无色无味(杨波) 的Web Log(博客)

Split Tunneling(隧道分离)技术主要是用来区分流量的，那区分什么流量呢？在本实验中主要是用来区分去往Internet的流量和要通过VPN加密传输的流量。在实验中我们先不采用隧道分离技术，我们能看到Client端在成功建立VPN连接后，不能访问Server端的内部网络，也不能访问Internet了，要解决这个问题，为了达到Client端能同时访问Server端的内部网络和Internet网络的效果我们应该如何解决呢？那就往下看吧！

2) 实验环境

本人使用Dynamips模拟了两台3640的路由器和一台7200的路由器，IOS版本分别为c7200-advsecurityk9-mz.124-11.T和c3640-ik9o3s-mz.124-10。把一台7200（ISP）的以太网接口和一台3640（EZVPN-Client）分别桥接到了物理的网卡上和真实的主机相连。具体的拓扑结构和IP地址划分如下：

Easy VPN Remote with Client Mode and Split Tunneling.png (163.91 KB)

2008-4-1 15:17

具体的.net文件如下：

autostart = false

[localhost]
port = 7200
udp = 10000
workingdir = ../tmp/
   
    [[router R1]]
    image = ../ios/unzip-c3640-ik9o3s-mz.124-10.bin
    model = 3640
    console = 3001
    ram = 128
    confreg = 0×2142
    exec_area = 64
    mmap = False
    slot1 = NM-4T
    slot0 = NM-1FE-TX
    s1/2 = R3 S1/0
    f0/0 = NIO_udp:30000:127.0.0.1:20000

    [[router R2]]
    image = ../ios/unzip-c3640-ik9o3s-mz.124-10.bin
    model = 3640
    console = 3002
    ram = 128
    confreg = 0×2142
    exec_area = 64
    mmap = False
    slot1 = NM-4T
    slot0 = NM-1FE-TX
    s1/2 = R3 S1/1
    f0/0 = NIO_gen_eth:/Device/NPF_{A6FCF818-D943-4CC2-B462-085AF2946D71}

    [[router R3]]
    image = ../ios/unzip-c7200-advsecurityk9-mz.124-11.T.bin
    model = 7200
    console = 3003
    npe = npe-400
    ram = 128
    confreg = 0×2142
    exec_area = 64
    mmap = false
    slot0 = PA-C7200-IO-FE
    slot1 = PA-4T
    f0/0 = SW1 1

    [[ethsw SW1]]
    1 = dot1q 1
    2 = access 1 NIO_gen_eth:/Device/NPF_{3A6BB436-2962-4893-8335-211D3AE3471C}

3) 实验的目的
通过使用Split Tunneling技术，使Client端内网的VPC能同时访问Server端内部网络和Internet网的WEB服务器。

4) 基本实验环境的配置和测试

在这一步我们将配置路由器的基本连通性和一些基本的配置命令以达到Server端和Clinet端能正常访问Internet WEB服务器的效果，并用ping测试。

EZVPN-Server的基本配置

interface serial 1/2
ip address 220.1.3.2 255.255.255.0
no shutdown
exit

interface fastethernet 0/0
ip address 10.1.1.1 255.255.255.0
no keepalive
no shutdown
exit

access-list 1 permit 10.1.1.0 0.0.0.255

ip nat inside source list 1 interface serial 1/2 overload

interface fastethernet 0/0
ip nat inside
exit

interface serial 1/2
ip nat outside
exit

ip route 0.0.0.0 0.0.0.0 serial 1/2
EZVPN-Client的基本配置

interface serial 1/2
ip address 220.1.1.2 255.255.255.0
no shutdown
exit

interface fastethernet 0/0
ip address 192.168.10.1 255.255.255.0
no shutdown
exit

access-list 1 permit 192.168.10.0 0.0.0.255

ip nat inside source list 1 interface serial 1/2 overload

interface fastethernet 0/0
ip nat inside
exit

interface serial 1/2
ip nat outside
exit

ip route 0.0.0.0 0.0.0.0 serial 1/2

ISP的基本配置

interface serial 1/0
ip address 220.1.3.1 255.255.255.0
no shutdown
exit

interface serial 1/1
ip address 220.1.1.1 255.255.255.0
no shutdown
exit

interface fastethernet 0/0
ip address 220.1.2.1 255.255.255.0
no shutdown
exit

在EZVPN-Client（PC）进行测试：

C:/Documents and Settings/cx>ping 220.1.2.2

Pinging 220.1.2.2 with 32 bytes of data:

