MSR3600设置VPN

单位路由器是H3C MSR3600，连接三条网络，期中一条是电信专线有公网固定IP，因为业务需要想要设置VPN。现在VPN设置基本没啥问题，但是公网无法连接，测试之后发现通过公网无法ping通路由器上的公网IP地址，不知道是哪里设置有问题。现在把路由器配置贴上来，各位大神给瞧瞧咋回事

路由器配置：

#

 version 7.1.064, Release 0809P28

#

 sysname Internet-Roter

#

 clock timezone Beijing add 08:00:00

 clock protocol ntp

#

 telnet server enable

#

 security-zone intra-zone default permit

#

track 1 nqa entry admin pppoe0591 reaction 1

#

track 2 nqa entry admin pppoe0309 reaction 1

#

track 3 nqa entry admin zx reaction 1

#

ospf 10 router-id 10.255.255.1

 default-route-advertise always

 import-route direct

 area 0.0.0.0

  network 172.255.255.1 0.0.0.0

#

 dialer-group 10 rule ip permit

#

 ip unreachables enable

 ip ttl-expires enable

#

 dhcp enable

 dhcp server always-broadcast

#

 dns proxy enable

#

 lldp global enable

#

 password-recovery enable

#

vlan 1

#

object-group service FW

 0 service tcp destination eq 12306

#

dhcp server ip-pool lan1

 gateway-list 192.168.0.1

 network 192.168.0.0 mask 255.255.254.0

 address range 192.168.1.2 192.168.1.254

 dns-list 192.168.0.1

#

policy-based-route pbr permit node 10

 if-match acl 3010

 apply next-hop 192.168.2.1 track 1

#

policy-based-route pbr permit node 20

 if-match acl 3020

 apply next-hop 192.168.1.1 track 2

#

nqa entry admin pppoe0309

 type icmp-echo

  description ip 192.168.1.1

  frequency 100

  reaction 1 checked-element probe-fail threshold-type consecutive 5 action-type trigger-only

  source ip 192.168.1.2

#

nqa entry admin pppoe0591

 type icmp-echo

  destination ip 192.168.2.1

  frequency 100

  reaction 1 checked-element probe-fail threshold-type consecutive 5 action-type trigger-only

  source ip 192.168.2.2

#

nqa entry admin zx

 type icmp-echo

  destination ip 113.200.75.1

  frequency 100

  reaction 1 checked-element probe-fail threshold-type consecutive 5 action-type trigger-only

