【IT168 专稿】本配置能实现XP用户不用安装VPN CLIENT 连接和其它用户（WIN98,2000)）安装VPN CLIENT 也可以连接。希望大家支持多提意见。

    pixfirewall(config)# sh run
    : Saved
    :
    PIX Version 6.3(4)
    interface ethernet0 auto
    interface ethernet1 auto
    nameif ethernet0 outside security0
    nameif ethernet1 inside security100
    enable password C0IEAxsrkBzv9xyd encrypted
    passwd C0IEAxsrkBzv9xyd encrypted
    hostname pixfirewall
    domain-name rtp.cisco.com
    clock timezone CST 8
    fixup protocol dns maximum-length 512
    fixup protocol ftp 21
    fixup protocol h323 h225 1720
    fixup protocol h323 ras 1718-1719
    fixup protocol http 80
    fixup protocol rsh 514
    fixup protocol rtsp 554
    fixup protocol sip 5060
    fixup protocol sip udp 5060
    fixup protocol skinny 2000
    fixup protocol smtp 25
    fixup protocol sqlnet 1521
    fixup protocol tftp 69
    names
    access-list 80 permit ip 192.168.0.0 255.255.0.0 192.168.100.0 255.255.255.0
    pager lines 24
    logging on
    mtu outside 1500
    mtu inside 1500
    ip address outside  *.*.*.*  255.255.255.248
    ip address inside 192.168.100.10 255.255.255.0
    ip verify reverse-path interface outside
    ip audit info action alarm
    ip audit attack action alarm
    ip local pool vpnpool 192.168.100.100-192.168.100.200
    no failover
    failover timeout 0:00:00
    failover poll 15
    no failover ip address outside
    no failover ip address inside
    pdm location 192.168.100.1 255.255.255.255 inside
    pdm location 192.168.0.0 255.255.0.0 inside
    pdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 0 access-list 80
    nat (inside) 1 0.0.0.0 0.0.0.0 0 0
    static (inside,outside) *.*.*.* 192.168.100.4 netmask 255.255.255.255 0 0
    conduit permit tcp host *.*.*.* eq www any
    conduit permit tcp host *.*.*.* eq 3389 any
    conduit permit tcp host *.*.*.* eq ftp any
    route outside 0.0.0.0 0.0.0.0 *.*.*.* 1
    route inside 192.168.0.0 255.255.0.0 192.168.100.11 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
    timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
    timeout uauth 0:05:00 absolute
    aaa-server TACACS+ protocol tacacs+
    aaa-server TACACS+ max-failed-attempts 3
    aaa-server TACACS+ deadtime 10
    aaa-server RADIUS protocol radius
    aaa-server RADIUS max-failed-attempts 3
    aaa-server RADIUS deadtime 10
    aaa-server LOCAL protocol local
    aaa authentication enable console LOCAL
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.0.0 255.255.0.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server community public
    no snmp-server enable traps
    floodguard enable
    sysopt connection permit-ipsec
    sysopt connection permit-l2tp
    crypto ipsec transform-set esp-des-md5 esp-des esp-md5-hmac
    crypto ipsec transform-set esp-des-md5 mode transport
    crypto dynamic-map cisco 4 set transform-set esp-des-md5
    crypto map ipsecin 5 ipsec-isakmp dynamic cisco
    crypto map ipsecin client configuration address initiate
    crypto map ipsecin client configuration address respond
    crypto map ipsecin interface outside
    isakmp enable outside
    isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
    isakmp client configuration address-pool local vpnpool outside
    isakmp policy 10 authentication pre-share
    isakmp policy 10 encryption des
    isakmp policy 10 hash md5
    isakmp policy 10 group 1
    isakmp policy 10 lifetime 86400
    isakmp policy 20 authentication pre-share
    isakmp policy 20 encryption des
    isakmp policy 20 hash md5
    isakmp policy 20 group 2
    isakmp policy 20 lifetime 86400
    vpngroup aaa address-pool vpnpool
    vpngroup aaa dns-server 192.168.1.1
    vpngroup aaa split-tunnel 80
    vpngroup aaa idle-time 1800
    vpngroup aaa password ********
    telnet 192.168.0.0 255.255.0.0 inside
    telnet timeout 5
    ssh 0.0.0.0 0.0.0.0 outside
    ssh 192.168.0.0 255.255.0.0 inside
    ssh timeout 10
    management-access inside
    console timeout 5
    vpdn group 1 accept dialin l2tp
    vpdn group 1 ppp authentication pap
    vpdn group 1 client configuration address local vpnpool
    vpdn group 1 client configuration dns 202.102.152.3
    vpdn group 1 client authentication local
    vpdn group 1 l2tp tunnel hello 60
    vpdn username aaa password *********
    vpdn enable outside
    username aaa password Nr2JryhhyAbeFCjx encrypted privilege 15
    terminal width 80
    Cryptochecksum:5415c3b3a0c95dc95fccc465f05e6982
    : end
    pixfirewall(config)#