Reply from 220.1.2.2: bytes=32 time=248ms TTL=126
Reply from 220.1.2.2: bytes=32 time=44ms TTL=126
Reply from 220.1.2.2: bytes=32 time=80ms TTL=126
Reply from 220.1.2.2: bytes=32 time=562ms TTL=126

Ping statistics for 220.1.2.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 44ms, Maximum = 562ms, Average = 233ms

119a2355459.jpg (19.54 KB)

2008-4-1 15:17

测试结果表明Client端内网用户通过NAT技术能够正常访问Internet WEB服务器。

在EZVPN-Server（VPC）进行测试：

VPCS 1 >ping 220.1.2.2
220.1.2.2 icmp_seq=1 time=166.000 ms
220.1.2.2 icmp_seq=2 time=208.000 ms
220.1.2.2 icmp_seq=3 time=47.000 ms
220.1.2.2 icmp_seq=4 time=165.000 ms
220.1.2.2 icmp_seq=5 time=147.000 ms

测试结果表明Server端内网用户通过NAT技术能够正常访问Internet WEB服务器。

5) Easy VPN For Split Tunneling的配置

EZVPN-Server的配置（不启用split tunneling）

ip local pool Remote-Pool 172.16.1.200 172.16.1.250

username cisco password cisco

aaa new-mode

aaa authentication login lab-remote-access local
crypto isakmp xauth timeout 30

aaa authorization network vpn-group local

crypto isakmp enable
crypto isakmp policy 10
authentication pre-share
encryption 3des
group 2
exit

crypto isakmp client configuration group test
key VPNKEY
domain cisco.com
pool Remote-Pool
exit

crypto ipsec transform-set VPNTRANSFORM esp-3des esp-sha-hmac
exit

crypto dynamic-map Dynamic-Map 10
set transform-set VPNTRANSFORM
reverse-route
exit

crypto map ClientMap client authentication list lab-remote-access
crypto map ClientMap client configuration address respond
crypto map ClientMap isakmp authorization list vpn-group
crypto map ClientMap 65535 ipsec-isakmp dynamic Dynamic-Map

interface serial 1/2
crypto map ClientMap
exit

crypto isakmp keepalive 20 10

EZVPN-Clinet的配置

crypto ipsec client ezvpn test-Client
group test key VPNKEY
peer 220.1.3.2
mode client
connect auto
username cisco password cisco
xauth userid mode local
exit

interface serial 1/2
crypto ipsec client ezvpn test-Client
exit

interface fastethernet 0/0
crypto ipsec client ezvpn test-Client inside
exit

在EZVPN-Client端测试

EZVPN-Client#show crypto ipsec client ezvpn
Easy VPN Remote Phase: 4

Tunnel name : test-Client
Inside interface list: FastEthernet0/0
Outside interface: Serial1/2
Current State: IPSEC_ACTIVE
Last Event: SOCKET_UP
Address: 172.16.1.200
Mask: 255.255.255.255
Default Domain: cisco.com
Save Password: Disallowed
Current EzVPN Peer: 220.1.3.2

我们看见VPN建立成功，接下来到PC上测试

C:/Documents and Settings/cx>ping 10.1.1.2

Pinging 10.1.1.2 with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 10.1.1.2:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)

C:/Documents and Settings/cx>ping 220.1.2.2

Pinging 220.1.2.2 with 32 bytes of data:

Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 220.1.2.2:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)

