Исходное сообщение
"Asa5505 нет выхода на внешний vpn сервер" Отправлено decrups, 13-Янв-10 08:30
Доброе время суток. Возникла необходимость стыковаться изнутри по VPN на внешний сервер. Между клиентом и сервером стоит ASA5505 version 7.2(2): клиент VPN <---> ASA5505 <---> сервер VPN Клиент стандартный виндовой. При попытке соединения клиента, вылетает ошибка 619. Хотя без промежуточной Циски все работает. вот конфига hostname ciscoasa domain-name default.domain.invalid enable password PLBb27eKLE1o9FTB encrypted names ! interface Vlan103 nameif inside security-level 100 ip address 192.168.1.1 255.255.255.0 ! interface Vlan104 nameif outside security-level 0 pppoe client vpdn group ххх ip address pppoe ! ftp mode passive dns domain-lookup outside dns server-group DefaultDNS retries 1 name-server 62.231.161.9 name-server 208.67.222.222 domain-name default.domain.invalid same-security-traffic permit inter-interface access-list racces extended permit tcp any host х.х.х.х eq 3380 access-list racces extended permit tcp any host х.х.х.хeq 3355 access-list racces extended permit tcp any host х.х.х.х eq 3341 access-list racces extended permit tcp any host х.х.х.х eq 3340 access-list racces extended permit icmp any host х.х.х.х access-list racces extended permit tcp any host х.х.х.х eq 3381 access-list alownat extended permit ip 192.168.0.0 255.255.255.0 any access-list alownat extended permit ip 192.168.1.0 255.255.255.0 any access-list ICMPACL extended permit icmp any any access-list inside_outside extended permit tcp any any eq www access-list inside_outside extended permit icmp any any access-list inside_outside extended permit udp any any eq domain access-list inside_outside extended permit tcp any any eq aol access-list inside_outside extended permit tcp any any eq smtp access-list inside_outside extended permit tcp any any eq pop3 access-list inside_outside extended permit tcp any any eq 9999 access-list inside_outside extended permit tcp any any eq https access-list inside_outside extended permit tcp any any eq 1194 access-list inside_outside extended permit tcp any any eq 3390 access-list inside_outside extended permit tcp any any eq 3389 access-list inside_outside extended permit udp any any eq 1194 access-list inside_outside extended permit tcp any any eq ftp access-list inside_outside extended permit tcp any any eq ftp-data access-list inside_outside extended permit tcp any any eq 8080 access-list inside_outside extended permit tcp any any eq 3355 access-list inside_outside extended permit tcp any any eq pptp access-list inside_outside extended permit gre any any access-list FTPACL extended permit tcp any any eq ftp access-list FTPACL extended permit tcp any any eq ftp-data access-list alow_vpn extended permit ip 192.168.5.0 255.255.255.0 any pager lines 24 mtu inside 1500 mtu outside 1500 ip local pool user_vpn 192.168.1.100-192.168.1.110 mask 255.255.255.0 icmp unreachable rate-limit 1 burst-size 1 icmp permit any inside asdm image disk0:/asdm-522.bin no asdm history enable arp timeout 14400 nat-control   global (outside) 1 interface nat (inside) 0 access-list alow_vpn nat (inside) 1 access-list alownat static (inside,outside) tcp interface 3341 192.168.1.2 3307 netmask 255.255.255.255 static (inside,outside) tcp interface 3340 192.168.1.2 3306 netmask 255.255.255.255 static (inside,outside) tcp interface 3380 192.168.1.2 3380 netmask 255.255.255.255 static (inside,outside) tcp interface 3355 192.168.1.2 3355 netmask 255.255.255.255 static (inside,outside) tcp interface 3381 192.168.1.2 3381 netmask 255.255.255.255 access-group inside_outside in interface inside access-group racces in interface outside route outside 0.0.0.0 0.0.0.0 62.231.160.28 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout uauth 0:05:00 absolute group-policy test internal group-policy test attributes vpn-tunnel-protocol IPSec l2tp-ipsec webvpn webvpn   functions url-entry file-access file-entry file-browsing mapi port-forward filter http-proxy auto-download citrix   svc required username aria password hrQJD8m6imkmheRR encrypted username it_serv password pqTbTfo5OBDPP2x6 encrypted privilege 15 aaa authentication enable console LOCAL aaa authentication telnet console LOCAL aaa local authentication attempts max-fail 5 http server enable http 192.168.1.2 255.255.255.255 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart tunnel-group remote_users type webvpn tunnel-group remote_users general-attributes address-pool user_vpn default-group-policy test tunnel-group remote_users webvpn-attributes group-alias itserv enable telnet 192.168.1.2 255.255.255.255 inside telnet timeout 60 ssh timeout 5 console timeout 0 vpdn group test request dialout pppoe vpdn group test localname хххх vpdn group test ppp authentication pap vpdn username хххх password ********* store-local !             class-map FTP-CLASS match access-list FTPACL class-map ICMP-CLASS match access-list ICMPACL ! ! policy-map ICMP-POLICY class ICMP-CLASS   inspect icmp class FTP-CLASS   inspect ftp ! service-policy ICMP-POLICY global webvpn enable outside svc enable url-list Serverlist "SGATE" http://192.168.1.2 1 tunnel-group-list enable prompt hostname context Cryptochecksum:ef7d316890972123f3831f6e7124bc43 : end Нашел похожее только вместо асы 2800, говорят иос обновили все заработало. Может что в конфиге добавить надо?