防火墙上做完NQA和策略路由的联动之后，怎么有一条没生效？

ACL3000匹配的10段的地址，3100匹配的20段和30段的地址

配置发上来看下吧

version 7.1.064, Release 9560P40 # sysname FW # clock protocol none # context Admin id 1 # irf mac-address persistent timer irf auto-update enable undo irf link-delay irf member 1 priority 1 # track 1 nqa entry track1 node1 reaction 1 # track 2 nqa entry track2 node2 reaction 2 # ip unreachables enable ip ttl-expires enable # dns proxy enable dns server 8.8.8.8 dns server 114.114.114.114 dns server 202.99.160.68 dns server 202.99.166.4 dns server 223.5.5.5 # lldp global enable # password-recovery enable # vlan 1 # object-group ip address 10 security-zone Trust 0 network subnet 192.168.10.0 255.255.254.0 # object-group ip address 20 security-zone Trust 0 network subnet 192.168.20.0 255.255.254.0 # policy-based-route waiwang permit node 10 if-match acl 3001 apply next-hop 27.128.180.49 track 1 # policy-based-route waiwang permit node 20 if-match acl 3002 apply next-hop 121.28.214.9 track 2 # policy-based-route waiwang permit node 30 # nqa entry track1 node1 type icmp-echo destination ip 223.5.5.5 frequency 3000 next-hop ip 27.128.180.49 reaction 1 checked-element probe-fail threshold-type consecutive 3 action-type trigger-only # nqa entry track2 node2 type icmp-echo destination ip 223.5.5.5 frequency 3000 next-hop ip 121.28.214.9 reaction 1 checked-element probe-fail threshold-type consecutive 3 action-type trigger-only # nqa schedule track1 node1 start-time now lifetime forever nqa schedule track2 node2 start-time now lifetime forever # controller Cellular1/0/0 # controller Cellular1/0/1 # interface NULL0 # interface Vlan-interface1 # interface GigabitEthernet1/0/0 port link-mode route combo enable copper ip address 192.168.0.1 255.255.255.0 # interface GigabitEthernet1/0/1 port link-mode route combo enable copper ip address 27.128.180.61 255.255.255.240 nat outbound ip policy-based-route waiwang # interface GigabitEthernet1/0/2 port link-mode route # interface GigabitEthernet1/0/4 port link-mode route ip address 121.28.214.10 255.255.255.252 nat outbound ip policy-based-route waiwang # interface GigabitEthernet1/0/5 port link-mode route ip address 192.168.1.2 255.255.255.0 # interface GigabitEthernet1/0/6 port link-mode route # interface GigabitEthernet1/0/7 port link-mode route # interface GigabitEthernet1/0/8 port link-mode route # interface GigabitEthernet1/0/9 port link-mode route # interface GigabitEthernet1/0/10 port link-mode route # interface GigabitEthernet1/0/11 port link-mode route # interface GigabitEthernet1/0/3 port link-mode bridge # security-zone name Local # security-zone name Trust import interface GigabitEthernet1/0/5 import interface GigabitEthernet1/0/7 import interface Vlan-interface1 # security-zone name DMZ # security-zone name Untrust # security-zone name Management import interface GigabitEthernet1/0/0 # security-zone name untrust1 import interface GigabitEthernet1/0/1 # security-zone name untrust2 import interface GigabitEthernet1/0/4 # scheduler logfile size 16 # line class aux user-role network-operator # line class console authentication-mode scheme user-role network-admin # line class vty user-role network-operator # line aux 0 user-role network-admin # line con 0 user-role network-admin # line vty 0 63 authentication-mode scheme user-role network-admin # ip route-static 0.0.0.0 0 27.128.180.49 ip route-static 0.0.0.0 0 121.28.214.9 ip route-static 192.168.10.0 24 192.168.1.254 ip route-static 192.168.20.0 24 192.168.1.254 ip route-static 192.168.30.0 24 192.168.1.254 # performance-management # ssh server enable ssh server acl 3000 # arp ip-conflict log prompt # acl advanced 3000 rule 0 permit ip source 192.168.20.0 0.0.0.255 rule 5 deny ip # acl advanced 3001 rule 0 permit ip source 192.168.20.0 0.0.0.255 rule 5 permit ip source 192.168.30.0 0.0.0.255 # acl advanced 3002 rule 0 permit ip source 192.168.10.0 0.0.0.255 # undo password-control blacklist all-line # domain system # domain default enable system # role name level-0 description Predefined level-0 role # role name level-1 description Predefined level-1 role # role name level-2 description Predefined level-2 role # role name level-3 description Predefined level-3 role # role name level-4 description Predefined level-4 role # role name level-5 description Predefined level-5 role # role name level-6 description Predefined level-6 role # role name level-7 description Predefined level-7 role # role name level-8 description Predefined level-8 role # role name level-9 description Predefined level-9 role # role name level-10 description Predefined level-10 role # role name level-11 description Predefined level-11 role # role name level-12 description Predefined level-12 role # role name level-13 description Predefined level-13 role # role name level-14 description Predefined level-14 role # user-group system # local-user admin class manage password hash $h$6$y1Z6s7JQZ78VpjW+$adOvbv6Hk9Q5bysbs6xSCWmmyqh/160tVTXVpMqRVLtrn2ycpSxf4dpvnCw55vnTUly1P/9wFP9Ic3PeuW/uow== service-type ssh terminal https authorization-attribute user-role level-3 authorization-attribute user-role network-admin authorization-attribute user-role network-operator # session top-statistics enable # ipsec logging negotiation enable # ike logging negotiation enable # ip https enable # blacklist global enable # url-filter signature auto-update update schedule daily start-time 02:00:00 tingle 120 # ips signature auto-update update schedule daily start-time 02:00:00 tingle 120 # app-profile 1_IPv4 ips apply policy default mode protect url-filter apply policy default anti-virus apply policy default mode protect # loadbalance isp file flash:/lbispinfo_v1.5.tp # traffic-policy rule 1 name 限速10 action qos profile 限速10 source-address address-set 10 source-zone Trust destination-zone Untrust rule 2 name 限速20 action qos profile 限速20 source-address address-set 20 source-zone Trust destination-zone Untrust profile name 限速10 bandwidth total guaranteed 300000 bandwidth total maximum 350000 bandwidth total guaranteed per-ip 10000 profile name 限速20 bandwidth total guaranteed 100000 bandwidth total maximum 150000 bandwidth total guaranteed per-ip 10000 # security-policy ip rule 0 name test action pass source-zone local source-zone trust destination-zone local destination-zone trust rule 1 name shouquan action pass profile 1_IPv4 source-zone Untrust destination-zone Trust rule 2 name trust-untrust action pass source-zone trust destination-zone untrust1 destination-zone untrust2 rule 3 name per-nqa action pass source-zone trust destination-zone untrust1 destination-zone untrust2 destination-ip-host 223.5.5.5 rule 4 name local-untrust action pass source-zone local destination-zone untrust1 destination-zone untrust2 # security-policy ipv6 # anti-virus signature auto-update update schedule daily start-time 02:00:00 tingle 120 # cloud-management server domain opstunnel-seccloud.h3c.com # return