终端设备ping外网请求超时。

在配置完防火墙，核心交换机，汇聚交换机，接入交换机的情况下，终端的设备和无线都能自动获取到IP地址（核心充当的DHCP服务器），终端设备ping防火墙管理地址（192.168.110.1）和其他设备管理地址都可以ping通，终端设备去ping防火墙外网119.180.25.107ping不通，防火墙里也配置了安全策略放通，核心，防火墙，汇聚写有路由。

防火墙

interface gigabitethernet 1/0/2

 ip address 119.180.25.107 255.255.255.192

quit

interface GigabitEthernet 1/0/3

ip add 192.168.110.1 24

qu

ip route-static 0.0.0.0 0 119.180.25.65

ip route-static 192.168.0.0 16 192.168.110.2

ip route-static 172.16.0.0 16 192.168.110.2

security-zone name Untrust

import interface GigabitEthernet 1/0/2

quit

security-zone name Trust

import interface GigabitEthernet 1/0/3

quit

nat address-group 0

address 119.180.25.65 119.180.25.107

quit

acl basic 2000

rule permit source 192.168.0.0 0.0.255.255

rule permit source 172.16.0.0 0.0.255.255

quit

interface GigabitEthernet 1/0/2

nat outbound 2000 address-group 0

quit

security-policy ip 

rule 0 name 0 

action pass  

counting enable

source-zone local  

source-zone Trust  

source-zone Untrust  

destination-zone local  

destination-zone Trust  

destination-zone Untrust  

quit

acl advanced 3001

rule permit ip source 192.168.0.0 0.0.255.255

rule permit ip source 172.16.0.0 0.0.255.255

quit

zone-pair security source Trust destination Untrust

packet-filter 3001

quit