问

MSR3620，内网使用外网IP无法访问内网设备

2022-03-31提问

0关注
1收藏，1403浏览

zhiliao_xfT5i

zhiliao_xfT5i 零段

粉丝：0人关注：0人

问题描述：

外网访问正常但内网使用外网IP无法访问内网设备，因为设备用到很多端口，直接使用一对一静态全端口映射，内网口已开启nat hairpin

组网及组网描述：

MSR3620 V7最新版本821P18 ，交换机5560S，三个不同网段

四IP：114.114.114.109主，114.114.114.110一对一映射，114.114.114.111一对一映射（IP瞎写的忽略）

开启nat hairpin为啥内网访问不行，所有设置都是WEB操作设置的,还需要设置哪里

#
version 7.1.064, Release 0821P18
#
sysname H3C
#
clock timezone Beijing add 08:00:00
clock protocol none
#
wlan global-configuration
#
qos carl 1 destination-ip-address object-group SW2 per-address shared-bandwidth time-range word
qos carl 2 destination-ip-address object-group SW3 per-address shared-bandwidth time-range word
qos carl 3 destination-ip-address object-group SW4 per-address shared-bandwidth time-range word
qos carl 4 destination-ip-address object-group SW5 per-address shared-bandwidth time-range word
qos carl 5 destination-ip-address object-group SW6 per-address shared-bandwidth time-range word
#
track 1022 nqa entry ge0/2 1 reaction 1
#
track 1023 nqa entry ge0/1 1 reaction 1
#
dialer-group 3 rule ip permit
#
nat address-group 0
#
nat static inbound 112.112.112.111 172.16.7.241
nat static inbound 112.112.112.110 172.16.5.226
nat static outbound 172.16.5.226 112.112.112.110
nat static outbound 172.16.7.241 112.112.112.111
#
dhcp enable
dhcp server always-broadcast
#
dns proxy enable
#
system-working-mode standard
password-recovery enable
#
vlan 1
#
object-group ip address dstgroup20
0 network subnet 0.0.0.0 0.0.0.0
#
object-group ip address srcgroup20
0 network host address 172.16.7.66
#
object-group ip address SW2
#
object-group ip address SW3
#
object-group ip address SW4
#
object-group ip address SW5
#
object-group ip address SW6
#
dhcp server ip-pool ge0
gateway-list 172.16.1.1
network 172.16.1.0 mask 255.255.255.0
address range 172.16.1.14 172.16.1.225
dns-list 211.138.180.2
#
dhcp server ip-pool lan1
gateway-list 192.168.0.1
network 192.168.0.0 mask 255.255.254.0
address range 192.168.1.2 192.168.1.254
dns-list 192.168.0.1
#
policy-based-route pbr2 permit node 0
if-match acl name acl20
apply output-interface Dialer2
#
nqa entry ge0/1 1
type icmp-echo
destination ip 211.138.180.2
frequency 10000
out interface GigabitEthernet0/1
probe timeout 1000
reaction 1 checked-element probe-fail threshold-type consecutive 5 action-type trigger-only
#
nqa entry ge0/2 1
type icmp-echo
destination ip 211.138.180.2
frequency 10000
out interface Dialer2
probe timeout 1000
reaction 1 checked-element probe-fail threshold-type consecutive 5 action-type trigger-only
#
nqa schedule ge0/1 1 start-time now lifetime forever
nqa schedule ge0/2 1 start-time now lifetime forever
#
controller Cellular0/0
#
interface Dialer1
mtu 1492
#
interface Dialer2
mtu 1492
ppp chap password cipher $c$3$jgbo2BfUudfNk/dvCx68/2GeZWmugm16Zw==
ppp chap user 13675518888
ppp ipcp dns admit-any
ppp ipcp dns request
ppp pap local-user 13675518888 password cipher $c$3$OoXOadb2cjMfEJ9VKrOqzMxazq04bsmvTw==
dialer bundle enable
dialer-group 3
dialer timer idle 0
dialer timer autodial 5
ip address ppp-negotiate
tcp mss 1280
ip last-hop hold
packet-filter name WebPing17413 inbound
nat outbound
nat static enable
#
interface NULL0
#
interface GigabitEthernet0/0
port link-mode route
description LAN-interface
combo enable copper
ip address 172.16.1.1 255.255.255.0
tcp mss 1280
nat hairpin enable
ip policy-based-route pbr2
ip subscriber l2-connected enable
ip subscriber initiator dhcp enable
ip subscriber initiator unclassified-ip enable
ip subscriber dhcp domain ipoeenabledomain
ip subscriber unclassified-ip domain ipoeenabledomain
#
interface GigabitEthernet0/1
port link-mode route
description Double_Line1
bandwidth 200000
combo enable copper
ip address 114.114.114.119 255.255.255.0
dns server 211.138.180.2
tcp mss 1280
ip last-hop hold
packet-filter name WebPing3 inbound
qos reserved-bandwidth pct 100
qos lr outbound cir 200000 cbs 12500000 ebs 0
qos car inbound carl 1 cir 65536 cbs 4096000 ebs 0 green pass red discard yellow pass
qos car inbound carl 2 cir 65536 cbs 4096000 ebs 0 green pass red discard yellow pass
qos car inbound carl 3 cir 65536 cbs 4096000 ebs 0 green pass red discard yellow pass
