H3C SecPath M9006 不能登陆Web界面（物理墙）和SSH不能登陆防火墙

dis cu # version 7.1.064, Release 9153P3901 # sysname H3C_M9006 # clock timezone Beijing add 08:00:00 clock protocol ntp context 1 # context Admin id 1 # context context1 id 2 context start location blade-controller-team 1 allocate interface Route-Aggregation1 to Route-Aggregation2 share # context context2 id 3 context start location blade-controller-team 1 allocate interface Route-Aggregation3 to Route-Aggregation4 share # context context3 id 4 context start location blade-controller-team 1 allocate interface Route-Aggregation5 to Route-Aggregation6 share # context context4 id 5 context start location blade-controller-team 1 allocate interface Route-Aggregation7 to Route-Aggregation8 share # context context5 id 6 context start location blade-controller-team 1 allocate interface Route-Aggregation9 to Route-Aggregation10 share # context context6 id 7 context start location blade-controller-team 1 allocate interface Route-Aggregation11 to Route-Aggregation12 share # context context7 id 8 context start location blade-controller-team 1 allocate interface Route-Aggregation13 to Route-Aggregation14 share # context context8 id 9 context start location blade-controller-team 1 allocate interface Route-Aggregation15 to Route-Aggregation16 share # context context9 id 10 context start location blade-controller-team 1 allocate interface Route-Aggregation17 to Route-Aggregation18 share # context context10 id 11 context start location blade-controller-team 1 allocate interface Route-Aggregation19 to Route-Aggregation20 share # ip vpn-instance management route-distinguisher 1000000000:1 vpn-target 1000000000:1 import-extcommunity vpn-target 1000000000:1 export-extcommunity # telnet server acl 2020 # irf mac-address persistent always irf auto-update enable irf auto-merge enable undo irf link-delay irf member 1 priority 1 # ip unreachables enable ip ttl-expires enable # nat static-load-balance enable # password-recovery enable # vlan 1 # irf-port 1/1 port group interface Ten-GigabitEthernet1/4/0/7 mode enhanced port group interface Ten-GigabitEthernet1/4/0/8 mode enhanced # object-group ip address all_http security-zone Untrust 0 network host address 1.2.4.1 # monitor-link group 1 # interface Route-Aggregation1 link-aggregation mode dynamic # interface Route-Aggregation2 link-aggregation mode dynamic # interface Route-Aggregation3 link-aggregation mode dynamic # interface Route-Aggregation4 link-aggregation mode dynamic # interface Route-Aggregation5 link-aggregation mode dynamic # interface Route-Aggregation6 link-aggregation mode dynamic # interface Route-Aggregation7 link-aggregation mode dynamic # interface Route-Aggregation8 link-aggregation mode dynamic # interface Route-Aggregation9 link-aggregation mode dynamic # interface Route-Aggregation10 link-aggregation mode dynamic # interface Route-Aggregation11 link-aggregation mode dynamic # interface Route-Aggregation12 link-aggregation mode dynamic # interface Route-Aggregation13 link-aggregation mode dynamic # interface Route-Aggregation14 link-aggregation mode dynamic # interface Route-Aggregation15 link-aggregation mode dynamic # interface Route-Aggregation16 link-aggregation mode dynamic # interface Route-Aggregation17 link-aggregation mode dynamic # interface Route-Aggregation18 link-aggregation mode dynamic # interface Route-Aggregation19 link-aggregation mode dynamic # interface Route-Aggregation20 link-aggregation mode dynamic # interface Route-Aggregation24 # interface Route-Aggregation1024 description MAD mad bfd enable mad ip address 192.168.2.1 255.255.255.0 member 1 mad ip address 192.168.2.2 255.255.255.0 member 2 # interface NULL0 # interface M-GigabitEthernet1/0/0/0 ip address 1.2.2.6 255.255.255.0 # interface Blade-Aggregation1 link-aggregation blade Blade4fw # interface Blade-Aggregation257 # security-zone name Local # security-zone name Trust import interface Route-Aggregation1024 # security-zone name DMZ # security-zone name Untrust # security-zone name Management import interface M-GigabitEthernet1/0/0/0 # security-zone name test # zone-pair security source Any destination Any packet-filter 3000 # zone-pair security source Local destination Local packet-filter 3000 # zone-pair security source Local destination Trust packet-filter 2000 packet-filter 3000 # zone-pair security source Local destination Untrust packet-filter 3000 # zone-pair security source Trust destination Local packet-filter 2000 packet-filter 3000 # zone-pair security source Trust destination Trust packet-filter 3000 # zone-pair security source Trust destination Untrust packet-filter 3000 # zone-pair security source Untrust destination Local packet-filter 3000 # zone-pair