-list acl-outside extended permit icmp any any echo
access-list acl-inside extended permit icmp any any echo
access-list global_mpc extended permit ip any any
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static obj-SrcNet obj-SrcNet destination static obj-amzn-ire obj-amzn-ire route-lookup
nat (inside,outside) source static obj-SrcNet obj-SrcNet destination static obj-amzn-lon obj-amzn-lon route-lookup
nat (inside,outside) source static any any destination static NETWORK_OBJ_10.101.2.0_24 NETWORK_OBJ_10.101.2.0_24 no-proxy-arp route-lookup
!
object network obj_any
nat (inside,outside) dynamic interface
object network inside-subnet
nat (inside,outside) dynamic interface
!
nat (inside,outside) after-auto source dynamic any interface
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 109.239.111.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server LDAP_SRV_GRP protocol ldap
aaa-server LDAP_SRV_GRP (outside) host 10.1.18.109
ldap-base-dn dc=fabrikam, dc=ltd
ldap-scope subtree
ldap-naming-attribute sAMAccountName
ldap-login-password *****
ldap-login-dn cn=Administrator, cn=Users, dc=fabrikam, dc=ltd
server-type microsoft
user-identity default-domain LOCAL
http server enable
http 10.0.0.0 255.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
sysopt connection tcpmss 1379
sla monitor 1
type echo protocol ipIcmpEcho 10.1.0.1 interface outside
frequency 5
sla monitor schedule 1 life forever start-time now
sla monitor 2
type echo protocol ipIcmpEcho 10.2.0.1 interface outside
frequency 5
sla monitor schedule 2 life forever start-time now
sla monitor 5
type echo protocol ipIcmpEcho 8.8.8.8 interface outside
frequency 5
sla monitor schedule 5 life forever start-time now
crypto ipsec ikev1 transform-set transform-amzn-lon esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set transform-amzn-ire esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set transfrom-amzn esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set transform-amzn esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set transfrom-amzn1 esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set transform-amzn1 esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set transform-ireland esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES128-SHA1_TRANS esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES128-SHA1_TRANS mode transport
crypto ipsec ikev1 transform-set APPLE_CLIENT esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set APPLE_CLIENT mode transport
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec security-association replay window-size 128
crypto ipsec security-association pmtu-aging infinite
crypto ipsec df-bit clear-df outside
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-256-SHA ESP-3DES-SHA ESP-DES-SHA ESP-AES-128-SHA-TRANS ESP-AES-192-SHA-TRANS ESP-AES-256-SHA-TRANS ESP-3DES-SHA-TRANS ESP-DES-SHA-TRANS
crypto dynamic-map DYN_OUTSIDE 10000 set ikev1 transform-set ESP-AES128-SHA1_TRANS
crypto dynamic-map DYN_OUTSIDE 10000 set reverse-route
crypto map amazon_lon_map 1 match address acl-amzn-lon
crypto map amazon_lon_map 1 set pfs
crypto map amazon_lon_map 1 set peer x.x.x.x v.v.v.v
crypto map amazon_lon_map 1 set ikev1 transform-set transform-amzn-lon
crypto map amazon_lon_map 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map amazon_lon_map 1 set security-association lifetime seconds 3600
crypto map amazon_lon_map 2 match address outside_cryptomap_2
