M9000防火墙NAT转换443端口的问题

使用H3C M9000做NAT地址和端口转换。

问题是：

1，防火墙做了NAT地址和443端口转换之后，只有ip:443 -> ip:443的这种不转换443端口的方式可以访问成功，而ip:9443 -> ip:443这种转换了443端口的方式则不能成功。具体是：

https://10.10.10.6:443      #可以成功打开Server A的https页面

https://10.10.10.6:9443    #无法打开Server B的https页面

请协助判断问题出在哪里？

组网需求是：

1，PC 1能打开server A和server B的https页面；

2，Server A和Server B开放https服务（端口443）。

网络拓扑图如下：

防火墙的相关配置如下：

#
 security-zone intra-zone default permit
#       
 system-working-mode standard
 password-recovery enable
#
vlan 1
#
interface NULL0
#
interface M-GigabitEthernet1/0/0/0
 ip binding vpn-instance management
 ip address 192.168.0.1 255.255.255.0
#
interface Ten-GigabitEthernet2/5/0/1
 port link-mode route
 ip address 10.10.10.115 255.255.255.0
 nat outbound 3997 address-group 1 port-preserved
 nat server protocol tcp global 10.10.10.6 22 inside 192.168.1.1 22
 nat server protocol tcp global 10.10.10.6 222 inside 192.168.1.2 22
 nat server protocol tcp global 10.10.10.6 443 inside 192.168.1.253 443
 nat server protocol tcp global 10.10.10.6 9443 inside 192.168.1.252 443
 nat static enable

#
interface Ten-GigabitEthernet2/5/0/2
 port link-mode route
 ip address 192.168.1.254 255.255.255.0
#
security-zone name Local
#
security-zone name Trust
 import interface Ten-GigabitEthernet2/5/0/2
#
security-zone name DMZ
#
security-zone name Untrust
 import interface Ten-GigabitEthernet2/5/0/1
#
security-zone name Management
 import interface M-GigabitEthernet1/0/0/0
#
zone-pair security source DMZ destination Trust
#
zone-pair security source Local destination Trust
 packet-filter 3998
#
zone-pair security source Local destination Untrust
 packet-filter 3998
#
zone-pair security source Trust destination DMZ
#
zone-pair security source Trust destination Local
 packet-filter 3998
#
zone-pair security source Trust destination Untrust
 packet-filter 3997
#
zone-pair security source Untrust destination Local
 packet-filter 3999
#
zone-pair security source Untrust destination Trust
 packet-filter 3001
#
 scheduler logfile size 16
#
 ip route-static 0.0.0.0 0 10.10.10.254
#
 ssh server enable
 undo ssh server compatible-ssh1x enable
#
acl number 3001
 rule 0 permit ip
#
acl number 3997
 rule 0 permit ip
#
acl number 3998
 rule 1 permit ip
#  
acl number 3999
 rule 0 permit ip
#
domain system
#
 domain default enable system
#
user-group system
#
nat address-group 1
 address 10.10.10.115 10.10.10.115
#
 ip https enable