H3C SecPath F1000-AK135+出口NAT地址转换

需求：内网通过运营商给的公网IP进行地址转换访问外网

问题：地址转换不成功，防火墙上能够ping通运营商网关，内网无法ping通，防火墙上没有NAT转换的session表项

配置：域间策略策略全部放开仍不生效

nat address-group 7

 address 运营商提供的公网IP

object-group ip address YD

 description 

 security-zone Trust

 0 network host address 192.168.x.x----------(内网地址)

interface GigabitEthernet1/0/1

 port link-mode route

 ip address 117.*.*.137 255.255.255.0   -------运营商提供公网地址

 nat outbound 3000 counting

 nat hairpin enable

 gateway 117.*.*.129--------------运营商网关地址

policy-based-route 1 permit node 3003

 if-match acl 3003

 apply next-hop 117.*.*.129 direct track  4 ----------运营商网关地址

ip route-static 0.0.0.0 0 117.*.*.129 preference 80 description------回程路由也配置了

acl advanced 3003

 description 

 rule 0 permit ip source object-group YD

----------------------------------------------------------------------

<fw01>dis nat session destination-ip 117.*.*.137

Slot 1:

Total sessions found: 0

Slot 2:

Total sessions found: 0

出口防火墙连接运营商ONU，已有的运营商线路能够nat转换，