ASA 5505后升级单程交通流

Question

我希望有人能给我们一个指针，因为我们确信这是一个非常简单的错误。

我们最近运行一个IPSec站点对站点VPN使用2 x思科ASA 5505在英国和美国办事处之间。两者均为ASA 8.4.1。我们最初尝试直接升级到9.1.5，但这导致了连接问题，我们回滚了版本和配置，并按照发布说明进行了分阶段的升级。

在升级…之前

• 使用Anyconnect远程访问美国ASA的美国工作人员。他们可以访问英国网络上的东西。英国的工作人员从家里连接到英国ASA，可以访问美国的网络。
• 直接连接到英国网络的设备可以访问美国网络上的设备(每个设备上都有通过各自ASA的适当静态路由)。

这两种设备现在都是9.1.5，但我们看到了一些问题。

• 英国Anyconnect客户端和英国设备可以通过VPN (ping、smtp、ssh等)进行通信。
• 美国Anyconnect客户端和美国设备可以相互通信，但不能与英国设备通信。连接只是超时。

我已经把下面的秘密联系起来了。谢谢你所提供的任何指点！

美国射程: 192.168.0.0/16

英国范围: 172.16.0.0/16

UK VPN运行-config：

!
ASA Version 9.1(5)
!
hostname ukvpn
domain-name inside.testco.com
names
ip local pool vpnips 172.16.200.151-172.16.200.200 mask 255.255.0.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
 switchport access vlan 12
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 172.16.254.7 255.255.0.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 29.135.92.8 255.255.254.0
!
interface Vlan12
 management-only
 no forward interface Vlan2
 nameif mgmt
 security-level 100
 ip address 10.0.0.35 255.0.0.0
!
boot system disk0:/asa915-k8.bin
boot system disk0:/asa913-k8.bin
ftp mode passive
clock timezone GMT/BST 0
clock summer-time GMT/BDT recurring last Sun Mar 1:00 last Sun Oct 2:00
dns domain-lookup inside
dns server-group DefaultDNS
 name-server 172.16.254.8
 name-server 192.168.254.111
 domain-name inside.testco.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj-172.16.0.0
 subnet 172.16.0.0 255.255.0.0
object network obj-192.168.0.0
 subnet 192.168.0.0 255.255.0.0
object network NETWORK_OBJ_172.16.200.128_25
 subnet 172.16.200.128 255.255.255.128
object network obj-45.99.208.8
 host 45.99.208.8
object network obj-172.16.254.8
 host 172.16.254.8
object-group network DM_INLINE_NETWORK_1
 network-object object obj-172.16.0.0
 network-object object obj-192.168.0.0
access-list outside_1_cryptomap extended permit ip 172.16.0.0 255.255.0.0 192.168.0.0 255.255.0.0
access-list outside_1_cryptomap extended permit icmp host 172.16.254.8 host 45.99.208.8
access-list outside_1_cryptomap extended permit ip host 172.16.254.8 host 65.99.209.9
access-list outside_1_cryptomap extended permit icmp host 29.135.92.8 host 192.168.254.111
access-list outside_1_cryptomap extended permit ip host 29.135.92.8 host 192.168.254.111
access-list outside_1_cryptomap extended permit ip 172.16.0.0 255.255.0.0 10.1.2.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 172.16.0.0 255.255.0.0 10.0.8.0 255.255.252.0
access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 192.168.0.0 255.255.0.0
access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 10.50.0.0 255.255.192.0
access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 10.1.2.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 10.0.8.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 172.16.0.0 255.255.0.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.101.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.102.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.105.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.200.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.254.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.50.0.0 255.255.192.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.53.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.54.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.250.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.49.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.50.0 255.255.254.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.52.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.56.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.106.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.60.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.1.2.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.140.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.141.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.8.0 255.255.252.0
access-list inside_access_in extended permit ip any4 any4
access-list inside_access_in extended permit icmp any4 any4
access-list outside_access_in extended permit ip any4 any4
access-list outside_access_in extended permit icmp any4 any4
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu mgmt 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
asdm image disk0:/asdm-733.bin
asdm location 10.0.0.0 255.0.0.0 inside
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static any any destination static NETWORK_OBJ_172.16.200.128_25 NETWORK_OBJ_172.16.200.128_25 no-proxy-arp route-lookup description mystery rule
nat (inside,any) source static obj-172.16.0.0 obj-172.16.0.0 destination static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 no-proxy-arp
!
object network obj-172.16.0.0
 nat (inside,outside) dynamic interface
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 29.135.92.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
 webvpn
  url-list value testco
  file-browsing enable
  file-entry enable
  http-proxy enable
  url-entry enable
aaa-server nt protocol nt
aaa-server nt (inside) host 172.16.254.8
 nt-auth-domain-controller dc-uk
aaa-server nt (outside) host 192.168.254.111
 nt-auth-domain-controller dc-us
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set isr-vpn-set esp-des esp-md5-hmac
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs group1
crypto map outside_map 1 set peer 45.99.208.8
crypto map outside_map 1 set ikev1 transform-set ESP-AES-256-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint ASDM_TrustPoint0
 enrollment self
 subject-name CN=ukvpn
 proxy-ldc-issuer
 crl configure
crypto ca trustpool policy
crypto ca certificate chain ASDM_TrustPoint0
 certificate aafb674d
    <removed>
  quit
crypto isakmp nat-traversal 10
crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
crypto ikev1 enable outside
crypto ikev1 ipsec-over-tcp port 10000
crypto ikev1 policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
vpn-sessiondb max-other-vpn-limit 10
vpn-sessiondb max-anyconnect-premium-or-essentials-limit 25

