H3C SecPath F1000-AI-35 双WAN出口，内网设备无法访问对外映射的应用服务

客户出口一条专线、一条宽带。内网划分为vlan 100有线、G0/0/15端口无线、vlan 200服务器3个区域，服务器区域通过专线策略路由上网，并有部分服务对外映射。有线通过宽带策略路由走宽带上网。无线接在G0/0/15端口下，做私有网段，通过源NAT到地址10.0.0.1，使用宽带策略路由上网。目前的问题是无线区域的内网终端，可以ping通专线地址，无法访问在专线地址上做目的映射的端口服务。在专线地址服务的内网SVI端口 vlan 200上做nat hairpin也没什么用。安全策略也配置了any to any。

interface Vlan-interface100

 ip address 172.16.10.254 255.255.255.0

 dhcp server apply ip-pool pool-work

 ip policy-based-route to-kuandai

#

interface Vlan-interface200

 ip address 172.16.20.254 255.255.255.0

 nat hairpin enable

 manage ping inbound

 manage ping outbound

 dhcp server apply ip-pool pool-work-2

 ip policy-based-route to-zhuanxian

interface GigabitEthernet1/0/15

 port link-mode route

 description GuideLan Interface

 ip address 10.0.0.1 255.255.255.252

 undo dhcp select server

 ip policy-based-route to-kuandai

nat global-policy

 rule name GlobalPolicyRule_8

  service 8090

  source-zone zhuanxian

  destination-ip host 58.214.22.202

  action dnat ip-address 172.16.20.6 local-port 8090

  counting enable

 rule name GlobalPolicyRule_11

  source-zone zhuanxian

  destination-ip host 58.214.22.202

  action dnat ip-address 172.16.20.2 local-port 4433

  counting enable

 rule name GlobalPolicyRule_1

  description GuideNat

  source-zone wireless

  destination-zone kuandai

  action snat easy-ip

 rule name GlobalPolicyRule_5

  description GuideNat

  source-zone Trust

  destination-zone kuandai

  action snat easy-ip

 rule name GlobalPolicyRule_6

  source-zone video

  destination-zone zhuanxian

  action snat easy-ip

 rule name 1

  source-zone Trust

  source-zone video

  source-zone wireless

  destination-zone DMZ

  destination-zone kuandai

  destination-zone zhuanxian

  action snat easy-ip