防火墙排除IPSEC兴趣流不做NAT

您好，在acl中设置

然后应用在nat就可以了

各位大佬，我配置改成如下可以吗，本地内网（192.168.20.0）访问对端内网（172.16.12.0）？

防火墙Untrust出口配置如下：

interface GigabitEthernet1/0/7 

 port link-mode route 

 description TO-dianxin 

 ip address 58.35.189.130 255.255.255.248 

 nat outbound 3200

 manage https outbound 

 manage ping inbound 

 manage ping outbound 

 manage ssh outbound

acl策略：

acl advanced 3200

rule 0 deny ip source 192.168.20.0 0.0.1.255 destination 172.16.12.0 0.0.1.255

rule 5 permit ip

策略NAT配置如下：

object-group ip address 公网IP 

 0 network host address 58.35.189.130 

 10 network host address 58.35.189.131

 20 network host address 58.35.189.132

 30 network host address 58.35.189.133

 40 network host address 58.35.189.134

object-group ip address 上网 

 security-zone Trust 

 0 network subnet 192.168.20.0 255.255.255.0 

 10 network subnet 192.168.22.0 255.255.255.0 

 20 network subnet 192.168.24.0 255.255.255.0 

 30 network subnet 192.168.25.0 255.255.255.0 

 40 network subnet 192.168.27.0 255.255.255.0 

nat global-policy rule name GlobalPolicyRule_1 

 source-zone Trust 

 destination-zone Untrust 

 source-ip 上网 

 action snat 

object-group 公网IP 

 counting enable

#

acl advanced name IPsec_GE1/0/2_IPv4_100
rule 1 permit ip source 172.22.0.0 0.0.255.255 destination 10.10.200.0 0.0.0.255

#

acl advanced 3002
rule 9 deny ip source 172.22.0.0 0.0.255.255 destination 10.10.200.0 0.0.0.255
rule 10 permit ip

#

interface GigabitEthernet1/0/2
port link-mode route
ip address X.X.X.X 255.255.255.0
nat outbound 3002 
ipsec apply policy GE1/0/2