dhcpd address 172.16.254.100-172.16.254.150 inside
dhcpd dns 172.16.254.8 192.168.254.111 interface inside
dhcpd lease 14400 interface inside
dhcpd domain inside.testco.com interface inside
dhcpd option 3 ip 172.16.254.7 interface inside
dhcpd option 60 ip 172.16.254.11 interface inside
dhcpd enable inside
!
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ssl trust-point ASDM_TrustPoint0 inside
ssl trust-point ASDM_TrustPoint0 outside
webvpn
 enable inside
 enable outside
 anyconnect-essentials
 anyconnect image disk0:/anyconnect-win-3.1.06079-k9.pkg 1 regex "Windows NT"
 anyconnect image disk0:/anyconnect-macosx-i386-3.1.06079-k9.pkg 2 regex "Intel Mac OS X"
 anyconnect enable
 cache
  disable
group-policy DfltGrpPolicy attributes
 vpn-idle-timeout none
 vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless
 password-storage enable
 split-tunnel-network-list value testcostaffvpn_splitTunnelAcl
 webvpn
  hidden-shares visible
  activex-relay disable
  auto-signon allow uri * auth-type all
group-policy testcostaffvpn internal
group-policy testcostaffvpn attributes
 dns-server value 172.16.254.8 192.168.254.111
 vpn-access-hours none
 vpn-simultaneous-logins 4
 vpn-idle-timeout none
 vpn-session-timeout none
 vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless
 password-storage enable
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value testcostaffvpn_splitTunnelAcl
 default-domain value inside.testco.com
 split-dns value dfw1.rlocal lon1.rlocal testcopub.com testcopub.co.uk testco.com
 vlan none
 webvpn
  url-list value testco
  filter none
  http-proxy enable
  customization value DfltCustomization
  hidden-shares visible
  file-entry enable
  file-browsing enable
  url-entry enable
  auto-signon allow uri * auth-type all
tunnel-group DefaultWEBVPNGroup general-attributes
 address-pool vpnips
 authentication-server-group nt
 default-group-policy testcostaffvpn
tunnel-group testcostaffvpn type remote-access
tunnel-group testcostaffvpn general-attributes
 address-pool vpnips
 authentication-server-group nt
 default-group-policy testcostaffvpn
tunnel-group testcostaffvpn ipsec-attributes
 ikev1 pre-shared-key <removed>
 isakmp keepalive threshold 30 retry 2
tunnel-group testcostaffvpn ppp-attributes
 no authentication chap
 no authentication ms-chap-v1
 authentication ms-chap-v2
tunnel-group anyconnect type remote-access
tunnel-group anyconnect general-attributes
 address-pool vpnips
 authentication-server-group nt
 default-group-policy testcostaffvpn
tunnel-group 45.99.208.17 type ipsec-l2l
tunnel-group 45.99.208.17 ipsec-attributes
 ikev1 pre-shared-key <removed>
tunnel-group 45.99.208.8 type ipsec-l2l
tunnel-group 45.99.208.8 ipsec-attributes
 ikev1 pre-shared-key <removed>
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect rsh
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc 
  inspect xdmcp
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:838a16ab71a9de739edc27076262d7b6
: end

