问

nat 做好了。突然这几天外网无法连接ERP服务器了

2023-04-19提问

0关注
0收藏，503浏览

网络杂工菜鸟型

网络杂工菜鸟型一段

粉丝：0人关注：1人

问题描述：

#
version 7.1.064, Release 0821P18
#
sysname H3C
#
wlan global-configuration
#
telnet server enable
#
security-zone intra-zone default permit
#
dialer-group 4 rule ip permit
#
ip load-sharing mode per-flow src-ip global
#
dhcp enable
dhcp server always-broadcast
#
dns proxy enable
#
system-working-mode standard
password-recovery enable
#
vlan 1
#
object-group ip address dstgroup20
1004 network subnet 0.0.0.0 0.0.0.0
#
object-group ip address dstgroup21
0 network subnet 0.0.0.0 0.0.0.0
#
object-group ip address dstgroup22
1004 network subnet 0.0.0.0 0.0.0.0
#
object-group ip address srcgroup20
1004 network range 192.168.0.1 192.168.0.254
#
object-group ip address srcgroup21
0 network host address 192.168.1.227
#
object-group ip address srcgroup22
1004 network range 192.168.3.1 192.168.3.254
#
object-group ip address 宿舍网段
0 network range 192.168.3.2 192.168.3.254
#
dhcp server ip-pool ge0
gateway-list 10.10.12.1
network 10.10.12.0 mask 255.255.255.0
address range 10.10.12.100 10.10.12.255
dns-list 10.10.12.1
forbidden-ip-range 10.10.12.1 10.10.12.1
#
dhcp server ip-pool lan1
gateway-list 192.168.0.1
network 192.168.0.0 mask 255.255.254.0
address range 192.168.1.2 192.168.1.254
dns-list 192.168.0.1
#
policy-based-route pbr2 permit node 0
if-match acl name acl20
apply output-interface Dialer3
#
policy-based-route pbr2 permit node 1
if-match acl name acl21
apply next-hop 183.131.202.45
apply output-interface GigabitEthernet0/2
#
policy-based-route pbr2 permit node 2
if-match acl name acl22
apply output-interface GigabitEthernet0/1
#
controller Cellular0/0
#
interface Dialer1
mtu 1492
#
interface Dialer2
mtu 1492
#
interface Dialer3
mtu 1492
ppp chap password cipher $c$3$hGY98VK2gTU3hyGRahCOdJzCkEOojUTQvg==
ppp chap user 057496257980
ppp ipcp dns admit-any
ppp ipcp dns request
ppp pap local-user 057496257980 password cipher $c$3$yI0rDPqIel/XDCrQYaIP8vF08zZqPs2LuQ==
dialer bundle enable
dialer-group 4
dialer timer idle 0
dialer timer autodial 5
ip address ppp-negotiate
tcp mss 1280
ip last-hop hold
nat outbound
#
interface NULL0
#
interface GigabitEthernet0/0
port link-mode route
description LAN-interface
ip address 10.10.12.1 255.255.255.0
tcp mss 1280
nat hairpin enable
ip policy-based-route pbr2
#
interface GigabitEthernet0/1
port link-mode route
description Multiple_Line1
ip address 10.10.10.2 255.255.255.0
dns server 10.10.10.1
tcp mss 1280
ip last-hop hold
packet-filter name WebTelnet3 inbound
nat outbound
#
interface GigabitEthernet0/2
port link-mode route
description Multiple_Line2
combo enable copper
ip address 183.131.202.46 255.255.255.252
dns server 223.5.5.5
tcp mss 1280
ip last-hop hold
packet-filter name WebTelnet4 inbound
nat outbound
nat server protocol tcp global 183.131.202.46 95 inside 192.168.1.227 95
nat server protocol tcp global 183.131.202.46 5366 inside 192.168.1.227 5366
nat server protocol tcp global 183.131.202.46 8191 inside 192.168.1.8 8191 description ERP服务器
nat server protocol udp global 183.131.202.46 95 inside 192.168.1.227 95
nat server protocol udp global 183.131.202.46 5366 inside 192.168.1.227 5366
nat server protocol udp global 183.131.202.46 8191 inside 192.168.1.8 8191 description ERP服务器
#
interface GigabitEthernet0/3
port link-mode route
description Multiple_Line3
combo enable copper
packet-filter name WebTelnet5 inbound
nat static enable
pppoe-client dial-bundle-number 3
#
interface GigabitEthernet0/4
port link-mode route
#
interface GigabitEthernet0/5
port link-mode route
#
security-zone name Local
#
security-zone name Trust
#
security-zone name DMZ
#
security-zone name Untrust
#
security-zone name Management
#
scheduler logfile size 16
#
line class console
user-role network-admin
#
line class tty
user-role network-operator
#
line class usb
user-role network-admin
#
line class vty
user-role network-operator
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-operator
#
ip route-static 0.0.0.0 0 GigabitEthernet0/2 183.131.202.45
ip route-static 0.0.0.0 0 Dialer3
ip route-static 0.0.0.0 0 GigabitEthernet0/1 10.10.10.1 preference 80
ip route-static 172.16.0.0 24 GigabitEthernet0/0 10.10.12.2
ip route-static 192.168.0.0 22 10.10.12.2
#
info-center loghost 127.0.0.1 port 3301
info-center source CFGLOG loghost level informational
#
performance-management
#
time-range tr20 00:00 to 24:00 daily
time-range tr21 00:00 to 24:00 daily
time-range tr22 00:00 to 24:00 daily
#
acl advanced name WebTelnet3
rule 65533 deny tcp destination-port eq telnet
#
acl advanced name WebTelnet4
rule 65533 deny tcp destination-port eq telnet
#
acl advanced name WebTelnet5
rule 65533 deny tcp destination-port eq telnet
#
acl advanced name acl20
rule 1 permit ip source object-group srcgroup20 destination object-group dstgroup20 time-range tr20
rule 1 comment 无线分流
#
acl advanced name acl21
rule 1 permit ip source object-group srcgroup21 destination object-group dstgroup21 time-range tr21
rule 1 comment --
#
acl advanced name acl22
rule 1 permit ip source object-group srcgroup22 destination object-group dstgroup22 time-range tr22
rule 1 comment 宿舍分流
#
password-control enable
undo password-control aging enable
undo password-control history enable
password-control length 6
password-control login-attempt 3 exceed lock-time 10
password-control update-interval 0
password-control login idle-time 0
#
domain system
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
service-type telnet http
authorization-attribute user-role network-admin
#
session statistics enable
#
l2tp enable
#
ip http enable
web new-style
#
url-filter category custom severity 65535
#
wlan ap-group default-group
vlan 1
#
traffic-policy
rule 1 name web_AppTraffRank
application app http
#
dac log-collect service dpi traffic enable
dac traffic-statistic application enable
#
dac storage service dpi traffic limit hold-time 1
dac storage service traffic limit hold-time 1
#
cloud-management server domain oasis.h3c.com
#
return