Cisco ASA - Sophos站点到站点VPN没有其他网络的响应

Question

我正在尝试建立一个站点来站点VPN隧道，在两个网络之间，一个与索福斯UTM，另一个思科5515 X。隧道的ASA端配置了一个公共对等私有地址子网(192.168.71.0)，而索弗斯端被迫使用与隧道对等端和主机相同的IP地址(3.3.3.50 --这是一个假地址)。隧道关闭了，我可以看到流量通过索福斯UTM的网络，但没有什么从思科方面回来。这是我第一次不得不为这个配置一个ASA，我完全感到困惑。

谁能告诉我我错过了什么吗？我的Cisco ASA配置在下面。

crypto ipsec ikev1 transform-set REMOTE_LOCAL esp-3des esp-md5-hmac 
crypto ipsec security-association pmtu-aging infinite
crypto map REMOTE2LOCAL 1 match address REMOTE_to_LOCAL
crypto map REMOTE2LOCAL 1 set pfs 
crypto map REMOTE2LOCAL 1 set peer 3.3.3.50 
crypto map REMOTE2LOCAL 1 set ikev1 transform-set REMOTE_LOCAL
crypto map REMOTE2LOCAL interface outside
crypto ca trustpool policy
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 86400

crypto ipsec ikev1 transform-set REMOTE_LOCAL esp-3des esp-md5-hmac

object network mgmt71vpn
 subnet 192.168.71.0 255.255.255.0
object network REMOTE.50
 host 3.3.3.50

nat (inside,outside) source static mgmt71vpn mgmt71vpn destination static REMOTE.50 REMOTE.50 no-proxy-arp route-lookup
access-list REMOTE_to_LOCAL extended permit ip object mgmt71vpn object REMOTE.50 
access-list outside_in extended permit ip host 3.3.3.50 192.168.71.0 255.255.255.0
access-group outside_in in interface outside

谢谢!

Answer 1

下面是ASA的配置：

route outside 192.168.26.50 255.255.255.255 <default gateway IP address>

crypto ipsec ikev1 transform-set REMOTE_LOCAL esp-3des esp-md5-hmac 
crypto ipsec security-association pmtu-aging infinite
crypto map REMOTE2LOCAL 1 match address REMOTE_to_LOCAL
crypto map REMOTE2LOCAL 1 set pfs 
crypto map REMOTE2LOCAL 1 set peer 3.3.3.50 
crypto map REMOTE2LOCAL 1 set ikev1 transform-set REMOTE_LOCAL
crypto map REMOTE2LOCAL interface outside
crypto ca trustpool policy
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 86400

crypto ipsec ikev1 transform-set REMOTE_LOCAL esp-3des esp-md5-hmac

object network mgmt71vpn
 subnet 192.168.71.0 255.255.255.0
object network REMOTE.50
 host 192.168.26.50

nat (inside,outside) source static mgmt71vpn mgmt71vpn destination static REMOTE.50 REMOTE.50
access-list REMOTE_to_LOCAL extended permit ip object mgmt71vpn object REMOTE.50 
access-list outside_in extended permit ip host 192.168.26.50 192.168.71.0 255.255.255.0
access-group outside_in in interface outside

然后在Sophos框上，将您的受保护子网发送到192.168.26.50地址，当目的地是192.168.71.0/24网络时。如果你对此有任何意见或者需要更多的帮助，请告诉我。