US VPN运行-config：

!
ASA Version 9.1(5)
!
hostname usvpn
domain-name inside.testco.com
names
ip local pool vpnips 192.168.200.151-192.168.200.200 mask 255.255.0.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
 switchport access vlan 3
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
 switchport access vlan 12
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.254.107 255.255.0.0
 ospf cost 10
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 45.99.208.8 255.255.255.224
 ospf cost 10
!
boot system disk0:/asa915-k8.bin
boot system disk0:/asa913-k8.bin
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns domain-lookup inside
dns server-group DefaultDNS
 name-server 192.168.254.111
 name-server 172.16.254.8
 domain-name inside.testco.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj-192.168.0.0
 subnet 192.168.0.0 255.255.0.0
object network obj-172.16.0.0
 subnet 172.16.0.0 255.255.0.0
object network obj-192.168.200.192
 subnet 192.168.200.192 255.255.255.224
object network NETWORK_OBJ_192.168.254.128_25
 subnet 192.168.254.128 255.255.255.128
object network obj-29.135.92.8
 host 29.135.92.8
object network obj-192.168.254.111
 host 192.168.254.111
object network obj-192.168.254.200
 host 192.168.254.200
object network obj-10.1.2.0
 subnet 10.1.2.0 255.255.255.0
object network obj-10.0.250.0
 subnet 10.0.250.0 255.255.255.0
object network obj-10.0.0.0
 subnet 10.0.0.0 255.0.0.0
 description http://www.cisco.com/en/US/docs/security/asa/asa83/upgrading/migrating.html#wp97481
object network intra
object-group network DM_INLINE_NETWORK_1
 network-object object obj-172.16.0.0
 network-object object obj-192.168.0.0
 network-object object obj-10.1.2.0
 network-object object obj-10.0.250.0
 network-object object obj-10.0.0.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 172.16.0.0 255.255.0.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 10.50.0.0 255.255.192.0
access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 10.0.250.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 192.168.0.0 255.255.0.0 172.16.0.0 255.255.0.0
access-list outside_1_cryptomap extended permit icmp host 45.99.208.8 host 172.16.254.8
access-list outside_1_cryptomap extended permit ip host 45.99.208.8 host 172.16.254.8
access-list outside_1_cryptomap extended permit icmp host 192.168.254.111 host 29.135.92.8
access-list outside_1_cryptomap extended permit ip host 192.168.254.111 host 29.135.92.8
access-list outside_1_cryptomap extended permit ip 192.168.0.0 255.255.0.0 10.1.2.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 192.168.0.0 255.255.0.0 10.0.250.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 172.16.0.0 255.255.0.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.50.0.0 255.255.192.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.101.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.102.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.105.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.200.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.254.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.53.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.54.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.250.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.49.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.50.0 255.255.254.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.52.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.56.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.106.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.60.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.1.2.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.140.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.8.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.55.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.16.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.253.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.141.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.23.0 255.255.255.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.0.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.24.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.32.0 255.255.252.0
access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.250.0 255.255.255.0
access-list inside_access_in extended permit ip any4 any4
access-list inside_access_in extended permit icmp any4 any4
access-list outside_access_in extended permit ip any4 any4
access-list outside_access_in extended permit icmp any4 any4
pager lines 24
logging enable
logging console warnings
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-733.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,any) source static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 destination static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 no-proxy-arp
!
object network obj-192.168.0.0
 nat (inside,outside) dynamic interface
object network obj-10.0.0.0
 nat (inside,outside) dynamic interface
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 45.99.208.1 1
route inside 10.0.0.0 255.0.0.0 192.168.49.3 1
route inside 10.0.0.0 255.255.252.0 192.168.49.3 1
route inside 10.0.8.0 255.255.252.0 192.168.49.3 1
route inside 10.0.16.0 255.255.252.0 192.168.49.3 1
route inside 10.0.24.0 255.255.252.0 192.168.49.3 1
route inside 10.0.32.0 255.255.252.0 192.168.49.3 1
route inside 10.1.2.0 255.255.255.0 192.168.49.3 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
 webvpn
  file-browsing enable
  file-entry enable
  http-proxy enable
  url-entry enable
aaa-server domain protocol nt
aaa-server domain (inside) host 192.168.254.111
 timeout 5
 nt-auth-domain-controller dc-us
aaa-server domain (outside) host 172.16.254.8
 nt-auth-domain-controller dc-uk
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA mode transport
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set isr-vpn-set esp-des esp-md5-hmac
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-256-SHA ESP-3DES-SHA
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs group1
crypto map outside_map 1 set peer 29.135.92.8
crypto map outside_map 1 set ikev1 transform-set ESP-AES-256-SHA
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint ASDM_TrustPoint0
 enrollment self
 subject-name CN=usvpn
 proxy-ldc-issuer
 crl configure
crypto ca trustpool policy
crypto ca certificate chain ASDM_TrustPoint0
 certificate f8674d
    <removed>
  quit
crypto ikev2 remote-access trustpoint ASDM_TrustPoint0
crypto ikev1 enable outside
crypto ikev1 ipsec-over-tcp port 10000
crypto ikev1 policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
vpn-sessiondb max-anyconnect-premium-or-essentials-limit 25