这个时候我们发现Client端内部的PC即不能访问Server端内网也不能访问外网了，这是为什么呢？那我们先来看看为什么不能访问外网。
首先我们在Client端内部的PC上使用tracert命令跟踪一下数据包
C:/Documents and Settings/cx>tracert 220.1.2.2
Tracing route to 220.1.2.2 over a maximum of 30 hops
  1    13 ms    51 ms    64 ms  192.168.10.1
  2   242 ms   160 ms   107 ms  220.1.3.2
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.
  5     *        *        *     Request timed out.
我们可以看见去往外网的下一跳为220.1.3.2，这个地址刚好是Server端的公网IP地址，而并没有走正常的NAT，造这个问题的原因正是应为没有启用隧道分离，Client端路由器把所有的数据包都放到隧道当中传输了。为了解决这个问题我们在Server端路由器上加入如下命令启用隧道分离。
access-list 100 permit ip 10.1.1.0 0.0.0.255 any
crypto isakmp client configuration group test
acl 100
接下来在Client端重新建立VPN连接并测试。
clear crypto session    清除原有的VPN连接
Mar 30 14:52:19.935: EZVPN(test-Client): Pending XAuth Request, Please enter the following command:
Mar 30 14:52:19.939: EZVPN: crypto ipsec client ezvpn xauth
     应为启用了XAUTH认证，所以在连接重置后要求重新输入用户名和密码
     使用show crypto ipsec client ezvpn查看隧道建立是否成功是否启用了隧道分离
EZVPN-Client#show crypto ipsec client ezvpn
Easy VPN Remote Phase: 4
Tunnel name : test-Client
Inside interface list: FastEthernet0/0
Outside interface: Serial1/2
Current State: IPSEC_ACTIVE
Last Event: SOCKET_UP
Address: 172.16.1.201
Mask: 255.255.255.255
Default Domain: cisco.com
Save Password: Disallowed
Split Tunnel List: 1
       Address    : 10.1.1.0
       Mask       : 255.255.255.0
       Protocol   : 0×0
       Source Port: 0
       Dest Port  : 0
Current EzVPN Peer: 220.1.3.2
    可以看见隧道建立成功并启用隧道分离，让我在到Client端的PC上测试
C:/Documents and Settings/cx>ping 220.1.2.2
Pinging 220.1.2.2 with 32 bytes of data:
Reply from 220.1.2.2: bytes=32 time=361ms TTL=126
Reply from 220.1.2.2: bytes=32 time=102ms TTL=126
Reply from 220.1.2.2: bytes=32 time=43ms TTL=126
Reply from 220.1.2.2: bytes=32 time=305ms TTL=126
Ping statistics for 220.1.2.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 43ms, Maximum = 361ms, Average = 202ms

C:/Documents and Settings/cx>ping 10.1.1.2
Pinging 10.1.1.2 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 10.1.1.2:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
    从测试结果上来看我们解决了上外网的问题，但是为什么还是不能访问Server端内部网络呢？我们在Client端使用show ip nat translation
EZVPN-Client#show ip nat translation
Pro Inside global      Inside local       Outside local      Outside global
icmp 172.16.1.201:512  192.168.10.2:512   10.1.1.2:512       10.1.1.2:512
从show命令当中我们发现当我们发送数据包去往10.1.1.0段时，Client端路由器进行了PAT地址翻译，这个刚好符合我们前面所讲过的client模式下EZVPN-Client会自动创建一个loopback口，当有用户需要访问EZVPN-Server后面的主机时，EZVPN-Client会自动用loopback接口的地址做PAT的原理。那也证明我们去网10段是没有问题的了，那问题是不是出在Server端呢，是不是因为Server端不能正常的把数据包送回来而导致Client端PC不能访问Server端内部网络呢？
    我们先看看Server端路由有没有问题
EZVPN-Server#show ip route
Codes: C – connected, S – static, R – RIP, M – mobile, B – BGP
       D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area
       N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2
       E1 – OSPF external type 1, E2 – OSPF external type 2
       i – IS-IS, su – IS-IS summary, L1 – IS-IS level-1, L2 – IS-IS level-2
       ia – IS-IS inter area, * – candidate default, U – per-user static route
       o – ODR, P – periodic downloaded static route

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

C    220.1.3.0/24 is directly connected, Serial1/2
     172.16.0.0/32 is subnetted, 1 subnets
S       172.16.1.201 [1/0] via 220.1.1.2
     10.0.0.0/24 is subnetted, 1 subnets
C       10.1.1.0 is directly connected, FastEthernet0/0
S*   0.0.0.0/0 is directly connected, Serial1/2
我们发现去往172.16.1.0段的路由存在，路由没有问题，那问题出现在哪里呢？我们再回想一下我们在Server端的配置，为了能够实现Server端内部主机能够访问Internet，我们在Server端路由器上配置了NAT，配置命令如下：

access-list 1 permit 10.1.1.0 0.0.0.255
ip nat inside source list 1 interface serial 1/2 overload

