简单的网络结构图：
CISCO anyconnect ***配置_第1张图片

1，公网IP是单独给***使用的。

2、ASA的outside 接口 10.10.1.30 直接nat到公网 XXX.XXX.XX.XX

3、ssl_***_pool 是10.25.10.0/24

4、ASA的outside 接口地址是vlan 1 10.10.0.0/23 。

5、anyconnect 客户端获取到10.25.10.0的地址，可以访问10.10.5.0/24和10.10.0.0/23的地址。

6、SSL ***拨号后，上网依然采用本地上网的方式

具体配置步骤：

  • 配置outside接口
    interface Ethernet1/1
    nameif outside
    security-level 100
    ip address 10.10.1.30 255.255.254.0

  • 配置SSL ***的地址池
    ip local pool SSLCLIENT_POOL 10.25.10.1-10.25.10.200 mask 255.255.255.0

  • 配置ssl ***的DNS
    dns server-group DefaultDNS
    name-server 10.10.5.51
    name-server 10.10.5.52
    domain-name XXXXXX.cn
  • 开启原进原出
    same-security-traffic permit intra-interface
  • 配置object对象
    object network SSL_POOL
    subnet 10.25.10.0 255.255.255.0
    object-group network inside_vlan
    network-object 10.10.0.0 255.255.254.0
    network-object 10.10.5.0 255.255.255.0
  • 配置AAA的ladp认证
    ldap attribute-map Banner
    aaa-server LDAP_SRV_GRP protocol ldap
    aaa-server LDAP_SRV_GRP (outside) host 10.10.5.51
    ldap-base-dn DC=chinavc,DC=com,DC=cn
    ldap-scope subtree
    ldap-naming-attribute sAMAccountName
    ldap-login-password *****
    ldap-login-dn CN=Administrator,CN=Users,DC=chinavc,DC=com,DC=cn
    server-type microsoft
  • 配置ASDM
    http server enable
    http 192.168.45.0 255.255.255.0 management
    http 0.0.0.0 0.0.0.0 outside
    http 0.0.0.0 0.0.0.0 inside
  • 配置NAT地址转换--去往内网的地址，不做NAT转换
    nat (outside,outside) source static ***_Vlan ***_Vlan destination static inside_vlan inside_vlan no-proxy-arp route-lookup
  • 配置ACL列表
    access-list web-*** extended permit ip object ***_Vlan object-group inside_vlan
    access-list web-*** extended permit ip object-group inside_vlan object ***_Vlan
    access-list web-*** extended permit ip object ***_Vlan object inside_vlan_5
    access-list web-*** extended permit ip object inside_vlan_5 object ***_Vlan
  • 接口下调用ACL列表
    access-group web-*** in interface outside
  • 开启WEB ***
    web***
    enable outside
    enable inside
    anyconnect image disk0:/anyconnect-win-4.7.00136-webdeploy-k9.pkg 1
    anyconnect enable
    tunnel-group-list enable
    cache
    disable
    error-recovery disable

  • 配置组策略
    group-policy GroupPolicy_GX_SSL***_PROFILE internal
    group-policy GroupPolicy_GX_SSL***_PROFILE attributes
    wins-server none
    dns-server value 10.10.5.51 10.10.5.52
    ***-tunnel-protocol ssl-client
    password-storage enable
    split-tunnel-policy tunnelspecified --此处配置隧道分流
    split-tunnel-network-list value web-*** --此处配置隧道分流
    default-domain value XXXXX.com.cn

     tunnel-group GX_SSL***_PROFILE type remote-access
 tunnel-group GX_SSL***_PROFILE general-attributes
        address-pool SSLCLIENT_POOL
        authentication-server-group LDAP_SRV_GRP
        default-group-policy GroupPolicy_GX_SSL***_PROFILE
tunnel-group GX_SSL***_PROFILE web***-attributes
        group-alias CRVC enable
        group-alias GX_SSL***_PROFILE disable
        group-alias XXX.com.cn disable