如拓扑图所示，内网设备互联是vlan304，172.10.18.0/24网段
核心交换机使用的三层口，172.100.1.1/29，对接防火墙172.100.1.2/29
目前内网都能正常通信，现在想在防火墙上做L2TP，让出差员工能从外网访问内网
做完之后，连上L2TP，发现只能电脑只能ping通防火墙上的IP：172.100.1.2，而不能ping通核心交换机的：172.100.1.1和172.10.18.254
防火墙的配置如下所示

# version 7.1.064, Release 9524P33 # sysname H3C # context Admin id 1 # irf mac-address persistent timer irf auto-update enable undo irf link-delay irf member 1 priority 1 # ip pool l2tp1 172.10.10.1 # password-recovery enable # vlan 1 # controller Cellular1/0/0 # interface Virtual-Template1 bandwidth 10000000 ppp authentication-mode chap remote address pool l2tp1 ip address 172.10.10.254 255.255.255.0 igmp enable # interface NULL0 # interface GigabitEthernet1/0/0 port link-mode route combo enable copper ip address 192.168.0.1 255.255.255.0 # interface GigabitEthernet1/0/1 port link-mode route description GuideLan Interface combo enable fiber ip address 172.100.1.2 255.255.255.248 igmp enable undo dhcp select server # interface GigabitEthernet1/0/2 port link-mode route nat outbound # interface GigabitEthernet1/0/3 port link-mode route description GuideWan Interface bandwidth 100000000 ip address 120.196.93.186 255.255.255.240 igmp enable dns server 211.136.192.6 nat outbound description GuideNat gateway 120.196.93.177 # interface GigabitEthernet1/0/4 port link-mode route # interface GigabitEthernet1/0/5 port link-mode route # interface GigabitEthernet1/0/6 port link-mode route # interface GigabitEthernet1/0/7 port link-mode route # interface GigabitEthernet1/0/8 port link-mode route # interface GigabitEthernet1/0/9 port link-mode route # interface GigabitEthernet1/0/10 port link-mode route # interface GigabitEthernet1/0/11 port link-mode route # security-zone name Local # security-zone name Trust import interface GigabitEthernet1/0/1 import interface Virtual-Template1 # security-zone name DMZ # security-zone name Untrust import interface GigabitEthernet1/0/3 # security-zone name Management import interface GigabitEthernet1/0/0 import interface GigabitEthernet1/0/2 # scheduler logfile size 16 # line class aux user-role network-operator # line class console authentication-mode scheme user-role network-admin # line class usb user-role network-admin # line class vty user-role network-operator # line aux 0 user-role network-admin # line con 0 user-role network-admin # line vty 0 63 authentication-mode scheme user-role network-admin # ip route-static 0.0.0.0 0 GigabitEthernet1/0/3 120.196.93.177 ip route-static 172.10.0.0 16 172.100.1.1 # info-center source FILTER logfile deny # ssh server enable # domain system # domain default enable system # role name level-0 description Predefined level-0 role # role name level-1 description Predefined level-1 role # role name level-2 description Predefined level-2 role # role name level-3 description Predefined level-3 role # role name level-4 description Predefined level-4 role # role name level-5 description Predefined level-5 role # role name level-6 description Predefined level-6 role # role name level-7 description Predefined level-7 role # role name level-8 description Predefined level-8 role # role name level-9 description Predefined level-9 role # role name level-10 description Predefined level-10 role # role name level-11 description Predefined level-11 role # role name level-12 description Predefined level-12 role # role name level-13 description Predefined level-13 role # role name level-14 description Predefined level-14 role # user-group system # local-user admin class manage password hash $h$6$B09jldzECww4j80c$0wUodAmxDN7hleI4/iQk8BZx5qAok9x6SnEGOVLp78IYQ56sL35Ueb2NszVVTK1x9tQE+i1DEHiqE1lnqMD+uA== service-type ssh terminal http https authorization-attribute user-role level-3 authorization-attribute user-role network-admin authorization-attribute user-role network-operator # local-user admin class network password cipher $c$3$HBAeP9rB20zNzQS5NINAZ6AtyAXkQCHH service-type ppp authorization-attribute user-role network-operator # session synchronization enable session synchronization http # ipsec logging negotiation enable # l2tp-group 1 mode lns allow l2tp virtual-template 1 undo tunnel authentication # l2tp enable # ike logging negotiation enable # ip https enable # inspect logging parameter-profile av_logging_default_parameter # inspect logging parameter-profile ips_logging_default_parameter # inspect logging parameter-profile url_logging_default_parameter # loadbalance isp file flash:/lbispinfo_v1.5.tp # traffic-policy rule 1 name GuideAVCPolicy action qos profile guideavcprofile1 source-zone Trust destination-zone DMZ destination-zone Untrust profile name guideavcprofile1 bandwidth downstream guaranteed 100000000 bandwidth downstream maximum 100000000 # security-policy ip rule 1 name GuideSecPolicy action pass source-zone Trust destination-zone Untrust destination-zone DMZ rule 0 name p action pass source-zone Trust source-zone Local destination-zone Local destination-zone Untrust rule 4 name Trust-Untrust action pass source-zone Trust destination-zone Untrust rule 5 name L2TP action pass source-zone Untrust destination-zone Local rule 6 name 1 action pass source-zone Untrust destination-zone Trust # ips logging parameter-profile ips_logging_default_parameter # anti-virus logging parameter-profile av_logging_default_parameter # return