H3C F100-C-G5二层透传后导致VPN业务不正常

此配置为我的防火墙配置：

[F100-C-G5]display current-configuration
#
version 7.1.064, Release 9560P33
#
sysname F100-C-G5
#
clock protocol none
#
context Admin id 1
#
ip vpn-instance MGT
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
dns server 8.8.8.8
dns server 114.114.114.114
#
lldp global enable
#
password-recovery enable
#
vlan 1
#
vlan 2 to 3
#
#
controller Cellular1/0/0
#
controller Cellular1/0/1
#
interface NULL0
#
interface Vlan-interface1
#
interface GigabitEthernet1/0/0
port link-mode route
combo enable fiber
#
interface GigabitEthernet1/0/1
port link-mode route
combo enable fiber
#
interface GigabitEthernet1/0/8
port link-mode route
#
interface GigabitEthernet1/0/11
port link-mode route
description for MGT
ip binding vpn-instance MGT
ip address 192.0.0.250 255.255.255.0
#
interface GigabitEthernet1/0/2
port link-mode bridge
port link-type trunk
port trunk permit vlan all
#
interface GigabitEthernet1/0/3
port link-mode bridge
port link-type trunk
port trunk permit vlan all
#
interface GigabitEthernet1/0/4
port link-mode bridge
description to sanfor
port link-type trunk
port trunk permit vlan all
#
interface GigabitEthernet1/0/5
port link-mode bridge
description to ER
port link-type trunk
port trunk permit vlan all
#
interface GigabitEthernet1/0/6
port link-mode bridge
description to sanfor
#
interface GigabitEthernet1/0/7
port link-mode bridge
description to ER
#
interface GigabitEthernet1/0/9
port link-mode bridge
#
interface GigabitEthernet1/0/10
port link-mode bridge
#
security-zone name Local
#
security-zone name Trust
import interface GigabitEthernet1/0/4 vlan 1 to 4094
import interface GigabitEthernet1/0/6 vlan 1 to 4094
import interface GigabitEthernet1/0/10 vlan 1 to 4094
import vlan 1 to 3
#
security-zone name DMZ
#
security-zone name Untrust
import interface GigabitEthernet1/0/5 vlan 1 to 4094
import interface GigabitEthernet1/0/7 vlan 1 to 4094
#
security-zone name Management
import interface GigabitEthernet1/0/11
#
zone-pair security source Any destination Any
packet-filter 3200
#
scheduler logfile size 16
#
line class aux
user-role network-operator
#
line class console
authentication-mode scheme
user-role network-admin
#
line class vty
user-role network-operator
#
line aux 0
user-role network-admin
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-admin
#
ip route-static vpn-instance MGT 0.0.0.0 0 192.0.0.1
#
undo info-center enable
#
performance-management
#
ssh server enable
#
arp static 192.0.0.3 0011-327b-b4c4
arp static 192.0.0.50 1418-7758-a694
arp static 192.0.0.51 c85b-7692-d741
arp static 192.0.0.52 eca8-6b82-0c1f
arp static 192.0.0.53 309c-232e-f4f9
arp static 192.0.0.54 4437-e64a-3629
arp static 192.0.0.55 d8cb-8abd-1175
arp static 192.0.0.57 d8cb-8abd-1fd4
arp static 192.0.0.58 90fb-a67b-1801
arp static 192.0.0.59 1cc1-de56-9405
arp static 192.0.0.60 14da-e9ca-4ef0
arp static 192.0.0.61 28d2-4433-19d1
arp static 192.0.0.86 7844-fde1-0100
arp static 192.0.0.93 b870-f42a-676a
arp static 192.0.0.94 507b-9d3d-6b31
arp static 192.0.0.95 6c4b-9028-0c4d
arp static 192.0.0.97 309c-232f-ac6a
arp static 192.0.0.98 4ccc-6a1c-ba6c
arp static 192.0.0.99 00e0-4c36-05e2
arp static 192.0.0.113 0017-c890-8a6b
arp static 192.0.0.115 0017-c890-8a5e
arp static 192.0.0.116 0047-5029-b11a
arp static 192.0.0.118 0007-4d9f-5b06
arp static 192.0.0.167 0007-4d92-c8b9
arp static 192.0.0.175 c025-a57f-aa08
arp static 192.0.0.245 8cec-4ba7-07c1
arp static 192.168.0.2 b82a-72dc-02ef
arp static 192.168.0.3 0011-327b-b4c4
arp static 192.168.0.48 1418-7758-a693
arp static 192.168.21.26 0007-4d9f-5b06
arp static 192.168.21.27 0017-c890-8a6b
arp static 192.168.21.28 489e-bdef-45bf
#
acl advanced 3200
rule 100 permit ip
#
undo password-control blacklist all-line
#
domain system
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password hash $h$6$c4P9kF64FqeScnym$usL23+3rOd7w67vXH8VBhTfrv+KgmSSLecix3/zBarCvB3YZxr82yPqoATrdV2kIuubhokKhVNpIgBZKjusPnQ==
service-type ssh telnet terminal http https
authorization-attribute user-role level-15
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
ssl renegotiation disable
ssl version ssl3.0 disable
ssl version tls1.0 disable
#
ipsec logging negotiation enable
#
ike identity fqdn test
ike logging negotiation enable
#
ip http enable
ip https enable
#
loadbalance isp file flash:/lbispinfo_v1.5.tp
#
security-policy ip
rule 0 name any
action pass
rule 10 name pass
action pass
source-zone Trust
source-zone Local
source-zone Untrust
source-zone Management
destination-zone Local
destination-zone Trust
destination-zone Untrust
rule 20 name 30
action pass
#
cloud-management server domain opstunnel-seccloud.h3c.com
#
return
[F100-C-G5]

没有大的问题，再看看路由器和交换机配置呢