F100防火墙映射后，对端无法访问端口，哪里配置有问题

#

 irf mac-address persistent timer

 irf auto-update enable

 undo irf link-delay

 irf member 1 priority 1

#

 dns server 211.138.240.100

 dns server 211.138.245.180

#

 password-recovery enable

#

vlan 1

#

controller Cellular1/0/0

#

controller Cellular1/0/1

#

interface NULL0

#

interface GigabitEthernet1/0/0

 port link-mode route

 combo enable copper

 ip address 192.168.0.1 255.255.255.0

#

interface GigabitEthernet1/0/1

 port link-mode route

 combo enable fiber

#

interface GigabitEthernet1/0/2

 port link-mode route

 ip address 192.168.3.1 255.255.255.0

#

interface GigabitEthernet1/0/3

 port link-mode route

#

interface GigabitEthernet1/0/4

 port link-mode route

#

interface GigabitEthernet1/0/5

 port link-mode route

#

interface GigabitEthernet1/0/6

 port link-mode route

#

interface GigabitEthernet1/0/7

 port link-mode route

#

interface GigabitEthernet1/0/8

 port link-mode route

#

interface GigabitEthernet1/0/9

 port link-mode route

 ip address 192.168.2.1 255.255.255.0

#

interface GigabitEthernet1/0/10

 port link-mode route

 ip address 192.168.1.1 255.255.255.0

#

interface GigabitEthernet1/0/11

 port link-mode route

 ip address 172.20.221.81 255.255.255.0

 nat outbound  

 nat server protocol tcp global 172.20.220.81 85 inside 192.168.1.121 80 rule ServerRule_6 description 85-80

 nat server protocol tcp global 172.20.221.81 448 inside 192.168.1.121 448 rule 12 description 448

 nat server protocol tcp global 172.20.221.81 554 inside 192.168.1.121 554 rule 14 description 554

 nat server protocol tcp global 172.20.221.81 655 inside 192.168.1.121 655 rule 15 description 655

 nat server protocol tcp global 172.20.221.81 6011 6201 inside 192.168.1.121 6011 6201 rule 6 description 6011-6201

 nat server protocol tcp global 172.20.221.81 6304 inside 192.168.1.121 6304 rule 16 description 6304

 nat server protocol tcp global 172.20.221.81 7031 inside 192.168.1.121 7031 rule 18 description 7031

 nat server protocol tcp global 172.20.221.81 7033 inside 192.168.1.121 7033 rule 19 description 7033

 nat server protocol tcp global 172.20.221.81 7280 inside 192.168.1.121 7280 rule 4 description 7280

 nat server protocol tcp global 172.20.221.81 7302 inside 192.168.1.121 7302 rule 13 description 7302

 nat server protocol tcp global 172.20.221.81 7661 inside 192.168.1.121 7661 rule ServerRule_9 description 7661

 nat server protocol tcp global 172.20.221.81 8000 8089 inside 192.168.1.121 8000 8089 rule 11 description 8000-8089

 nat server protocol tcp global 172.20.221.81 8374 8376 inside 192.168.1.121 8374 8376 rule 7 description 8374-8376

 nat server protocol tcp global 172.20.221.81 9308 inside 192.168.1.121 9308 rule 17 description 9308

 nat server protocol tcp global 172.20.221.81 16000 18000 inside 192.168.1.121 16000 18000 rule 9 description 16000-18000

 nat server protocol udp global 172.20.221.81 85 inside 192.168.1.121 80 rule 1 description 85-80

 nat server protocol udp global 172.20.221.81 7332 inside 192.168.1.121 7332 rule 5 description 7332

 nat server protocol udp global 172.20.221.81 7660 inside 192.168.1.121 7660 rule 2 description 7660

 nat server protocol udp global 172.20.221.81 8374 8376 inside 192.168.1.121 8374 8376 rule 8 description 8374-8376

 nat server protocol udp global 172.20.221.81 16000 18000 inside 192.168.1.121 16000 18000 rule 10 description 16000-18000

 manage ping inbound

 manage ping outbound

 manage ssh inbound

 manage ssh outbound

 manage telnet inbound

 manage telnet outbound

 gateway 172.20.221.82

#

interface Tunnel20 mode gre

 ip address 172.38.3.14 255.255.255.252

 source 172.20.221.81

 destination 172.38.3.13

#

security-zone name Local

#

security-zone name Trust

 import interface GigabitEthernet1/0/9

 import interface GigabitEthernet1/0/10

 import interface GigabitEthernet1/0/11

#

security-zone name DMZ

#

security-zone name Untrust

#

security-zone name Management

 import interface GigabitEthernet1/0/0

 import interface GigabitEthernet1/0/2

#

 scheduler logfile size 16

#

line class aux

 user-role network-operator

#

line class console

 authentication-mode scheme

 user-role network-admin

#

line class vty

 user-role network-operator

#

line aux 0

 user-role network-admin

#

line con 0

 user-role network-admin

#

line vty 0 63

 authentication-mode scheme

 user-role network-admin

#

 ip route-static 0.0.0.0 0 GigabitEthernet1/0/11 172.20.221.82

#

 info-center loghost 127.0.0.1 port 3301 format default

 info-center source CFGLOG loghost level informational

#

 snmp-agent

 snmp-agent local-engineid 800063A280A069D9B0697C00000001

 snmp-agent sys-info version v3

 snmp-agent group v3 V3GroupDefault privacy write-view ViewDefault notify-view ViewDefault

#

performance-management

#

 ssh server enable

#

 arp ip-conflict log prompt

#

domain system

#

 domain default enable system

#  

 ipsec logging negotiation enable

#

 ike logging negotiation enable

#

 ip https enable

#

 loadbalance isp file flash:/lbispinfo_v1.5.tp

#

security-policy ip

 rule 0 name T-T

  action pass

  source-zone Trust

  destination-zone Trust

 rule 1 name HT

  action pass

  source-zone Local

  source-zone Trust

  destination-zone Local

  destination-zone Trust

 rule 2 name t-u

  action pass

  source-zone Trust

  source-zone Untrust

  destination-zone Untrust

  destination-zone Trust

#

 cloud-management server domain opstunnel-seccloud.h3c.com

#

return