Всем привет. Помогите кто может, пожалуйста.
Стандартная схема ASA коннектится в интернет через PPPoE, за ней локальная сеть. Пытаюсь сделать доступ для клиентов L2TP c Висты. А оно не работает :)
Перерыл уже наверное всь сисковский сайт. Ничего не получается.
Вот АСовский конфиг:
!
hostname ASAVPN
domain-name test.local
!
interface Ethernet0/0
description TO_INTERNET
nameif outside
security-level 0
pppoe client vpdn group bezeqint
ip address pppoe setroute
!
interface Ethernet0/1
description TO_LAN
nameif inside
security-level 100
ip address 172.31.1.254 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
!
ftp mode passive
clock timezone IST 2
dns domain-lookup inside
dns server-group DefaultDNS
name-server 172.31.1.24
domain-name test.local
same-security-traffic permit intra-interface
access-list 101 extended permit icmp any any echo-reply
access-list 101 extended permit icmp any any source-quench
access-list 101 extended permit icmp any any unreachable
access-list 101 extended permit icmp any any time-exceeded
access-list inside_nat0_outbound extended permit ip 172.31.1.0 255.255.255.0 192.168.57.0 255.255.255.0

pager lines 24
logging enable
logging asdm debugging
mtu outside 1492
mtu inside 1500
mtu management 1500

ip local pool clientVPNpool 192.168.57.100-192.168.57.110 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 172.31.1.0 255.255.255.0
access-group 101 in interface outside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication enable console LOCAL
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
aaa authorization command LOCAL
http server enable
http 172.31.1.0 255.255.255.0 inside
crypto ipsec transform-set TRANS_ESP_3DES_MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set TRANS_ESP_3DES_MD5 mode transport
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map outside_dyn_map 20 set transform-set TRANS_ESP_3DES_MD5
crypto map outside_map 20 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
telnet 172.31.1.0 255.255.255.0 inside
telnet timeout 5
ssh 172.31.1.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
management-access management
vpdn group bezeqint request dialout pppoe
vpdn group bezeqint localname globdmz3@014
vpdn group bezeqint ppp authentication pap
vpdn username username password *********
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 10.3.1.5 source inside
ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1 rc4-md5
webvpn
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
wins-server value 172.31.1.24
dns-server value 172.31.1.24
vpn-tunnel-protocol l2tp-ipsec svc
default-domain value test.local
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol IPSec webvpn
username test password TalVL8v/GhWQSYhE encrypted
tunnel-group DefaultRAGroup general-attributes
address-pool clientVPNpool
authentication-server-group (outside) LOCAL
authorization-server-group LOCAL
default-group-policy DefaultRAGroup
tunnel-group DefaultRAGroup ipsec-attributes
pre-shared-key cisco12345
tunnel-group DefaultRAGroup ppp-attributes
authentication pap
authentication ms-chap-v2
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect icmp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:899c3a7ff0a9ca041a8450c9b5607f92
: end