  source ip 113.200.75.79

#

 nqa schedule admin pppoe0591 start-time now lifetime forever

 nqa schedule admin zx start-time now lifetime forever

#

controller Cellular0/0

#

interface Aux0

#

interface Virtual-Template0

#

interface NULL0

#

interface Vlan-interface1

 description LAN-interface

 ip address 192.168.0.1 255.255.255.0

 tcp mss 1280

 undo dhcp select server

#

interface GigabitEthernet0/0

 port link-mode route

 description PPPOE-02989630591

 ip address 192.168.2.2 255.255.255.0

 nat outbound 3000

#

interface GigabitEthernet0/1

 port link-mode route

 description DianXin-ZhuanXin

 ip address 113.200.75.79 255.255.255.128

 nat outbound 3000

#

interface GigabitEthernet0/2

 port link-mode route

 description PPPOE-02989630309

 ip address 192.168.1.2 255.255.255.0

 nat outbound 3000

#

interface GigabitEthernet0/3

 port link-mode route

 ip address 172.255.255.1 255.255.255.252

 ospf network-type p2p

 ip policy-based-route pbr

#

interface GigabitEthernet0/27

 port link-mode route

#

interface GigabitEthernet0/4

 port link-mode bridge

#

interface GigabitEthernet0/5

 port link-mode bridge

#

interface GigabitEthernet0/6

 port link-mode bridge

#

interface GigabitEthernet0/7

 port link-mode bridge

#

interface GigabitEthernet0/8

 port link-mode bridge

#

interface GigabitEthernet0/9

 port link-mode bridge

#

interface GigabitEthernet0/10

 port link-mode bridge

#

interface GigabitEthernet0/11

 port link-mode bridge

#

interface GigabitEthernet0/12

 port link-mode bridge

#

interface GigabitEthernet0/13

 port link-mode bridge

#

interface GigabitEthernet0/14

 port link-mode bridge

#

interface GigabitEthernet0/15

 port link-mode bridge

#

interface GigabitEthernet0/16

 port link-mode bridge

#

interface GigabitEthernet0/17

 port link-mode bridge

#

interface GigabitEthernet0/18

 port link-mode bridge

#

interface GigabitEthernet0/19

 port link-mode bridge

#

interface GigabitEthernet0/20

 port link-mode bridge

#

interface GigabitEthernet0/21

 port link-mode bridge

#

interface GigabitEthernet0/22

 port link-mode bridge

#

interface GigabitEthernet0/23

 port link-mode bridge

#

interface GigabitEthernet0/24

 port link-mode bridge

#

interface GigabitEthernet0/25

 port link-mode bridge

#

interface GigabitEthernet0/26

 port link-mode bridge

#

object-policy ip Local-Local

 rule 0 pass counting

#

object-policy ip Local-Trust

 rule 0 pass counting

#

object-policy ip Local-Untrust

 rule 0 pass counting

#

object-policy ip Trust-Local

 rule 0 pass counting

#

object-policy ip Trust-Trust

 rule 0 pass counting

#

object-policy ip Trust-Untrust

 rule 0 pass counting

#

object-policy ip Untrust-Local

 rule 1 pass service FW counting

#

security-zone name Local

#

security-zone name Trust

 import interface GigabitEthernet0/3

#

security-zone name DMZ

#

security-zone name Untrust

 import interface GigabitEthernet0/0

 import interface GigabitEthernet0/1

 import interface GigabitEthernet0/2

#

security-zone name Management

#

zone-pair security source Local destination Local

 object-policy apply ip Local-Local

#

zone-pair security source Local destination Trust

 object-policy apply ip Local-Trust

#

zone-pair security source Local destination Untrust

 object-policy apply ip Local-Untrust

#

zone-pair security source Trust destination Local

 object-policy apply ip Trust-Local

#

zone-pair security source Trust destination Trust

 object-policy apply ip Trust-Trust

#

zone-pair security source Trust destination Untrust

 object-policy apply ip Trust-Untrust

#

zone-pair security source Untrust destination Local

 object-policy apply ip Untrust-Local

#

 scheduler logfile size 16

#

line class aux

 user-role network-admin

#

line class tty

 user-role network-operator

#

line class vty

 user-role network-operator

#

line aux 0

 user-role network-admin

#

line vty 0 63

 authentication-mode scheme

 user-role network-admin

