单畅,某局点F10X0防火墙sslvpn拨入用户访问外网不通故障案例

问题描述

防火墙25口接政务网，做ospf和VPN实例，内网用户通过NAT出去访问政务网资源；

24口接互联网，做SSL VPN拨号，通过iNode客户端获取172.168.0.x的地址；

电脑通过iNode拨号后，无法访问政务网的地址。

过程分析

接口配置如下：

#

interface GigabitEthernet1/0/24

 port link-mode route

 description T-联通互联网专线

 ip address 123.13.176.208 255.255.255.0

 gateway 123.13.176.1

#

interface GigabitEthernet1/0/25

 port link-mode route

#

interface GigabitEthernet1/0/25.10

 ip address 172.16.201.202 255.255.255.252

 ospf network-type p2p

 vlan-type dot1q vid 10

#

interface GigabitEthernet1/0/25.2001

 ip binding vpn-instance KF_GongXiang_2001

 ip address 100.79.38.146 255.255.255.252

 ospf network-type p2p

 nat outbound 3001 address-group 1 vpn-instance KF_GongXiang_2001

 vlan-type dot1q vid 2001

#

#

sslvpn context SSLVPNSL

 gateway SSLVPNWG

 ip-tunnel interface SSLVPN-AC1

 ip-tunnel address-pool SSLVPN地址池 mask 255.255.224.0

 ip-tunnel dns-server primary 202.102.224.68

 ip-tunnel dns-server secondary 114.114.114.114

 ip-route-list 1

  include 0.0.0.0 0.0.0.0

  include 10.46.0.0 255.255.0.0

  include 59.0.0.0 255.0.0.0 

 policy-group SSLVPN资源组

  filter ip-tunnel acl 3999

  ip-tunnel access-route ip-route-list 1

  ip-tunnel address-pool SSLVPN 地址池  mask 255.255.224.0

 default-policy-group SSLVPN资源组

 force-logout max-onlines enable

 service enable

#

 ip route-static vpn-instance KF_GongXiang_2001 0.0.0.0 0 100.79.38.145

 #

ospf 2 vpn-instance KF_GongXiang_2001

 import-route direct route-policy YeWu

 import-route static

 area 0.0.0.0

  network 59.227.246.144 0.0.0.7

#

  network 100.79.38.144 0.0.0.3

#

查看配置有VPN路由配置，sslvpn ip-route-list 引入了全零路由。

但是外网接口绑定了vpn实例，sslvpn进来后由于AC口没有绑定VPN实例，所以进入了全局，需要增加配置ip route-static 0.0.0.0 0  vpn-instance  KF_GongXiang 100.79.38.145，即destination口绑定了VPN实例KF_GongXiang

解决方法

增加配置ip route-static 0.0.0.0 0  vpn-instance  KF_GongXiang 100.79.38.145解决