S87p0,V7防火墙SSLVPN不能ping通内网地址
根据案例中心的案例配置了V7版本防火墙的SSL VPN(防火墙透明接入网络),登录、获取地址都正常,但是访问其他内网资源就不通,比如与防火墙直连的路由器和交换机的接口地址。
请大神帮忙看看还有配置哪里有问题。
组网及组网描述:
主要配置如下:
#
version 7.1.
#
context Admin id 1
#
telnet server enable
#
vlan 1
#
interface Vlan-interface1
ip address 1
#
interface SSLVPN-AC
ip address 1
#
object-policy ip 1
rule
#
object-policy ip Any-Any
rule
#
security-zone name Local
#
security-zone name Trust
import interface SSLVPN-AC
import interface Vlan-interface1
import interface GigabitEthernet1/
#
security-zone name DMZ
#
security-zone name Untrust
import interface GigabitEthernet1/
#
security-zone name Management
import interface GigabitEthernet1/
#
zone-pair security source Any destination Any
object-policy apply ip Any-Any
packet-filter 3333
#
zone-pair security source Trust destination Local
object-policy apply ip 1
#
zone-pair security source Trust destination Untrust
object-policy apply ip 1
#
scheduler logfile size 16
#
ip route-static
#
ssh server enable
#
acl advanced 3333
rule
#
domain system
#
domain default enable system
#
user-group user-group1
authorization-attribute sslvpn-policy-group pgroup
#
local-user h3c class network
password cipher $c$3$AAzi
service-type sslvpn
group user-group1
authorization-attribute user-role network-operator
#
pki domain sslvpn
public-key rsa general name sslvpn
undo crl check enable
#
ssl server-policy ssl
pki-domain sslvpn
#
sslvpn ip address-pool 1 1
#
sslvpn gateway gw
ip address 1
ssl server-policy ssl
service enable
#
sslvpn context ctx1
gateway gw
ip-tunnel interface SSLVPN-AC
ip-tunnel address-pool 1 mask 255.255.255.
ip-route-list 123
include 1
policy-group pgroup
filter ip-tunnel acl 3333
ip-tunnel access-route ip-route-list 123
default-policy-group pgroup
service enable
#
trust到trust的策略放通下
防火墙ping你的内网资源能通吗
不行,还是不通
S87p有会话吗,display session table ipv4 destination-ip x.x.x.x ver,x.x.x.x是你ping的那个地址,看看有路由吗,回程有路由吗
狗剩 发表时间:2有会话,但都是内部地址的会话,没有vpn ip的会话。路由器回指了一条1
最后怎么解决的,遇到相同的问题
VOiV3H 发表时间:2CRM论坛(CRMbbs.com)——一个让用户更懂CRM的垂直性行业内容平台,CRM论坛致力于互联网、客户管理、销售管理、SCRM私域流量内容输出5年。 如果您有好的内容,欢迎向我们投稿,共建CRM多元化生态体系,创建CRM客户管理一体化生态解决方案。,V7防火墙SSLVPN不能ping通内网地址