F1000-AK115-双线接入，如何配置外网以及端口映射

#
version 7.1.064, Ess 9514P08
#
sysname H3C
#
clock timezone beijing add 08:00:00
clock protocol none
#
context Admin id 1
#
ip vpn-instance 1000mb
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
dialer-group 1 rule ip permit
dialer-group 2 rule ip permit
#
nat address-group 100 name 办公电脑
address 192.168.2.100 192.168.2.199
#
password-recovery enable
#
vlan 1
#
object-group ip address Server
security-zone Trust
0 network range 192.168.2.200 192.168.2.254
#
object-group ip address 内网用户地址
description 内网用户地址
security-zone Trust
0 network range 192.168.2.100 192.168.2.199
#
interface Dialer1
mtu 1492
ppp chap password cipher $c$3o+zyWx
ppp chap user CD0283391143522
ppp ipcp dns admit-any
ppp ipcp dns request
ppp pap local-user CD02833522 password cipher $c$3$aN2OeeVSkS9GRP
dialer bundle enable
dialer-group 2
dialer timer idle 0
dialer timer autodial 5
ip address ppp-negotiate
#
interface NULL0
#
interface GigabitEthernet1/0/0
port link-mode route
combo enable copper
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet1/0/1
port link-mode route
combo enable fiber
#
interface GigabitEthernet1/0/2
port link-mode route
ip address 192.168.1.1 255.255.255.0
#
interface GigabitEthernet1/0/3
port link-mode route
#
interface GigabitEthernet1/0/4
port link-mode route
#
interface GigabitEthernet1/0/5
port link-mode route
#
interface GigabitEthernet1/0/6
port link-mode route
#
interface GigabitEthernet1/0/7
port link-mode route
duplex full
shutdown
ip binding vpn-instance 1000mb
pppoe-client dial-bundle-number 1
#
interface GigabitEthernet1/0/8
port link-mode route
description TO_LAN
ip address 192.168.10.254 255.255.255.0
nat outbound 3100
nat server protocol tcp global 218.89.240.141 1433 inside 192.168.2.117 1433
nat server protocol tcp global 218.89.240.141 2022 inside 192.168.2.252 22
nat server protocol tcp global 218.89.240.141 4502 4503 inside 192.168.2.252 4502 4503
nat server protocol tcp global 218.89.240.141 8078 inside 192.168.2.252 8078
nat server protocol tcp global 218.89.240.141 8082 8085 inside 192.168.2.202 8082 8085
nat server protocol tcp global 218.89.240.141 8089 inside 192.168.2.252 8089
nat server protocol tcp global 218.89.240.141 8092 8199 inside 192.168.2.202 8092 8199
nat server protocol tcp global 218.89.240.141 9999 inside 192.168.2.252 9999
nat server protocol tcp global 218.89.240.141 14800 14820 inside 192.168.2.252 14800 14820
nat server protocol tcp global 218.89.240.141 43388 inside 192.168.2.202 3389
nat server protocol udp global 218.89.240.141 5040 inside 192.168.2.252 5040
nat server protocol udp global 218.89.240.141 5066 inside 192.168.2.252 5066
nat server protocol udp global 218.89.240.141 16000 25000 inside 192.168.2.252 16000 25000
#
interface GigabitEthernet1/0/9
port link-mode route
bandwidth 50000
ip address XXX.XXX.XXX.XXX 255.255.255.128
nat outbound
nat server protocol tcp global 218.89.240.141 1433 inside 192.168.2.117 1433
nat server protocol tcp global 218.89.240.141 2022 inside 192.168.2.252 22
nat server protocol tcp global 218.89.240.141 4502 4503 inside 192.168.2.252 4502 4503
nat server protocol tcp global 218.89.240.141 8078 inside 192.168.2.252 8078
nat server protocol tcp global 218.89.240.141 8082 8085 inside 192.168.2.202 8082 8085
nat server protocol tcp global 218.89.240.141 8089 inside 192.168.2.252 8089
nat server protocol tcp global 218.89.240.141 8092 8199 inside 192.168.2.202 8092 8199
nat server protocol tcp global 218.89.240.141 9999 inside 192.168.2.252 9999
nat server protocol tcp global 218.89.240.141 14800 14820 inside 192.168.2.252 14800 14820
nat server protocol tcp global 218.89.240.141 43388 inside 192.168.2.202 3389
nat server protocol udp global 218.89.240.141 5040 inside 192.168.2.252 5040
nat server protocol udp global 218.89.240.141 5066 inside 192.168.2.252 5066
nat server protocol udp global 218.89.240.141 16000 25000 inside 192.168.2.252 16000 25000
#
security-zone name Local
#
security-zone name Trust
import interface GigabitEthernet1/0/8
#
security-zone name DMZ
#
security-zone name Untrust
import interface Dialer1
import interface GigabitEthernet1/0/7
import interface GigabitEthernet1/0/9
#
security-zone name Management
import interface GigabitEthernet1/0/0
import interface GigabitEthernet1/0/2
#
scheduler logfile size 16
#
line class aux