crypto map amazon_lon_map 2 set pfs
crypto map amazon_lon_map 2 set peer m.m.m.m z.z.z.z
crypto map amazon_lon_map 2 set ikev1 transform-set transform-ireland
crypto map amazon_lon_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map MAP_OUTSIDE 1 match address outside_cryptomap_1
crypto map MAP_OUTSIDE 1 set pfs
crypto map MAP_OUTSIDE 1 set peer x.x.x.x v.v.v.v
crypto map MAP_OUTSIDE 1 set ikev1 transform-set transfrom-amzn
crypto map MAP_OUTSIDE 1 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map MAP_OUTSIDE 1 set security-association lifetime seconds 3600
crypto map MAP_OUTSIDE 1 set reverse-route
crypto map MAP_OUTSIDE 2 match address outside_cryptomap_3
crypto map MAP_OUTSIDE 2 set pfs
crypto map MAP_OUTSIDE 2 set peer m.m.m.m z.z.z.z
crypto map MAP_OUTSIDE 2 set ikev1 transform-set transform-ireland
crypto map MAP_OUTSIDE 2 set security-association lifetime seconds 3600
crypto map MAP_OUTSIDE 2 set reverse-route
crypto map MAP_OUTSIDE 10000 ipsec-isakmp dynamic DYN_OUTSIDE
crypto map MAP_OUTSIDE interface outside
crypto ca trustpoint _SmartCallHome_ServerCA
crl configure
crypto ca trustpoint ASDM_TrustPoint0
enrollment self
subject-name CN=ciscoasa
keypair OutOfOfficeKeyPair
proxy-ldc-issuer
crl configure
crypto ca trustpoint ASDM_TrustPoint1
enrollment terminal
subject-name CN=leeds.internal.fabrikam.ltd,O=fabrikam Limited,C=UK
keypair OutOfOfficeKeyPair
crl configure
crypto ca trustpoint ASDM_TrustPoint2
enrollment terminal
crl configure
crypto ca trustpoint ASDM_TrustPoint3
enrollment terminal
no validation-usage
crl configure
crypto ca trustpool policy
crypto ca certificate chain _SmartCallHome_ServerCA
certificate ca * removed*
quit
crypto ca certificate chain ASDM_TrustPoint0
certificate 7f301c5c *removed*
quit
crypto ca certificate chain ASDM_TrustPoint3
certificate ca *removed*
quit
crypto isakmp identity address
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev1 enable outside
crypto ikev1 policy 201
authentication pre-share
encryption aes
hash sha
group 2
lifetime 28800
crypto ikev1 policy 1000
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 2000
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 3000
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd domain leeds.internal.fabrikam.ltd
dhcpd auto_config outside
dhcpd option 3 ip 10.101.0.1 y.y.y.y
dhcpd option 6 ip 10.1.13.58 8.8.8.8
!
dhcpd address 10.101.1.1-10.101.1.254 inside
dhcpd domain leeds.internal.fabrikam.ltd interface inside
dhcpd option 3 ip 10.101.0.1 interface inside
dhcpd option 6 ip 10.1.13.58 8.8.8.8 interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
enable outside
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
dns-server value 8.8.8.8 8.8.4.4
vpn-tunnel-protocol l2tp-ipsec
default-domain value leeds.internal.fabrikam.ltd
group-policy DfltGrpPolicy attributes
group-policy OutOfOffice internal
group-policy OutOfOffice attributes
dns-server value 10.1.18.109 1.1.1.1
vpn-tunnel-protocol ikev1 l2tp-ipsec
default-domain value leeds.internal.fabrikam.ltd
group-policy ireland-filter internal
group-policy ireland-filter attributes
vpn-filter value ireland-filter
vpn-tunnel-protocol ikev1
group-policy filter1 internal
group-policy filter1 attributes
vpn-filter value amzn-filter
vpn-tunnel-protocol ikev1 ikev2
group-policy filter internal
group-policy filter attributes
vpn-filter value acl-amzn
