求助，请高手指点，asa5510,做remote access vpn，ping内网服务器，时断时续

remote access vpn 已经做成功，连接很正常。但连通后，ping内网服务器的ip（159.46.5.0网段的），有的时候通，有的时候不通。请高手看看！配置如下


: Z9 R: T, l0 ^# X, M, }; ?!
interface Ethernet0/0
& a& B* s" r; h! {& w0 A, g1 j nameif out
security-level 0
ip address 59.42.158.242 255.255.255.248
6 E4 K( M" U/ q3 h!
% V% C$ S  p/ ~interface Ethernet0/1
nameif ins
security-level 100
0 T3 {5 Y5 M% ]) `0 V- \7 Y0 o- [ ip address 159.46.30.1 255.255.255.0
!
( J: O; X+ ^8 _boot system disk0:/asa722-k8.bin
, R) m2 b4 _9 Z9 Z+ n$ N% Dftp mode passive
3 O! q. g) ]# A  s1 Bdns server-group DefaultDNS
domain-name eluckygo.com
access-list 100 extended permit ip any any
  ~" }+ U- K5 I1 iaccess-list 100 extended permit tcp any any
7 D2 S- K# w$ @: kaccess-list ins_nat0_outbound extended permit ip 159.46.5.0 255.255.255.0 159.46.40.0 255.255.255.128
access-list eluckygo_splitTunnelAcl standard permit 159.46.5.0 255.255.255.0
. q7 o( m" d0 K3 l* b, Gpager lines 24
, v) f3 K6 p' l, flogging asdm informational
# W9 m* P- o! ~& z2 dmtu out 1500
mtu ins 1500
$ ^/ c4 m6 X- r1 \6 M6 i2 A! ?! t$ Mmtu management 1500
ip local pool remote 159.46.40.10-159.46.40.100 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-507.bin
no asdm history enable
/ z6 a# z* s) U7 p/ [% Rarp timeout 14400
global (out) 1 interface
, ~* e9 ^; a$ tnat (ins) 0 access-list ins_nat0_outbound
5 P5 ~+ s4 x7 N/ l7 z& |6 w/ Y% ?nat (ins) 1 0.0.0.0 0.0.0.0
3 `' {' X' {- V. @3 N6 Pstatic (ins,out) 59.42.158.244 159.46.5.13 netmask 255.255.255.255
1 o# I; s6 @+ p( w5 B8 u( |static (ins,out) 59.42.158.243 159.46.5.12 netmask 255.255.255.255
static (ins,out) 59.42.158.246 159.46.5.80 netmask 255.255.255.255
access-group 100 in interface out
route out 0.0.0.0 0.0.0.0 59.42.158.241 1
route ins 159.46.5.0 255.255.255.0 159.46.30.2 1
4 {+ ^# W& {0 p; ~8 Y! ~  z$ d, Troute ins 159.46.21.0 255.255.255.0 159.46.30.2 1
0 B' X+ D) j3 ~3 }3 iroute ins 159.46.11.0 255.255.255.0 159.46.30.2 1
timeout xlate 3:00:00
- T: }$ g& M5 t, M" N+ Stimeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
7 L6 H9 b/ M  L2 y0 _9 z0 rtimeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
( D/ p1 ]8 R0 D* a- r' Rtimeout uauth 0:05:00 absolute
group-policy eluckygo internal
group-policy eluckygo attributes
- M; x4 O, x* Z, Z dns-server value 202.96.128.166 202.96.128.86
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
* @% ~) e% b4 p  S$ i9 ^3 k4 A- R8 _ split-tunnel-network-list value eluckygo_splitTunnelAcl
# F& Q: [  I1 j: q0 L default-domain value eluckygo.com
username 3dtgnt password G7JW/VOddMOcBc0F encrypted
8 n7 K1 m' ~5 m2 j' `! ?username eyes.com5 password LHjCcc5Dx99csJuz encrypted
username eyes.com5 attributes
* Z6 @5 g2 T4 ` vpn-group-policy eluckygo