我们发现访问控制列表1中定义了源地址为10.1.1.0的所有主机都要被翻译出去，也就是说当Server端内部主机想要回应172.16.1.0这个段的主机时，回应数据包在进入Server端路由器时因为满足被翻译的条件，所以就不能被送回给172.16.1.0的主机了，那我们怎么解决呢，我的解决办法就是修改访问控制列表1，首先把访问控制列表1删除，然后定义扩展访问控制列表111，指定原地址为10.1.1.0的到达目的地址为172.16.1.0的数据包不要被NAT翻译，其它所有数据包都将被翻译，具体命令如下：

no access-list 1

ip nat inside source list 111 interface serial 1/2 overload
    修改完配置命令并重置VPN连接后，我们再到Client端的PC上来做测试。

C:/Documents and Settings/cx>ping 10.1.1.2

Pinging 10.1.1.2 with 32 bytes of data:

Reply from 10.1.1.2: bytes=32 time=242ms TTL=124
Reply from 10.1.1.2: bytes=32 time=319ms TTL=124
Reply from 10.1.1.2: bytes=32 time=344ms TTL=124
Reply from 10.1.1.2: bytes=32 time=270ms TTL=124

Ping statistics for 10.1.1.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 242ms, Maximum = 344ms, Average = 293ms

C:/Documents and Settings/cx>ping 220.1.2.2

Pinging 220.1.2.2 with 32 bytes of data:

Reply from 220.1.2.2: bytes=32 time=340ms TTL=126
Reply from 220.1.2.2: bytes=32 time=161ms TTL=126
Reply from 220.1.2.2: bytes=32 time=159ms TTL=126
Reply from 220.1.2.2: bytes=32 time=268ms TTL=126

Ping statistics for 220.1.2.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 159ms, Maximum = 340ms, Average = 232ms

    我们发现这个时候我们既能访问Server端内部网络又能访问外网了，哈哈实验结束！

6) 实验扩展

接着这个实验平台我们再来看看Easy VPN Remote With Network-extension
Mode下使用Split Tunneling。

EZVPN-Server的配置（同样先不启用split tunneling）

interface serial 1/2
ip address 220.1.3.2 255.255.255.0
no shutdown
exit

interface fastethernet 0/0
ip address 10.1.1.1 255.255.255.0
no keepalive
no shutdown
exit

access-list 1 permit 10.1.1.0 0.0.0.255

ip nat inside source list 1 interface serial 1/2 overload

interface fastethernet 0/0
ip nat inside
exit

interface serial 1/2
ip nat outside
exit

ip route 0.0.0.0 0.0.0.0 serial 1/2

ip local pool Remote-Pool 172.16.1.200 172.16.1.250

username cisco password cisco

aaa new-mode

aaa authentication login lab-remote-access local
crypto isakmp xauth timeout 30

aaa authorization network vpn-group local

crypto isakmp enable
crypto isakmp policy 10
authentication pre-share
encryption 3des
group 2
exit

crypto isakmp client configuration group test
key VPNKEY
domain cisco.com
pool Remote-Pool
exit

crypto ipsec transform-set VPNTRANSFORM esp-3des esp-sha-hmac
exit

crypto dynamic-map Dynamic-Map 10
set transform-set VPNTRANSFORM
reverse-route
exit

crypto map ClientMap client authentication list lab-remote-access
crypto map ClientMap client configuration address respond
crypto map ClientMap isakmp authorization list vpn-group
crypto map ClientMap 65535 ipsec-isakmp dynamic Dynamic-Map

interface serial 1/2
crypto map ClientMap
exit

crypto isakmp keepalive 20 10

EZVPN-Client的配置

interface serial 1/2
ip address 220.1.1.2 255.255.255.0
no shutdown
exit

interface fastethernet 0/0
ip address 192.168.10.1 255.255.255.0
no shutdown
exit

access-list 1 permit 192.168.10.0 0.0.0.255

ip nat inside source list 1 interface serial 1/2 overload

interface fastethernet 0/0
ip nat inside
exit

interface serial 1/2
ip nat outside
exit

ip route 0.0.0.0 0.0.0.0 serial 1/2

crypto ipsec client ezvpn test-Client
group test key VPNKEY
peer 220.1.3.2
mode network-extension
connect auto
username cisco password cisco
xauth userid mode local
exit

