H3C_SecPath_F1070防火墙NAPT问题

  防火墙和路由器(模仿BARS)都用旁挂的方式。

路由器主要配置如图

交换机主要配置如图

防火墙具体配置如下：

[H3C]dis cur

#

 version 7.1.064, Alpha 7164

#

 sysname H3C

nat address-group 1

 address 10.240.64.1 10.240.64.254

object-group ip address 1

 0 network subnet 10.240.64.0 255.255.255.0

#                         

interface GigabitEthernet1/0/1

 port link-mode route

 combo enable copper

 ip address 192.168.0.1 255.255.255.0

#              

interface GigabitEthernet1/0/2

 port link-mode route

 combo enable copper

#              

interface GigabitEthernet1/0/2.2

 ip address 172.16.16.31 255.255.255.0

 vlan-type dot1q vid 2

#

interface GigabitEthernet1/0/2.11

 ip address 10.200.0.22 255.255.255.252

 nat outbound 2000 address-group 1

 vlan-type dot1q vid 11

#

interface GigabitEthernet1/0/2.605

 ip address 172.20.0.1 255.255.255.0

 vlan-type dot1q vid 605

#

security-zone name Local

#

security-zone name Trust

 import interface GigabitEthernet1/0/2.605

#

security-zone name DMZ

#

security-zone name Untrust

 import interface GigabitEthernet1/0/2.2

 import interface GigabitEthernet1/0/2.11

#

security-zone name Management

 import interface GigabitEthernet1/0/1

#

 ip route-static 0.0.0.0 0 10.200.0.21

#

 undo info-center enable

#

acl basic 2000

 rule 0 permit source 172.20.0.0 0.0.0.255

#

security-policy ip

 rule 5 name localtountrust

  action pass

  source-zone local

  source-zone untrust

  source-zone trust

  destination-zone local

  destination-zone untrust

  destination-zone trust

现在的情况是各个接口之间可以ping通，172.20.0.0之间可以ping通，但NAT不成功，无法ping 通119.36.136.254，请大神帮忙看看是什么原因造成的？