2 V. ]: u, k( K7 M+ O2 u8 Qhttp server enable
* k( l' l0 l  ?- _* Yhttp 192.168.1.0 255.255.255.0 management
no snmp-server location
3 o: ^. R. i! H5 [: @no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map out_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map out_dyn_map 40 set transform-set ESP-3DES-SHA
; L, Z3 H* Q8 {! R  {4 [crypto dynamic-map out_dyn_map 60 set transform-set ESP-3DES-SHA
8 T6 s* Y4 P6 |: k2 n  ~crypto map out_map 65535 ipsec-isakmp dynamic out_dyn_map
crypto map out_map interface out
crypto isakmp enable out
crypto isakmp policy 10
authentication pre-share
9 ~3 s1 b* x! ~1 q encryption 3des
hash sha
+ y. \1 U9 J6 [& {+ D group 2
% e7 o8 B# v. {1 _6 Z) p lifetime 86400
3 y* v- n: B2 ^6 Xtunnel-group eluckygo type ipsec-ra
% D/ m% n" g+ m6 I6 atunnel-group eluckygo general-attributes
8 Y: W$ C0 @7 B address-pool remote
default-group-policy eluckygo
tunnel-group eluckygo ipsec-attributes
pre-shared-key *
, B0 H7 E5 K2 Y( Ttelnet 159.46.5.0 255.255.255.0 ins
telnet 159.46.30.0 255.255.255.0 ins
telnet 159.46.5.11 255.255.255.255 ins
/ Y5 |' H4 f0 C7 X$ u# Ptelnet timeout 5
ssh 0.0.0.0 0.0.0.0 out
ssh timeout 60
console timeout 0
+ H& |) t' B" k% Pdhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
class-map inspection_default
match default-inspection-traffic
!
!
. @9 o1 g7 T  A, M$ P: F, apolicy-map type inspect dns migrated_dns_map_1
parameters
1 ?. `0 g5 Y( [" N) _' ^4 R6 m message-length maximum 512
policy-map global_policy
class inspection_default
; v* b& {6 w2 f1 y+ h: Z( J inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
' X0 i* ~; @# v  B- A* r7 | inspect sunrpc
: y2 C6 j8 h& [# u* d8 { inspect xdmcp
; Y% ~: U0 x' }2 l9 I/ R$ m inspect sip
inspect netbios
( Q& Z% y2 B, B inspect tftp
) Z2 }. w& C. l  h3 R; u* J! m inspect icmp
!
service-policy global_policy global
1 B) u7 {8 A1 B4 f7 ]- a- H- B; Xprompt hostname context
Cryptochecksum:0c3afefa2c1fe8c1a907a63d9ca07928

LZ要明白,如果相同的网段既应用在NAT又应用在VPN的业务的话,那么在处理的时候是先处理NAT的业务而后在处理VPN的业务.....所以,你这个很有可能是这个问题
' H' |& e8 m- ?   所以,在你所建立的NAT的扩展列表中把VPN的业务流给排除了,在试验一下!

你所说的是这条吗？access-list ins_nat0_outbound extended permit ip 159.46.5.0 255.255.255.0 159.46.40.0 255.255.255.128
; I( a( G. `" L- m) `! x我vpn连进来，获得的是159.46.40.0网段的。能否说的详细一些。谢谢

试下这个。。
% U' Q. [+ O( n  y' t4 w6 Z7 m( ^confi t
1 j5 c- G( z  r( Y7 B# j! ?2 Mgroup-police eluckygo attributes
split-tunnel-network-list value ins_nat0_outbound

1.  access-list ins_nat0_outbound extended permit ip 159.46.5.0 255.255.255.0 159.46.40.0 255.255.255.128
这个NAT的列表里的global address别包括NAT local pool里面的地址!
2 c  d. a' C! X' z4 j2.  access-list ins_nat0_outbound extended permit ip 159.46.5.0 255.255.255.0 159.46.40.0 255.255.255.128
) x- j! l" o# O7 V8 B! w这个NAT列表里的inside adress不要包括你那个服务器的地址.
然后试验!如还有问题,加我QQ:447571690或者MSN:tech_xing@TAC.com

你这里边有很多冲突问题....
比如:有可能global address的159.46.40.10-159.46.40.100这个地址范围里的某些需要分配给VPN客户端的地址已经被NAT所占用...
$ T! n6 @1 p9 |* N& D2 ~( r& j. \    在就是,内网服务器的地址,他所回复的包是先匹配NAT列表的...所以,肯定会有你现在这种情况

谢谢！我再试试。不过你说的global address是指的哪一段地址，我如果用一个不相干的网段，比如192.168.0.0这个网段是不是就没有这个问题了？

真是 收益 匪浅

没看完~~~~~~ 先顶，好同志

有道理。。。感谢攻城狮论坛