interface serial 1/2
crypto ipsec client ezvpn test-Client
exit

interface fastethernet 0/0
crypto ipsec client ezvpn test-Client inside
exit

ISP的配置

interface serial 1/0
ip address 220.1.3.1 255.255.255.0
no shutdown
exit

interface serial 1/1
ip address 220.1.1.1 255.255.255.0
no shutdown
exit

interface fastethernet 0/0
ip address 220.1.2.1 255.255.255.0
no shutdown
exit

接下来到Client路由器上检查VPN建立情况。

EZVPN-Client#show crypt ipsec client ezvpn
Easy VPN Remote Phase: 4

Tunnel name : test-Client
Inside interface list: FastEthernet0/0
Outside interface: Serial1/2
Current State: IPSEC_ACTIVE
Last Event: SOCKET_UP
Default Domain: cisco.com
Save Password: Disallowed
Current EzVPN Peer: 220.1.3.2

    在Server端查看路由表。

EZVPN-Server#show ip route
Codes: C – connected, S – static, R – RIP, M – mobile, B – BGP
       D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area
       N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2
       E1 – OSPF external type 1, E2 – OSPF external type 2
       i – IS-IS, su – IS-IS summary, L1 – IS-IS level-1, L2 – IS-IS level-2
       ia – IS-IS inter area, * – candidate default, U – per-user static route
       o – ODR, P – periodic downloaded static route

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

C    220.1.3.0/24 is directly connected, Serial1/2
S    192.168.10.0/24 [1/0] via 220.1.1.2
     10.0.0.0/24 is subnetted, 1 subnets
C       10.1.1.0 is directly connected, FastEthernet0/0
S*   0.0.0.0/0 is directly connected, Serial1/2

在网络扩展模式中应为不需要PAT，所以VPN连通后就相当与一个内部局域网，所以在show crypto ipsec client ezvpn结果中没有看到从服务器端地址池中获取到的IP地址因为现在不需要了。那这个时候Server端如何访问Client端的网络呢，因为在Server端配置了Revers-route，Server上会自动创建指向Remote内部网络的静态路由。 接下来我们在Client端的PC上测试连通性。

C:/Documents and Settings/cx>ping 220.1.2.2
Pinging 220.1.2.2 with 32 bytes of data:
Reply from 220.1.2.2: bytes=32 time=149ms TTL=126
Reply from 220.1.2.2: bytes=32 time=124ms TTL=126
Reply from 220.1.2.2: bytes=32 time=127ms TTL=126
Reply from 220.1.2.2: bytes=32 time=149ms TTL=126

Ping statistics for 220.1.2.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 124ms, Maximum = 149ms, Average = 137ms

C:/Documents and Settings/cx>ping 10.1.1.2
Pinging 10.1.1.2 with 32 bytes of data:
Reply from 220.1.1.1: Destination host unreachable.
Reply from 220.1.1.1: Destination host unreachable.
Reply from 220.1.1.1: Destination host unreachable.
Reply from 220.1.1.1: Destination host unreachable.

Ping statistics for 10.1.1.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

我们发现Client端PC能正常访问Internet但不能通过VPN访问Server端内网。为什么呢？我们在PC机上跟踪一下数据包。

C:/Documents and Settings/cx>tracert 220.1.2.2
Tracing route to 220.1.2.2 over a maximum of 30 hops
  1    88 ms    47 ms    46 ms  192.168.10.1
  2    80 ms   100 ms   184 ms  220.1.1.1
  3    72 ms    81 ms   236 ms  220.1.2.2

Trace complete.

C:/Documents and Settings/cx>tracert 10.1.1.2
Tracing route to 10.1.1.2 over a maximum of 30 hops
  1    16 ms    27 ms    46 ms  192.168.10.1
  2   132 ms    50 ms    70 ms  220.1.1.1
  3  220.1.1.1  reports: Destination host unreachable.

Trace complete.

    通过跟踪发现他们出去的下一跳地址都是220.1.1.1，就是说数据包都没有经过VPN隧道传输，而是直接走了PAT，通过在Client端show ip nat translation得以证明。

EZVPN-Client#show ip nat translations     
Pro Inside global      Inside local       Outside local      Outside global
icmp 220.1.1.2:512     192.168.10.2:512   10.1.1.2:512       10.1.1.2:512
icmp 220.1.1.2:512     192.168.10.2:512   220.1.2.2:512      220.1.2.2:512

