测试环境：ASA5520asa723-18-k8.bin：使用如下配置完全满足需求，当用户拨入VPN后只能访问内部资源，不能访问外部资源

        但用这个配置模板，到正式环境，就死活限制不了拨入的VPN用户访问互联网！

        ====================================================================================================

        测试环境：ASA5520asa723-18-k8.bin

        tunnel-grouptestzttypeipsec-ra

        tunnel-grouptestztipsec-attributes

        pre-shared-key*

        group-policyzttestinternal

        group-policyzttestattributes

        vpn-simultaneous-logins100

        vpn-idle-timeoutnone

        vpn-session-timeoutnone

        vpn-filtervaluedeny-access-internet

        split-tunnel-network-listvalueDeny-access-internet

        access-listdeny-access-internetextendedpermitip192.168.1.0255.255.255.0200.1.0.0255.255.0.0

        access-listdeny-access-internetextendedpermitip192.168.1.0255.255.255.0172.25.90.0255.255.255.0

        access-listdeny-access-internetextendedpermitip192.168.1.0255.255.255.0100.1.0.0255.255.0.0

        access-listdeny-access-internetextendeddenyip192.168.1.0255.255.255.0any

        access-listDeny-access-internetextendedpermitip172.25.90.0255.255.255.0192.168.1.0255.255.255.0

        access-listDeny-access-internetextendedpermitip100.1.0.0255.255.0.0192.168.1.0255.255.255.0

        access-listDeny-access-internetextendedpermitip200.1.0.0255.255.0.0192.168.1.0255.255.255.0

        access-listDeny-access-internetextendeddenyipany192.168.1.0255.255.255.0

        usernamekakakapassword69eXZQeiMSKhVvOtencrypted

        usernamekakakaattributes

        vpn-group-policyzttest

        vpn-tunnel-protocolIPSec

        vpn-framed-ip-address192.168.1.100255.255.255.0

        测试成功：用户kakaka只能访问内网，不能访问互联网

        =================================================================================[netxpage]

        正式环境：ASA5540asa723-18-k8.bin

        tunnel-grouptestzttypeipsec-ra

        tunnel-grouptestztipsec-attributes

        pre-shared-key*

        group-policyzttestinternal

        group-policyzttestattributes

        vpn-simultaneous-logins100

        vpn-idle-timeoutnone

        vpn-session-timeoutnone

        vpn-filtervaluedeny-access-internet

        split-tunnel-network-listvalueDeny-access-internet

        access-listdeny-access-internetextendedpermitiphost172.25.230.188172.0.0.0255.0.0.0

        access-listdeny-access-internetextendedpermitiphost172.25.230.18810.0.0.0255.0.0.0

        access-listdeny-access-internetextendeddenyiphost172.25.230.188any

        access-listDeny-access-internetextendedpermitip172.0.0.0255.0.0.0host172.25.230.188

        access-listDeny-access-internetextendedpermitip10.0.0.0255.0.0.0host172.25.230.188

        access-listDeny-access-internetextendeddenyipanyhost172.25.230.188

        usernamekakakapassword69eXZQeiMSKhVvOtencrypted

        usernamekakakaattributes

        vpn-group-policyzttest

        vpn-tunnel-protocolIPSec

        vpn-framed-ip-address172.25.230.188255.255.255.0

        测试失败：用户kakaka既能访问内网，又能访问互联网，晕，没有限制住！

        解决方法：我在5540设备上的group-policyzttestattributes中添加了

        split-tunnel-policyexcludespecified，就OK了，限制了用户访问互联网，只能访问内网

        此命令的意思：Excludeonlynetworksspecifiedbysplit-tunnel-network-list（排除上公网的用户）