qos car inbound carl 4 cir 65536 cbs 4096000 ebs 0 green pass red discard yellow pass
qos car inbound carl 5 cir 65536 cbs 4096000 ebs 0 green pass red discard yellow pass
nat outbound
nat static enable
ipsec apply policy WAN1(GE1)
ipsec no-nat-process enable
#
interface GigabitEthernet0/2
port link-mode route
description Double_Line2
combo enable copper
nat static enable
pppoe-client dial-bundle-number 2
#
interface GigabitEthernet0/3
port link-mode route
combo enable copper
#
interface GigabitEthernet0/4
port link-mode route
shutdown
#
interface GigabitEthernet0/5
port link-mode route
shutdown
#
security-zone name Local
#
security-zone name Trust
#
security-zone name DMZ
#
security-zone name Untrust
#
security-zone name Management
#
scheduler logfile size 16
#
line class console
user-role network-admin
#
line class tty
user-role network-operator
#
line class usb
user-role network-admin
#
line class vty
user-role network-operator
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-operator
#
ip route-static 0.0.0.0 0 GigabitEthernet0/1 112.30.112.1 track 1023
ip route-static 0.0.0.0 0 Dialer2 preference 100
ip route-static 172.16.2.0 24 GigabitEthernet0/0 172.16.1.2
ip route-static 172.16.3.0 24 GigabitEthernet0/0 172.16.1.2
ip route-static 172.16.4.0 24 GigabitEthernet0/0 172.16.1.2
ip route-static 172.16.5.0 24 GigabitEthernet0/0 172.16.1.2
ip route-static 172.16.6.0 24 GigabitEthernet0/0 172.16.1.2
ip route-static 172.16.7.0 24 GigabitEthernet0/0 172.16.1.2
ip route-static 172.16.8.0 24 GigabitEthernet0/0 172.16.1.2
ip route-static 211.138.180.2 32 GigabitEthernet0/1 112.30.112.1 description NqaTrack
ip route-static 211.138.180.2 32 Dialer2 description NqaTrack
#
info-center loghost 127.0.0.1 port 3301
info-center source CFGLOG loghost level informational
#
performance-management
#
time-range tr20 00:00 to 24:00 daily
time-range word 09:30 to 22:00 working-day Sat
#
acl advanced name WebPing3
rule 1 deny icmp icmp-type echo
#
acl advanced name WebPing17413
rule 1 deny icmp icmp-type echo
#
acl advanced name acl20
rule 1 permit ip source object-group srcgroup20 destination object-group dstgroup20 time-range tr20
rule 1 comment --
#
password-control enable
undo password-control aging enable
undo password-control history enable
password-control length 6
password-control login-attempt 3 exceed lock-time 10
password-control update-interval 0
password-control login idle-time 0
#
domain ipoeenabledomain
authorization-attribute idle-cut 5 1
authentication ipoe none
authorization ipoe none
accounting ipoe none
#
domain system
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
service-type telnet http https
authorization-attribute user-role network-admin
#
local-user dothink class network
password cipher $c$3$TZCczikgenTrJCs+bvOWzS6qMa3glH/waVWr
access-limit 130
service-type portal
service-type ppp
authorization-attribute user-role network-operator
#
session statistics enable
#
ipsec transform-set WAN1(GE1)@DOTHINK
esp encryption-algorithm aes-cbc-128
esp authentication-algorithm sha1
#
ipsec policy-template WAN1(GE1) 65535
transform-set WAN1(GE1)@DOTHINK
description WAN1(GE1)@DOTHINK
ike-profile WAN1(GE1)@DOTHINK
sa duration time-based 3600
sa duration traffic-based 1843200
reverse-route dynamic
reverse-route preference 100
#
ipsec policy WAN1(GE1) 65535 isakmp template WAN1(GE1)
#
ike profile WAN1(GE1)@DOTHINK
keychain WAN1(GE1)@DOTHINK
exchange-mode aggressive
match remote identity address 0.0.0.0 0.0.0.0
proposal 65535
#
ike proposal 65535
encryption-algorithm aes-cbc-128
dh group2
#
ike keychain WAN1(GE1)@DOTHINK
pre-shared-key address 0.0.0.0 0.0.0.0 key cipher $c$3$gJq47sx46/tsZCiAOZdxkmtVU9IU1Pki4Dct
#
ip http enable
ip https enable
web new-style
#
url-filter category custom severity 65535
#
wlan ap-group default-group
vlan 1
#
traffic-policy
rule 1 name web_AppTraffRank
application app http
#
dac log-collect service dpi traffic enable
dac traffic-statistic application enable
#
dac storage service dpi traffic limit hold-time 1
dac storage service traffic limit hold-time 1
#
cloud-management server domain oasis.h3c.com
#
return