dhcpd address 192.168.200.100-192.168.200.150 inside
dhcpd dns 192.168.254.111 172.16.254.8 interface inside
dhcpd lease 14400 interface inside
dhcpd domain inside.testco.com interface inside
dhcpd option 3 ip 192.168.254.107 interface inside
dhcpd option 60 ip 192.168.254.130 interface inside
dhcpd enable inside
!
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ssl trust-point ASDM_TrustPoint0 inside
ssl trust-point ASDM_TrustPoint0 outside
webvpn
 enable inside
 enable outside
 anyconnect-essentials
 anyconnect image disk0:/anyconnect-dart-win-2.5.6005-k9.pkg 1 regex "Windows NT"
 anyconnect image disk0:/anyconnect-macosx-i386-2.5.6005-k9.pkg 2 regex "Intel Mac OS X"
 anyconnect enable
 tunnel-group-list enable
 cache
  disable
group-policy DfltGrpPolicy attributes
 vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless
group-policy GroupPolicy_anyconnect internal
group-policy GroupPolicy_anyconnect attributes
 wins-server none
 dns-server value 192.168.254.111 172.16.254.8
 vpn-tunnel-protocol ssl-client
 default-domain value inside.testco.com
group-policy testcostaffvpn internal
group-policy testcostaffvpn attributes
 wins-server none
 dns-server value 192.168.254.111 172.16.254.8
 vpn-access-hours none
 vpn-simultaneous-logins 2
 vpn-idle-timeout none
 vpn-session-timeout none
 vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value testcostaffvpn_splitTunnelAcl
 default-domain value inside.testco.com
 split-dns value dfw1.rlocal lon1.rlocal testcopub.com testcopub.co.uk testco.com
 vlan none
 webvpn
  url-list none
  filter none
  http-proxy enable
  customization value DfltCustomization
  hidden-shares none
  file-entry enable
  file-browsing enable
  url-entry enable
tunnel-group DefaultRAGroup ppp-attributes
 no authentication chap
 no authentication ms-chap-v1
 authentication ms-chap-v2
tunnel-group 29.135.92.8 type ipsec-l2l
tunnel-group 29.135.92.8 ipsec-attributes
 ikev1 pre-shared-key <removed>
tunnel-group testcostaffvpn type remote-access
tunnel-group testcostaffvpn general-attributes
 address-pool vpnips
 authentication-server-group domain
 default-group-policy testcostaffvpn
tunnel-group testcostaffvpn ipsec-attributes
 ikev1 pre-shared-key <removed>
 isakmp keepalive threshold 30 retry 2
tunnel-group testcostaffvpn ppp-attributes
 no authentication chap
 no authentication ms-chap-v1
 authentication ms-chap-v2
tunnel-group anyconnect type remote-access
tunnel-group anyconnect general-attributes
 address-pool vpnips
 authentication-server-group domain
 default-group-policy testcostaffvpn
tunnel-group anyconnect webvpn-attributes
 group-alias anyconnect enable
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
hpm topN enable
Cryptochecksum:d20c924a5c39211877c10cb6e61359fe
: end

Answer 1

192.168.0.0/16直接连接在美国& 172.16.0.0/16在英国直接连接。根据运行配置，允许站点到现场隧道的流量在192.168.0.0/16和172.16.0.0/16之间通过，并且允许同一安全级别之间的通信量。另外，您在两个防火墙上都有手动身份NAT配置。Web配置了隧道指定的拆分隧道，并且允许使用其他地址.路由配置也是正确的。

所以它应该工作得很好。

你能看看下面，

1. 在vpn客户端计算机上进行路由打印，以查看是否只通过隧道路由备用位置目的地。
2. 当用户试图连接时，连接记录在防火墙上。
3. 调试日志以查看加密、解密在尝试从vpn客户端计算机连接时发生。
4. 由于它是9.X，您可以尝试通过欺骗VPN客户端IP地址作为从一个防火墙到另一个防火墙目的地的源来平tcp吗？

示例

从英国防火墙来试试这个，

ping tcp 192.168.49.3 22源172.16.200.152 23423