 user-role network-operator

#

 ip route-static 0.0.0.0 0 192.168.2.1 preference 100

 ip route-static 0.0.0.0 0 192.168.1.1 preference 150

 ip route-static 0.0.0.0 0 113.200.75.1 track 3

#

 ssh server enable

 ssh server acl 2000

 ssh server port 12306

#

 ntp-service enable

 ntp-service unicast-server 114.118.7.161

#

acl advanced 3000

 rule 0 permit ip

#

acl advanced 3010

 description PPPOE-02989630591

 rule 0 permit ip source 172.16.10.0 0.0.1.255

 rule 5 permit ip source 172.16.20.0 0.0.1.255

 rule 10 permit ip source 172.16.30.0 0.0.1.255

#

acl advanced 3020

 description PPPOE-02989630309

 rule 0 permit ip source 172.16.15.0 0.0.0.255

 rule 5 permit ip source 172.16.25.0 0.0.0.255

 rule 10 permit ip source 172.16.40.0 0.0.0.255

#

 password-control enable

 undo password-control aging enable

 undo password-control length enable

 undo password-control composition enable

 undo password-control history enable

 password-control length 6

 password-control login-attempt 3 exceed lock-time 2

 password-control update-interval 0

 password-control login idle-time 0

 undo password-control complexity user-name check

 undo password-control change-password first-login enable

#

domain system

#

 domain default enable system

#

role name level-0

 description Predefined level-0 role

#

role name level-1

 description Predefined level-1 role

#

role name level-2

 description Predefined level-2 role

#

role name level-3

 description Predefined level-3 role

#

role name level-4

 description Predefined level-4 role

#

role name level-5

 description Predefined level-5 role

#

role name level-6

 description Predefined level-6 role

#

role name level-7

 description Predefined level-7 role

#

role name level-8

 description Predefined level-8 role

#

role name level-9

 description Predefined level-9 role

#

role name level-10

 description Predefined level-10 role

#

role name level-11

 description Predefined level-11 role

#

role name level-12

 description Predefined level-12 role

#

role name level-13

 description Predefined level-13 role

#

role name level-14

 description Predefined level-14 role

#

user-group system

#

local-user admin class manage

 service-type ftp

 service-type ssh telnet terminal http https

 authorization-attribute user-role level-15

 authorization-attribute user-role network-admin

 authorization-attribute user-role network-operator

#

local-user administrator class manage

 service-type ssh telnet terminal

 authorization-attribute user-role level-15

 authorization-attribute user-role network-admin

 authorization-attribute user-role network-operator

#

 ip http enable

 ip https enable

#

wlan global-configuration

#

wlan ap-group default-group

 vlan 1

#

return

核心交换机配置#

 version 7.1.070, Release 7557P03

#

 sysname Core-S7003

#

 telnet server enable

#

 forward-path-detection enable

#

ospf 10 router-id 172.255.255.2

 import-route direct

 area 0.0.0.0

  network 172.255.255.2 0.0.0.0

#

 ip unreachables enable

 ip ttl-expires enable

#

 dhcp enable

 dhcp server forbidden-ip 172.16.10.2 172.16.10.100

 dhcp server forbidden-ip 172.16.20.2 172.16.20.100

 dhcp server forbidden-ip 172.16.30.2 172.16.30.100

#

 dns proxy enable

#

 lldp global enable

#

 system-working-mode standard

 xbar load-balance

 password-recovery enable

#

vlan 1

#

vlan 10

 description lu bo fu wu qi

#

vlan 15

 description guang bo

#

vlan 20

 description 监控

#

vlan 25

 description xiao xue ban gong - jiao xue

#

vlan 30

 description zhong xue ban gong - jiao xue

#

vlan 35

 description 3#net

#

vlan 40

 description WLAN

#

vlan 100

 description SW-Manager

#

vlan 142

 description 软件开发

#

 stp global enable

#

ftth

#

dhcp server ip-pool 1#

 gateway-list 172.16.20.1

 network 172.16.20.0 mask 255.255.254.0

 dns-list 61.134.1.4 218.30.19.40

#

dhcp server ip-pool 2#

 gateway-list 172.16.10.1

 network 172.16.10.0 mask 255.255.254.0

