SecPath F1000-AK135 vpn 单通

总公司使用SecPath F1000-AK135防火墙，分公司使用tp_link路由器，现在是分公司能ping通总公司，总公司ping不通分公司，请各位大佬指点

object-group ip address 192.168.1.0

security-zone Trust

0 network subnet 192.168.1.0 255.255.255.0

#

object-group ip address 192.168.3.0

security-zone Untrust

0 network subnet 192.168.3.0 255.255.255.0

#

object-group ip address ipsec-local

security-zone Local

0 network host address 公网ip

#

object-group ip address ipsec-remote

security-zone Untrust

0 network host address 对端公网ip

#

object-group ip address thg

0 network host address 192.168.1.149

#

dhcp server ip-pool 10

gateway-list 172.16.0.254

network 172.16.0.0 mask 255.255.0.0

dns-list 202.102.224.68 202.102.227.68

#

interface GigabitEthernet1/0/0

port link-mode route

ip address 192.168.0.1 255.255.255.0

#

interface GigabitEthernet1/0/1

port link-mode route

ip address 公网ip 255.255.255.240

tcp mss 1300

nat outbound disable

nat outbound 3999

gateway 61.54.4.30

#

interface GigabitEthernet1/0/2

port link-mode route

ip address 192.168.1.1 255.255.255.0

nat hairpin enable

#

security-zone name Local

#

security-zone name Trust

import interface GigabitEthernet1/0/2

#

security-zone name DMZ

#

security-zone name Untrust

import interface GigabitEthernet1/0/1

#

security-zone name Management

import interface GigabitEthernet1/0/0

#

security-zone name un

#

zone-pair security source Any destination Any

#

zone-pair security source Local destination Trust

object-policy apply ip Local-Trust

packet-filter 3000

#

zone-pair security source Local destination Untrust

object-policy apply ip Local-Untrust

packet-filter 3000

#

zone-pair security source Trust destination Local

object-policy apply ip Trust-Local

packet-filter 3000

#

zone-pair security source Trust destination Trust

object-policy apply ip Trust-Trust

packet-filter 3000

#

zone-pair security source Trust destination Untrust

object-policy apply ip Trust-Untrust

packet-filter 3000

#

zone-pair security source Untrust destination Local

object-policy apply ip Untrust-Local

packet-filter 3000

#

zone-pair security source Untrust destination Trust

object-policy apply ip Untrust-Trust

packet-filter 3000

#

ip route-static 0.0.0.0 0 61.54.4.30

#

info-center source FILTER logfile deny

#

ssh server enable

ssh server acl 2100

#

acl basic 2100

description 设备访问限制

rule 0 permit source 192.168.1.0 0.0.0.255

#

acl advanced 3000

rule 0 permit ip

#

acl advanced 3999

rule 0 deny ip source 192.168.1.0 0.0.0.255 destination 192.168.3.0 0.0.0.255

rule 5 permit ip

#

acl advanced name IPsec_piaoliu_IPv4_1

rule 1 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.3.0 0.0.0.255

#

domain system

#

domain default enable system

#

role name level-0

description Predefined level-0 role

#

user-group system

#

local-user admin class manage

password hash 8767g==

service-type ssh telnet terminal https

authorization-attribute user-role level-3

authorization-attribute user-role network-admin

authorization-attribute user-role network-operator

#

local-user thdxg class manage

service-type telnet

authorization-attribute user-role network-operator

#

session statistics enable

session synchronization enable

session synchronization http

#

ipsec logging negotiation enable

#

ipsec transform-set piaoliu_IPv4_1

esp encryption-algorithm aes-cbc-128

esp authentication-algorithm sha1

#

ipsec smart-link policy piaoliu_1

smart-link enable

link 1 interface GigabitEthernet1/0/1 local 公网ip nexthop 61.54.4.30 remote 对端公网ip

#

ipsec policy piaoliu 1 isakmp

transform-set piaoliu_IPv4_1

security acl name IPsec_piaoliu_IPv4_1

ike-profile piaoliu_IPv4_1

smart-link policy piaoliu_1

#

ike logging negotiation enable

#

ike profile piaoliu_IPv4_1

keychain piaoliu_IPv4_1

local-identity address 公网ip

match remote identity address 对端公网ip 255.255.255.255

proposal 1

#

ike proposal 1

encryption-algorithm aes-cbc-128

#

ike keychain piaoliu_IPv4_1

pre-shared-key address 对端公网ip 255.255.255.255 key cipher $c$3$KO7q3vXyJcYbdGQ6NOuZsNH2DSHuNtq

#

ip http acl 2100

ip https acl 2100

ip http enable

ip https enable

#

inspect logging parameter-profile av_logging_default_parameter

#

inspect logging parameter-profile ips_logging_default_parameter

#

inspect logging parameter-profile url_logging_default_parameter

#

loadbalance isp file flash:/lbispinfo_v1.5.tp

#

security-policy ip

rule 0 name vpn-local-remote

action pass

counting enable

source-zone Local

destination-zone Untrust

source-ip ipsec-local

destination-ip ipsec-remote

rule 1 name vpn-remote-local

action pass

counting enable

source-zone Untrust

destination-zone Local

source-ip ipsec-remote

destination-ip ipsec-local

rule 2 name vpn-1-3

action pass

counting enable

source-zone Trust

destination-zone Untrust

source-ip 192.168.1.0

destination-ip 192.168.3.0

rule 3 name vpn-3-1

action pass

counting enable

source-zone Untrust

destination-zone Trust

source-ip 192.168.3.0

destination-ip 192.168.1.0

#

ips logging parameter-profile ips_logging_default_parameter

#

anti-virus logging parameter-profile av_logging_default_parameter

#

return