    所以能ping通Internet WEB就很正常了，但是ping 10.1.1.2的数据包由于被送到了ISP路由器，而ISP路由器上没有到达10.1.1.0网段的路由，所以返回目的地不可达的回应。那怎么解决这个问题呢，可能这个时候我们想到那就用隧道分离不就可以了吗？那我们来试试看，首先在Server端加上隧道分离的命令，如下：

access-list 100 permit ip 10.1.1.0 0.0.0.255 any

crypto isakmp client configuration group test
acl 100

接下来在Client端重新建立VPN连接并测试。
clear crypto session    清除原有的VPN连接
Mar 30 14:52:19.935: EZVPN(test-Client): Pending XAuth Request, Please enter the following command:
Mar 30 14:52:19.939: EZVPN: crypto ipsec client ezvpn xauth
     应为启用了XAUTH认证，所以在连接重置后要求重新输入用户名和密码
     使用show crypto ipsec client ezvpn查看隧道建立是否成功是否启用了隧道分离

EZVPN-Client#show crypt ipsec client ezvpn
Easy VPN Remote Phase: 4

Tunnel name : test-Client
Inside interface list: FastEthernet0/0
Outside interface: Serial1/2
Current State: IPSEC_ACTIVE
Last Event: SOCKET_UP
Default Domain: cisco.com
Save Password: Disallowed
Split Tunnel List: 1
       Address    : 10.1.1.0
       Mask       : 255.255.255.0
       Protocol   : 0×0
       Source Port: 0
       Dest Port  : 0
Current EzVPN Peer: 220.1.3.2
    我们看见隧道分离建立成功，接下来在PC端测试。

C:/Documents and Settings/cx>ping 10.1.1.2
Pinging 10.1.1.2 with 32 bytes of data:
Reply from 220.1.1.1: Destination host unreachable.
Reply from 220.1.1.1: Destination host unreachable.
Reply from 220.1.1.1: Destination host unreachable.
Reply from 220.1.1.1: Destination host unreachable.

Ping statistics for 10.1.1.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

测试结果还是目的不可达，为什么呢？这里我个人是这样理解的，首先我们在服务器和客户端上都启用了NAT功能，当Easy VPN Client工作在Easy VPN Remote Client模式下时，EZVPN-Client会自动创建一个loopback口，当有用户需要访问EZVPN-Server后面的主机时，EZVPN-Client会自动用loopback接口的地址做PAT，这个时候Easy VPN Client自动创建的PAT要优先于我们手动配置的NAT，当不匹配PAT时再匹配NAT，所以Client模式下默认EZVPN-Client端内网的PC ping不通外网，因为所有的数据包都被送到隧道里面去了，并没有送到外网，所以当启用隧道分离后就能解决这个问题了。而当Easy VPN Client工作在Easy VPN Remote network-extension模式下时，EZVPN-Client不需要创建PAT，当VPN连通后就相当与一个内部局域网。这个时候在EZVPN-Client端上只有一个我们手动配置的NAT，所以当数据包进入路由器的时候，还没有来得及把数据包送到隧道里面就先被NAT翻译出去了，所以也就导致在这个模式下，能ping通外网WEB，但不能ping通对端内网的PC。这个时候即使我们在服务器上启用了隧道分离技术也没有用，因为数据包先被NAT出去了。要解决这个问题我们只能在EZVPN-Client上更改NAT的配置，告诉NAT哪些数据包要NAT出去，哪些不要被NAT，并把EZVPN-Server上有关隧道分离的命令删除，具体修改配置如下：

EZVPN-Server端

no access-list 100 permit ip 10.1.1.0 0.0.0.255 any
crypto isakmp client configuration group test
no acl 100
EZVPN-Client端

no access-list 1 permit 192.168.10.0 0.0.0.255
access-list 111 deny ip 192.168.10.0 0.0.0.255 10.1.1.0 0.0.0.255
access-list 111 permit ip any any
ip nat inside source list 111 interface serial 1/2 overload

    在Client端PC机上测试。

C:/Documents and Settings/cx>ping 10.1.1.2

Pinging 10.1.1.2 with 32 bytes of data:

Reply from 10.1.1.2: bytes=32 time=242ms TTL=124
Reply from 10.1.1.2: bytes=32 time=319ms TTL=124
Reply from 10.1.1.2: bytes=32 time=344ms TTL=124
Reply from 10.1.1.2: bytes=32 time=270ms TTL=124

Ping statistics for 10.1.1.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 242ms, Maximum = 344ms, Average = 293ms