 dns-list 61.134.1.4 218.30.19.40

#

dhcp server ip-pool 3#

 gateway-list 172.16.30.1

 network 172.16.30.0 mask 255.255.254.0

 dns-list 61.134.1.4 218.30.19.40

#

dhcp server ip-pool wifi

 gateway-list 172.16.40.1

 network 172.16.40.0 mask 255.255.252.0

 dns-list 61.134.1.4 218.30.19.40

#

interface NULL0

#

interface Vlan-interface1

#

interface Vlan-interface10

 description lu bo fu wu qi

 ip address 192.168.0.1 255.255.255.0

#

interface Vlan-interface15

 description guang bo

 ip address 192.168.10.1 255.255.255.0

#

interface Vlan-interface20

 description eHome

 ip address 192.168.8.254 255.255.254.0

#

interface Vlan-interface25

 description xiao xue ban gong - jiao xue

 ip address 172.16.10.1 255.255.254.0

 ip address 172.16.15.1 255.255.255.0 sub

 dhcp server apply ip-pool 2#

#

interface Vlan-interface30

 description zhong xue ban gong - jiao xue

 ip address 172.16.20.1 255.255.254.0

 ip address 172.16.25.1 255.255.255.0 sub

 dhcp server apply ip-pool 1#

#

interface Vlan-interface35

 description 3#bangong

 ip address 172.16.30.1 255.255.254.0

 ip address 172.16.35.1 255.255.255.0 sub

 dhcp server apply ip-pool 3#

#

interface Vlan-interface40

 description 智慧课堂

 ip address 172.16.40.1 255.255.255.0

#

interface Vlan-interface100

 description SW-Manager

 ip address 192.168.100.1 255.255.255.0

#

interface Vlan-interface142

 description 程序开发服务器

 ip address 192.168.142.1 255.255.255.0

#

interface GigabitEthernet1/0/24

 port link-mode route

 description H3C-MSR3600

 ip address 172.255.255.2 255.255.255.252

 ospf network-type p2p

 packet-filter 3000 inbound

#

interface GigabitEthernet0/0/1

 port link-mode bridge

 description zhong xue ban gong - jiaoxue

 port access vlan 30

#

interface GigabitEthernet0/0/2

 port link-mode bridge

 description zhong xue guang bo

 port access vlan 15

#

interface GigabitEthernet0/0/3

 port link-mode bridge

 description 3#bangong

 port access vlan 35

 speed 1000

 duplex full

#

interface GigabitEthernet0/0/4

 port link-mode bridge

 description 3#guangbo

 port access vlan 15

#

interface GigabitEthernet0/0/5

 port link-mode bridge

#

interface GigabitEthernet0/0/6

 port link-mode bridge

#

interface GigabitEthernet0/0/7

 port link-mode bridge

#

interface GigabitEthernet0/0/8

 port link-mode bridge

#

interface GigabitEthernet0/0/9

 port link-mode bridge

#

interface GigabitEthernet0/0/10

 port link-mode bridge

#

interface GigabitEthernet0/0/11

 port link-mode bridge

#

interface GigabitEthernet0/0/12

 port link-mode bridge

#

interface GigabitEthernet0/0/13

 port link-mode bridge

#

interface GigabitEthernet0/0/14

 port link-mode bridge

#

interface GigabitEthernet0/0/15

 port link-mode bridge

#

interface GigabitEthernet0/0/16

 port link-mode bridge

#

interface GigabitEthernet0/0/17

 port link-mode bridge

#

interface GigabitEthernet0/0/18

 port link-mode bridge

#

interface GigabitEthernet0/0/19

 port link-mode bridge

#

interface GigabitEthernet0/0/20

 port link-mode bridge

#

interface GigabitEthernet0/0/21

 port link-mode bridge

#

interface GigabitEthernet0/0/22

 port link-mode bridge

#

interface GigabitEthernet0/0/23

 port link-mode bridge

#

interface GigabitEthernet0/0/24

 port link-mode bridge

#

interface GigabitEthernet1/0/1

 port link-mode bridge

 port access vlan 10

#

interface GigabitEthernet1/0/2

 port link-mode bridge

 port access vlan 20

#

interface GigabitEthernet1/0/3

 port link-mode bridge

 port access vlan 20

#

interface GigabitEthernet1/0/4

 port link-mode bridge

 port access vlan 20

#

interface GigabitEthernet1/0/5

 port link-mode bridge

 port access vlan 15

#

interface GigabitEthernet1/0/6

 port link-mode bridge

 port access vlan 15

#

interface GigabitEthernet1/0/7

 port link-mode bridge

 port access vlan 15

#

interface GigabitEthernet1/0/8

 port link-mode bridge

 port access vlan 15

#

interface GigabitEthernet1/0/9

 port link-mode bridge

