MSR内网无法上网

＃ interface NULLO # interface GigabitEthernet0/0 port link-mode route combo enable fiber ip address 10.10.20.2 255.255.255.0 nat hairpin enable ip policy-based-route anchises # interface GigabitEthernet0/1 port link-mode route combo enable copper p address 36.112.211.238 255.255.255.252 nat outbound 3000 address-group nat server protocol tp global 36.112.211.238 21 inside 192.168.0.196 21 nat server protocol tp global 36.112.211.238 1194 inside 192.168.0.253 1194 nat server protocol tp global 36.112.211.238 1723 inside 192.168.0.196 1723 nat server protocol tp global 36.112.211.238 2008 inside 192.168.0.240 2008 nat server protocol tp global 36.112.211.238 2009 inside 192.168.0.243 2008 nat server protocol top global 36.112.211.238 9090 inside 172.172.100.29090 nat server protocol tp global 36.112.211.238 20081 inside 192.168.0.243 8080. nat server protocol up global 36.112.211.238 1194 inside 192.168.0.254 1194 # ip route-static 0 -O. • 0 0 36.112.211.237 track 1 p route-static 0 223.72.215.201 track 2 prefere ip route-static 0.0.0.0 0 192.168.10.1 track 2 preferenc ip route-static 10.10.0.0 16 10.10.20.1 p route-static 106.39.20.0 24 192.168.10.1 ip route-static 172.172.10.0 24 10.10.20.1 p route-static 172.172.20.0 24 10.10.20.1 ip route-static 172.172.30.0 24 10.10.20.1 ip route-static 172.172.100.0 24 10.10.20.1 ip route-static 172.172.101.0 24 10.10.20.1 p route-static 172.172.200.0 24 223.72.161.82 ip route-static 192.168.0.0 24 10.10.20.1 ip route-static 192.192.10.0 24 10.10.20.1 ip route-static 192.192.20.0 24 10.10.20.1 ip route-static 223.5.5.5 32 192.168.10.1 目前的配置内网访问外网正常，今天进行网络改造，出口路由器前面加一台三层设备当出口，路由器下沉，更改路由器的出口地址，改为内网地址与新增的三层设备互联，并更改静态路由，配置如下： # 1D Fouterstatis 9-0:09 9 292:268:100-4 trzek a. p route-static 10.10.0.0 16 10.10.20.1 ip route-static 106.39.20.0 24 192.168.10.1 ip route-static 172.172.10.0 24 10.10.20.1 ip route-static 172.172.20.0 24 10.10 20.1 ip route-static 172.172.30.0 24 10.10.20.1 ip route-static 172.172.100.0 24 10.10.20.1 p route-static 172.172.101.0 24 10.10.20.1 ip route-static 172.172.200.0 24 223.72.161.82 ip route-static 192.168.0.0 24 10.10.20.1 ip route-static 192.192.10.0 24 10.10.20.1 ip route-static 192.192.20.0 24 10.10.20.1 p route-static 223.5.5.5 32 192.168.10.1 # 配置后接口的mat没有取消，内网的pc就上不去网，将nat取消，访问外网就正常了，但感觉与may没多大关系呢，nat 配置如下 # acl basic 2000 rule 0 permit source 172.172.0.0 0.0.0.255 # acl advanced 3000 rule 0 deny ip source 192.192.10.0 0.0.0.255 destination 172.172.200.0 0. rule 5 deny ip source 192.192.20.0 0.0.0.255 destination 172.172.200.0 10A0 rule 10 deny ip source 172.172.10.0 0.0.0.255 destination 172.172.200.0 0 rule 15 deny ip source 172:172.30.0 0.0.0.255 destination 172.172.200.0 0. 10 rule 20 deny ip source 172.172.100.0 0.0.0.255 destination 172.172.200.0 0 rule 25 deny ip source 172.172.20.0 0.0.0.255 destination 172.172.200.0 rule 30 deny ip source 192.168.100.0 6.0.01255 destination 172.172-200-0 rule 35 deny ip source 192.168.0.0 0.0.0.255 destination 172.172.200.0 300, 0. O 0 0 rule 40 deny ip source 192.192.10.0 0.0.0.255 destination 192.168.100. rule 0 0 0 45 deny ip source 192.192.20.0 0.0.0.255 destination 192.168.100.0 010 rule 50 deny ip source 172.172.10.0 0.0.0.255 destination 192.168.100.0 0 0 rule 55 deny ip source 172.172.20.0 0.0.0.255 destination 192.168.100. - 0 0 0 rule 60 deny ip source 172.172.30.0 0.0.0.255 destination 192.168.100.0 0 0 rule 65 deny ip source 172.172.100.0 0.0.0.255 destination 192.168.100.0 0 rule 70 deny ip source 192.168.0.0 0.0.0.255 destination 192.168.100.0 0 rule 75 deny ip source 172.172.200.0 0.0.0.255 destination 192.168.100.0 0 rule 80 deny ip source 172.172.101.0 0.0.0.255 rule 100 permit ip # nat address-group 0 address 36.112.211.238 36.112.211.238 #