security source Untrust destination Trust packet-filter 3000 # zone-pair security source Untrust destination Untrust packet-filter 3000 # scheduler logfile size 16 # line class console user-role network-admin # line class vty user-role network-operator # line con 1/0 1/1 authentication-mode scheme user-role network-admin # line vty 0 63 authentication-mode scheme user-role network-admin # line vty 64 511 user-role network-operator # ip route-static 0.0.0.0 0 1.2.2.1 # info-center loghost 1.2.2.111 # customlog format nat telecom customlog host 1.2.2.111 export telecom-sessionlog customlog host source M-GigabitEthernet1/0/0/0 customlog timestamp localtime # snmp-agent snmp-agent local-engineid 800063A2800440A9E1066800000001 snmp-agent community read test snmp-agent community write test_wr snmp-agent community cipher $c$3$63SUYxxrU8ChoqApZcGcHm7cDJotjqlVafPac65FPg== user-role level-15 snmp-agent sys-info version all # ssh server enable sftp server enable ssh server acl 2020 # ntp-service source M-GigabitEthernet1/0/0/0 ntp-service unicast-peer 1.2.2.123 ntp-service unicast-server 1.2.2.124 # acl basic 2000 rule 0 permit source 192.168.2.0 0.0.0.255 # acl basic 2020 rule 0 permit source object-group all_http # acl basic name deny_all rule 0 permit source object-group all_http # acl advanced 3000 rule 0 permit ip # password-control length 8 # radius trap-version v1 # domain system # domain default enable system # role name level-0 description Predefined level-0 role # role name level-1 description Predefined level-1 role # role name level-2 description Predefined level-2 role # role name level-3 description Predefined level-3 role # role name level-4 description Predefined level-4 role # role name level-5 description Predefined level-5 role # role name level-6 description Predefined level-6 role # role name level-7 description Predefined level-7 role # role name level-8 description Predefined level-8 role # role name level-9 description Predefined level-9 role # role name level-10 description Predefined level-10 role # role name level-11 description Predefined level-11 role # role name level-12 description Predefined level-12 role # role name level-13 description Predefined level-13 role # role name level-14 description Predefined level-14 role # user-group system # local-user admin class manage password hash $h$6$rKDV3w2ZfQ5wYZUL$l/M+t8rwcNM14r2/3iztdWhOfGL6RtimP9fEn1qKHUZv2ir1Vj5gETa2h5yRZAgEPpRoma3p1AFAIdX0kEGHJg== service-type ftp service-type ssh telnet terminal https authorization-attribute user-role level-3 authorization-attribute user-role level-15 authorization-attribute user-role network-admin authorization-attribute user-role network-operator # local-user adminlrf class manage password hash $h$6$W+gKpQpQpbS9Unxd$a6lrY75LpDa+y4FPf1NK+9goSOiv8nxpAP28242PMxc3lrEJhI25N/sizPXMXWHJR17NDVPLSQ1JKFaIiWKM5w== service-type ssh telnet terminal https authorization-attribute work-directory chassis1#slot0#flash: authorization-attribute user-role context-admin authorization-attribute user-role guest-manager authorization-attribute user-role network-admin authorization-attribute user-role context-operator authorization-attribute user-role network-operator # public-key peer 127.0.0.1 public-key-code begin 30819F300D06092A864886F70D010101050003818D00308189028181009BE9B29CEBFC67BD B881781ED4C1E90867E6E3E5818D2796BF8E96AAD0D4E29CA2478640FE93BF0F619B182809 763579DF67F298AB381ED6E760842F1B77DAFA807F82EB5E161D823C0777C1777E5EEDAE00 6B27E59885099A71C1ACB8735C9FB3BB593F8D096BBD650904BCAA6A597FB233C79BAFE03C 7618AF192A98034BA10203010001 public-key-code end peer-public-key end # ip http enable ip https enable webui log enable # inspect block-source parameter-profile ips_block_default_parameter # inspect block-source parameter-profile url_block_default_parameter # inspect block-source parameter-profile waf_block_default_parameter # inspect capture parameter-profile ips_capture_default_parameter # inspect capture parameter-profile waf_capture_default_parameter # inspect logging parameter-profile av_logging_default_parameter # inspect logging parameter-profile ips_logging_default_parameter # inspect logging parameter-profile url_logging_default_parameter # inspect redirect parameter-profile av_redirect_default_parameter # inspect redirect parameter-profile ips_redirect_default_parameter # inspect redirect parameter-profile url_redirect_default_parameter # inspect redirect parameter-profile waf_redirect_default_parameter # loadbalance isp file flash:/lbispinfo_v1.5.tp # ip-reputation # security-policy ip # ips logging parameter-profile ips_logging_default_parameter # anti-virus logging parameter-profile av_logging_default_parameter # undo hardware audit url enable #