F100防火墙配置好后无法上网

配置好后无法上外网，可以ping通网关，及wan口ip

# version 7.1.064, Release 9590P18 # sysname H3C # clock timezone Bangkok add 07:00:00 clock protocol none # wlan global-configuration # irf mac-address persistent timer irf auto-update enable undo irf link-delay irf member 1 priority 1 # dhcp server always-broadcast # dns proxy enable dns server 8.8.8.8 dns server 114.114.114.114 ip host quicknet.h3c.com 10.27.254.254 dns fast-reply enable # lldp global enable # password-recovery enable # vlan 1 # dhcp server ip-pool lan1 gateway-list 192.168.0.1 network 192.168.0.0 mask 255.255.255.0 address range 192.168.0.2 192.168.0.254 dns-list 192.168.0.1 # dhcp server ip-pool lan2 gateway-list 10.27.254.254 network 10.27.254.0 mask 255.255.255.0 dns-list 61.19.245.245 202.129.27.135 forbidden-ip-range 10.27.254.1 10.27.254.100 # interface NULL0 # interface Vlan-interface1 description LAN-interface ip address 10.27.254.254 255.255.255.0 tcp mss 1280 undo dhcp select server # interface GigabitEthernet1/0/1 port link-mode route description GuideWan Interface ip address 122.155.78.162 255.255.255.252 dns server 61.19.245.245 dns server 202.129.27.135 ipsec apply policy tozb gateway 122.155.78.161 # interface GigabitEthernet1/0/0 port link-mode bridge # interface GigabitEthernet1/0/2 port link-mode bridge # interface GigabitEthernet1/0/3 port link-mode bridge # interface GigabitEthernet1/0/4 port link-mode bridge # interface GigabitEthernet1/0/5 port link-mode bridge # interface GigabitEthernet1/0/6 port link-mode bridge port link-type trunk port trunk permit vlan all # security-zone name Local # security-zone name Trust import interface GigabitEthernet1/0/2 vlan 1 import interface GigabitEthernet1/0/6 vlan 1 # security-zone name DMZ # security-zone name Untrust import interface GigabitEthernet1/0/1 # security-zone name Management # security-zone name LAN import interface Vlan-interface1 import interface GigabitEthernet1/0/0 vlan 1 import interface GigabitEthernet1/0/3 vlan 1 import interface GigabitEthernet1/0/4 vlan 1 import interface GigabitEthernet1/0/5 vlan 1 # scheduler logfile size 16 # line class aux user-role network-operator # line class console authentication-mode scheme user-role network-admin # line class vty user-role network-operator # line aux 0 authentication-mode none user-role network-admin # line con 0 user-role network-admin # line vty 0 63 authentication-mode scheme user-role network-admin # ip route-static 0.0.0.0 0 10.27.254.1 # undo info-center logfile enable # ssh server enable # acl advanced name IPsec_tozb_IPv4_1 rule 0 permit ip source 10.27.0.0 0.0.0.255 destination 172.0.3.0 0.0.0.255 rule 1 permit ip source 10.27.0.0 0.0.0.255 destination 10.0.0.0 0.0.0.255 # domain system # domain default enable system # role name level-0 description Predefined level-0 role # role name level-1 description Predefined level-1 role # role name level-2 description Predefined level-2 role # role name level-3 description Predefined level-3 role # role name level-4 description Predefined level-4 role # role name level-5 description Predefined level-5 role # role name level-6 description Predefined level-6 role # role name level-7 description Predefined level-7 role # role name level-8 description Predefined level-8 role # role name level-9 description Predefined level-9 role # role name level-10 description Predefined level-10 role # role name level-11 description Predefined level-11 role # role name level-12 description Predefined level-12 role # role name level-13 description Predefined level-13 role # role name level-14 description Predefined level-14 role # user-group system # local-user admin class manage password hash $h$6$+wLHP+aeP/vvLaj2$KRlI49Y8l7iiDLfX//cYbdm3/bYacWX/+WxrgCEue7mD/BG6nbsod3lXq/ExCtBDmucekpNMTnwguvadjZbxhQ== service-type ssh telnet terminal http https authorization-attribute user-role level-3 authorization-attribute user-role network-admin authorization-attribute user-role network-operator password-control length 4 password-control composition type-number 1 type-length 1 undo password-control complexity user-name check # ssl renegotiation disable ssl version ssl3.0 disable ssl version tls1.0 disable undo ssl version tls1.1 disable # ipsec transform-set tozb_IPv4_1 esp encryption-algorithm aes-cbc-128 esp authentication-algorithm sha256 # ipsec policy tozb 1 isakmp transform-set tozb_IPv4_1 security acl name IPsec_tozb_IPv4_1 local-address 122.155.78.162 remote-address 119.145.41.172 ike-profile tozb_IPv4_1 # nat global-policy rule name PolicyRule_1 description GuideNat source-zone Trust destination-zone Untrust action snat easy-ip # ike profile tozb_IPv4_1 keychain tozb_IPv4_1 exchange-mode aggressive local-identity address 122.155.78.162 match remote identity address 119.145.41.172 255.255.255.0 match local address GigabitEthernet1/0/1 proposal 1 # ike proposal 1 encryption-algorithm 3des-cbc authentication-algorithm md5 # ike keychain tozb_IPv4_1 match local address GigabitEthernet1/0/1 pre-shared-key address 119.145.41.172 255.255.255.0 key cipher $c$3$x/RqlIhxPsG+oA1ThJEmgcj8u+9o7ZCDU3N6 # netconf soap http enable # ip http enable ip https enable # loadbalance isp file flash:/lbispinfo_v1.5.tp # smartmc tc enable # wlan ap-group default-group vlan 1 # security-policy ip rule 4 name GuideSecPolicy action pass source-zone Trust source-zone Local destination-zone Untrust destination-zone DMZ destination-zone Trust destination-zone Local rule 0 name AUTONET_LOCAL2ANY_DONTMODIFY action pass source-zone local rule 1 name AUTONET_LAN2LOCAL_DONTMODIFY action pass source-zone LAN destination-zone local rule 2 name AUTONET_LAN2LAN_DONTMODIFY action pass source-zone LAN destination-zone LAN # cloud-management server domain cloudnet.h3c.com # return