 port access vlan 20

#

interface GigabitEthernet1/0/10

 port link-mode bridge

 port access vlan 20

#

interface GigabitEthernet1/0/11

 port link-mode bridge

 port access vlan 20

#

interface GigabitEthernet1/0/12

 port link-mode bridge

 port access vlan 20

#

interface GigabitEthernet1/0/13

 port link-mode bridge

 port access vlan 25

#

interface GigabitEthernet1/0/14

 port link-mode bridge

 port access vlan 25

#

interface GigabitEthernet1/0/15

 port link-mode bridge

 port access vlan 25

#

interface GigabitEthernet1/0/16

 port link-mode bridge

 port access vlan 25

#

interface GigabitEthernet1/0/17

 port link-mode bridge

 port access vlan 15

#

interface GigabitEthernet1/0/18

 port link-mode bridge

 port access vlan 40

#

interface GigabitEthernet1/0/19

 port link-mode bridge

 port access vlan 40

#

interface GigabitEthernet1/0/20

 port link-mode bridge

 port access vlan 142

#

interface GigabitEthernet1/0/21

 port link-mode bridge

 description NSFOCUS-ShangWangXingWei-Manager

 port access vlan 100

#

interface GigabitEthernet1/0/22

 port link-mode bridge

 description NSFOCUS-RuQinJianCe-Manager

 port access vlan 100

#

interface GigabitEthernet1/0/23

 port link-mode bridge

 description NSFOCUS-FW-Manager

 port access vlan 100

#

interface M-GigabitEthernet0/0/0

#

interface Ten-GigabitEthernet0/0/25

 port link-mode bridge

#

interface Ten-GigabitEthernet0/0/26

 port link-mode bridge

#

interface Ten-GigabitEthernet0/0/27

 port link-mode bridge

#

interface Ten-GigabitEthernet0/0/28

 port link-mode bridge

#

interface Ten-GigabitEthernet1/0/25

 port link-mode bridge

#

interface Ten-GigabitEthernet1/0/26

 port link-mode bridge

#

interface Ten-GigabitEthernet1/0/27

 port link-mode bridge

#

interface Ten-GigabitEthernet1/0/28

 port link-mode bridge

#

 scheduler logfile size 16

#

line class aux

 user-role network-admin

#

line class vty

 user-role network-operator

#

line aux 0 1

 user-role network-admin

#

line vty 0 4

 authentication-mode scheme

 user-role level-3

 user-role network-admin

 user-role network-operator

 set authentication password hash $h$6$p66cRxLgjq7XnMiR$3BoEtnD+adgSeBFUPrfFxOHLNWs/YzuAaftLLdxE+UIPrRYct8vQOi3Co5SVOrk5DYpUJgKnLJXve1+nxBPCBQ==

#

line vty 5 63

 authentication-mode scheme

 user-role network-admin

 user-role network-operator

#

 ip route-static 0.0.0.0 0 192.168.100.1

#

 undo info-center enable

#

 ssh server enable

#

acl advanced 3000

 rule 0 deny ip source 192.168.10.0 0.0.0.255

 rule 5 deny ip source 192.168.8.0 0.0.1.255

 rule 100 permit ip

#

domain system

#

 domain default enable system

#

role name level-0

 description Predefined level-0 role

#

role name level-1

 description Predefined level-1 role

#

role name level-2

 description Predefined level-2 role

#

role name level-3

 description Predefined level-3 role

#

role name level-4

 description Predefined level-4 role

#

role name level-5

 description Predefined level-5 role

#

role name level-6

 description Predefined level-6 role

#

role name level-7

 description Predefined level-7 role

#

role name level-8

 description Predefined level-8 role

#

role name level-9

 description Predefined level-9 role

#

role name level-10

 description Predefined level-10 role

#

role name level-11

 description Predefined level-11 role

#

role name level-12

 description Predefined level-12 role

#

role name level-13

 description Predefined level-13 role

#

role name level-14

 description Predefined level-14 role

#

user-group system

#

local-user admin class manage

 password hash $h$6$d8JvuOWjt8vld5mC$/G1K/YanXR/X71I6InP4WSJnOFZnz4BtyH+2llGd0FnvOeIe0BC5kCzl7j/RTyQqD2/JBQqydUOW4sdOnPiVSQ==

 service-type telnet http https ssh terminal

 authorization-attribute user-role level-15

 authorization-attribute user-role network-admin

 authorization-attribute user-role network-operator

#

 ip http enable

 ip https enable

#

return