user-role network-operator
#
line class console
authentication-mode scheme
user-role network-admin
#
line class vty
user-role network-operator
#
line aux 0
user-role network-admin
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-admin
#
ip route-static 0.0.0.0 0 GigabitEthernet1/0/9 218.89.240.129
ip route-static 0.0.0.0 0 Dialer1
ip route-static 192.168.0.0 16 192.168.10.253
#
ssh server enable
#
acl basic 2000
rule 0 permit vpn-instance 1000mb source object-group 内网用户地址
#
acl advanced 3100
description LAN-NAT-LAN
rule 10 permit ip source 192.168.0.0 0.0.255.255 destination 192.168.0.0 0.0.255.255
#
domain system
#
aaa session-limit ftp 16
aaa session-limit telnet 16
aaa session-limit ssh 16
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password hash $h$6$GaYHTcawYnBNvFdPeeKErO+A4mhLG/MBURfFKLLOR/H0xdVy4yH09L6i/gCxBX7Mlrhg==
service-type ssh terminal https
authorization-attribute user-role level-3
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
app-group p2p-youxi
description "User-defined application group"
include application 11Platform
include application 17173
include application 178Game
include application 4399
include application 52PK
include application 7k7k
include application 91Game
include application AnHeiXiYouJi
include application ArclivePlatform
include application BitTorrent
include application ChiBiZhiZhan
include application ChinaGameCenter
include application CrossFire
include application CSOL
include application DaHuaXiYou2
include application DaHuaXiYou3
include application DNF
include application DouZhanShen
include application FaceToFace
include application FanRenXiuZhen
include application GameDog
include application HaoFangFighting
include application HearthStone
include application iQiYiPPS
include application JiangShen
include application JingWuTuan
include application LeagueofLegends
include application Letv
include application MiniXiYou
include application OurGame
include application Popkart
include application QQFarm
include application QQGame
include application QQMaJiang
include application QQParkingSpace
include application QQPlatform
include application QQRanch
include application QQSanGuo
include application QQSpeed
include application QQUpdate
include application QQX5
include application QQYinSu
include application QQZiYouHuanXiang
include application QuanMinChuangTianXia
include application QuanMinXiYou
include application ReXueJiangHu
include application SanGuoSha
include application ShenZhiHaoJie
include application ShiJieOL
include application SuperRunning
include application Thunder
include application TianTianFuWeng
include application TianXia3
include application TongChengYou
include application TuLongZhiRen
include application VSPlatform
include application Weebia
include application XunLeiKanKan
include application YouXiaWang
include application ZhanJianDiGuo
#
app-group 下载
description 用户自定义应用组
#
apr signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
ip http port 8181
ip http enable
ip https port 1443
ip https enable
webui log enable
#
url-filter signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
ips signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
traffic-policy
rule name 2
disable
action qos profile 2M
source-address address-set 内网用户地址
profile name 2M
bandwidth downstream maximum 50000
bandwidth upstream maximum 50000
bandwidth upstream maximum per-ip 5000
bandwidth downstream maximum per-ip 5000
#
uapp-control
#
security-policy ip
rule 0 name local-to-any
action pass
source-zone Local
destination-zone Local
destination-zone Trust
destination-zone DMZ
destination-zone Untrust
destination-zone Management
rule 1 name any-to-local
action pass
source-zone Trust
source-zone DMZ
source-zone Untrust
source-zone Management
destination-zone Local
rule 4 name deny-p2p-youxi
disable
counting enable
source-zone Trust
destination-zone Untrust
source-ip 内网用户地址
app-group p2p-youxi
rule 2 name t-to-u
action pass
source-zone Trust
destination-zone Untrust
rule 3 name u-to-t
action pass
source-zone Untrust
destination-zone Trust
rule 5 name t-to-t
action pass
source-zone Trust
destination-zone Trust
#
anti-virus signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
return

单WAN测试PPPOE拨号没问题后，双WAN上网开启保存接口上一跳在外网口下配置ip last-hop hold测试，不同内网地址走不通wan口需要做策略路由。

端口映射不成功，确保服务器到FW的WAN口地址可达，外部端口未占用，检查配置是否有问题。