HEC WA4320-ACN-C FIT已刷FAT 共享上网如何配置？

现有一台HEC WA4320-ACN-C  FIT已刷FAT 现有网络结构为 防火墙>三层交换机（网关在这里）>二层交换机>WA4320。现在想通过WA43200 ，无线连接手机，使手机能够共享上网。我的配置如下，但不知道哪里不对，能PING通三层网关，PING不通DNS，手机无法上网。

<XUPE>dis cur

#

 version 5.20, Release 1509P01

#

 sysname XUPE

#

 clock timezone Beijing add 08:00:00

#

 nat address-group 0 192.168.214.200 192.168.214.200

#

 domain default enable system

#

 telnet server enable

#

 port-security enable

#

 web idle-timeout 100

#

 wlan uplink-interface GigabitEthernet1/0/1

#

 password-recovery enable

#

 undo attack-defense tcp fragment enable

#

acl number 2000

 rule 0 permit source 172.10.10.0 0.0.0.255

#               

vlan 1          

#               

vlan 2          

#               

domain system   

 access-limit disable

 state active   

 idle-cut disable

 self-service-url disable

#               

dhcp server ip-pool vlan2

 network 172.10.10.0 mask 255.255.255.0

 gateway-list 172.10.10.1

 dns-list 202.99.160.68 192.168.214.200

 expired day 0 hour 8

#               

user-group system

 group-attribute allow-guest

#               

local-user admin

 password cipher $c$3$KZv4wKNlbxGn5+vnzkjKB2I/5RCA381h/3pLEW0=

 authorization-attribute level 3

 service-type telnet

 service-type web

local-user xupe

 password cipher $c$3$ReS82LEGuiJ9mgVtL5+38wdRWCeusaWaMFBch0iYvn7b

 authorization-attribute level 3

 service-type ssh telnet terminal

 service-type web

#               

wlan rrm        

 dot11a mandatory-rate 6 12 24

 dot11a supported-rate 9 18 36 48 54

 dot11b mandatory-rate 1 2

 dot11b supported-rate 5.5 11

 dot11g mandatory-rate 1 2 5.5 11

 dot11g supported-rate 6 9 12 18 24 36 48 54

#               

wlan service-template 1 clear

 ssid H3C       

#               

wlan service-template 2 crypto

 ssid XUPE      

 cipher-suite ccmp

 security-ie rsn

 service-template enable

#               

cwmp            

 undo cwmp enable

#               

interface NULL0

#               

interface Vlan-interface1

 ip address 192.168.214.200 255.255.255.0

 undo dhcp select server global-pool

 nat outbound 2000 address-group 0

#               

interface Vlan-interface2

 ip address 172.10.10.1 255.255.255.0

#               

interface GigabitEthernet1/0/1

#               

interface WLAN-BSS2

 port access vlan 2

 port-security port-mode psk

 port-security tx-key-type 11key

 port-security preshared-key pass-phrase cipher $c$3$Q2A0euu+PrJBhiqIaAbsx8p1QLAZCtZ4Agb2M2k=

#               

interface WLAN-BSS3

 port access vlan 2

 port-security port-mode psk

 port-security tx-key-type 11key

 port-security preshared-key pass-phrase cipher $c$3$Ew60Z/hAuDdmUPUo5hQsdH5fpNyO5EgZcDKkRxw=

#               

interface WLAN-BSS32

#               

interface WLAN-BSS33

#               

interface WLAN-BSS34

 port access vlan 2

 port-security port-mode psk

 port-security tx-key-type 11key

 port-security preshared-key pass-phrase cipher $c$3$wWnMN+d+UUbPVbec0z6Fw9of8pwR4/9zNdSA

#               

interface WLAN-BSS35

 port link-type hybrid

 port hybrid vlan 1 untagged

 port-security port-mode psk

 port-security tx-key-type 11key

 port-security preshared-key pass-phrase cipher $c$3$wWnMN+d+UUbPVbec0z6Fw9of8pwR4/9zNdSA

#               

interface WLAN-Radio1/0/1

 service-template 2 interface wlan-bss 34

#               

interface WLAN-Radio1/0/2

 service-template 2 interface wlan-bss 35

#               

 undo info-center enable

#               

 dhcp enable    

#               

 arp-snooping enable

#               

 load xml-configuration

#               

 load tr069-configuration

#               

user-interface con 0

user-interface vty 0 4

 authentication-mode scheme

#               

return