username user1 password xxxxxxxxxxxxxxxxxxxxxxxx nt-encrypted
username user1 attributes
vpn-group-policy OutOfOffice
vpn-tunnel-protocol ikev1 l2tp-ipsec
service-type remote-access
tunnel-group DefaultRAGroup general-attributes
address-pool OutOfOfficePool
default-group-policy DefaultRAGroup
tunnel-group DefaultRAGroup ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group DefaultRAGroup ppp-attributes
authentication pap
authentication ms-chap-v2
tunnel-group x.x.x.x type ipsec-l2l
tunnel-group x.x.x.x general-attributes
default-group-policy filter1
tunnel-group x.x.x.x ipsec-attributes
ikev1 pre-shared-key *****
isakmp keepalive threshold 10 retry 10
tunnel-group v.v.v.v type ipsec-l2l
tunnel-group v.v.v.v general-attributes
default-group-policy filter1
tunnel-group v.v.v.v ipsec-attributes
ikev1 pre-shared-key *****
isakmp keepalive threshold 10 retry 10
tunnel-group IRELAND-135 type ipsec-l2l
tunnel-group IRELAND-135 general-attributes
default-group-policy ireland-filter
tunnel-group IRELAND-135 ipsec-attributes
ikev1 pre-shared-key *****
isakmp keepalive threshold 10 retry 10
tunnel-group IRELAND-159 type ipsec-l2l
tunnel-group IRELAND-159 general-attributes
default-group-policy ireland-filter
tunnel-group IRELAND-159 ipsec-attributes
ikev1 pre-shared-key *****
isakmp keepalive threshold 10 retry 10
tunnel-group OutOfOffice type remote-access
tunnel-group OutOfOffice general-attributes
address-pool OutOfOfficePool
authentication-server-group LDAP_SRV_GRP LOCAL
default-group-policy OutOfOffice
tunnel-group OutOfOffice ipsec-attributes
ikev1 pre-shared-key *****
ikev1 trust-point ASDM_TrustPoint0
tunnel-group OutOfOffice ppp-attributes
authentication ms-chap-v2
tunnel-group m.m.m.m type ipsec-l2l
tunnel-group m.m.m.m general-attributes
default-group-policy ireland-filter
tunnel-group m.m.m.m ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group z.z.z.z type ipsec-l2l
tunnel-group z.z.z.z general-attributes
default-group-policy ireland-filter
tunnel-group z.z.z.z ipsec-attributes
ikev1 pre-shared-key *****
!
class-map inspection_default
match access-list global_mpc
match default-inspection-traffic
class-map tcp_bypass
match access-list tcp_bypass
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
policy-map tcp_bypass_policy
class tcp_bypass
set connection advanced-options tcp-state-bypass
!
service-policy global_policy global
service-policy tcp_bypass_policy interface inside
prompt hostname context
no call-home reporting anonymous
: end
我甚至尝试过 80 端口 TCP ping，但无济于事，
在外部接口上
Sending 5 TCP SYN requests to 10.1.18.109 port 80
from 109.239.111.4, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
在内部接口上
Sending 5 TCP SYN requests to 10.1.18.109 port 80
from 109.239.111.4, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
Amazon AWS 的 VPC 流日志未显示任何尝试连接到该 IP 地址
我的 NAT 规则一目了然，
答案1
在这种情况下，您需要使用management-access <interface-name>全局命令，其中“<interface-name>”是内部接口名称。默认情况下，ASA 不会将其自己的流量放入 VPN 隧道，因此此命令允许该行为。此命令还允许您从隧道的另一端通过 SSH 连接到防火墙。
为了使其正常工作，涵盖防火墙子网的 NAT 语句需要route-lookup添加关键字，听起来您的已经这样做了。
答案2
让我根据你的描述指出一般的“提示”，看看要检查什么。希望它能有所帮助，即使它不是直接的“复制粘贴”解决方案。我提前为没有仔细检查你提供的配置而感到抱歉…… :-)
NAT - 此 LDAP 流量的源地址/接口
通常，NAT 是针对网络设置的，因此经过的流量（不是直接源自 ASA）会“匹配”规则以“排除”默认 NAT（MASQUERADE）或设置流量所需的特定 NAT。尝试捕获少量相关流量并关注数据包的源 IP。源可能不是您所期望的...
如果您尚未明确处理，则相关接口（即使对于 ipsec 隧道）也在外部。在这种情况下，IP 不是您在“ipsec 隧道”通信配置中期望/设置的 IP（加密图、NAT、防火墙规则等），结果是此通信无法工作，即使从任何其他“内部”设备进行通信，它也能正常工作。在这种情况下，此流量的明确 NAT 规则将有助于使通信适合隧道（我想到的第一个选项）。