msr3660不加acl，nat映射不通

1. #
2. version 7.1.064, Release 0615P10
3. #
4. sysname H3C
5. #
6. telnet server enable
7. #
8. ip pool l2tp1 10.0.0.2 10.0.0.10 
9. #
10. dhcp enable
11. dhcp server always-broadcast
12. #
13. dns proxy enable
14. #
15. password-recovery enable
16. #
17. vlan 1
18. #
19. dhcp server ip-pool lan1
20. gateway-list 192.168.0.1
21. network 192.168.0.0 mask 255.255.254.0
22. address range 192.168.1.2 192.168.1.254
23. dns-list 192.168.0.1
24. #
25. controller Cellular0/0
26. #
27. controller Cellular0/1
28. #
29. interface Aux0
30. #
31. interface Ethernet2/1
32. port link-mode route
33. ip address 192.9.177.2 255.255.255.0
34. nat outbound 2001
35. #
36. interface Virtual-Template1
37. ppp authentication-mode chap 
38. remote address pool l2tp1 
39. ip address 10.0.0.1 255.255.255.0
40. #
41. interface NULL0
42. #
43. interface Ethernet2/0
44. port link-mode bridge
45. #
46. interface Ethernet2/2
47. port link-mode bridge
48. #
49. interface Ethernet2/3
50. port link-mode bridge
51. #
52. interface GigabitEthernet0/0
53. port link-mode route
54. description Multiple_Line
55. bandwidth 100000
56. combo enable copper
57. ip address 123.133.79.53 255.255.255.248
58. ip address 123.133.79.52 255.255.255.248 sub
59. dns server 114.114.114.114
60. tcp mss 1280
61. nat outbound
62. nat server protocol tcp global 123.133.79.52 20 inside 180.180.1.42 20
63. nat server protocol tcp global 123.133.79.52 21 inside 180.180.1.42 21
64. nat server protocol tcp global 123.133.79.52 80 inside 180.180.1.19 80
65. nat server protocol tcp global 123.133.79.53 80 inside 180.180.1.8 80
66. nat server protocol tcp global 123.133.79.53 82 inside 180.180.1.15 82
67. nat server protocol tcp global 123.133.79.53 443 inside 180.180.1.8 443
68. nat server protocol tcp global 123.133.79.53 1433 inside 180.180.1.49 1433
69. nat server protocol tcp global 123.133.79.53 1521 inside 180.180.1.8 1521
70. nat server protocol tcp global 123.133.79.53 6000 inside 180.180.1.46 6000
71. nat server protocol tcp global 123.133.79.53 8888 inside 180.180.1.8 8888
72. #
73. interface GigabitEthernet0/1
74. port link-mode route
75. description Multiple_Line
76. combo enable copper
77. ip address 192.168.254.4 255.255.255.0
78. nat outbound
79. undo dhcp select server
80. #
81. interface GigabitEthernet0/2
82. port link-mode route
83. ip address 180.180.0.201 255.255.0.0
84. nat server protocol tcp global current-interface 9996 inside 131.252.88.188 9996
85. undo dhcp select server
86. #
87. security-zone name Local
88. #
89. security-zone name Trust
90. #
91. security-zone name DMZ
92. #
93. security-zone name Untrust
94. #
95. security-zone name Management
96. #
97. scheduler logfile size 16
98. #
99. line class aux
100. user-role network-admin
101. #
102. line class tty
103. user-role network-operator
104. #
105. line class usb
106. user-role network-admin
107. #
108. line class vty
109. user-role network-operator
110. #
111. line aux 0
112. user-role network-admin
113. #
114. line vty 0 63
115. authentication-mode scheme
116. user-role network-operator
117. #
118. ip route-static 0.0.0.0 0 GigabitEthernet0/0 123.133.79.49
119. ip route-static 131.252.88.188 32 Ethernet2/1 192.9.177.1
120. ip route-static 172.16.111.72 32 192.9.177.1 description yinlianjiankong
121. #
122. acl basic 2001
123. rule 5 permit
124. #
125. password-control enable 
126. undo password-control aging enable 
127. undo password-control history enable 
128. password-control length 6
129. password-control login-attempt 3 exceed lock-time 10
130. password-control update-interval 0
131. password-control login idle-time 0
132. password-control complexity user-name check
133. #
134. domain system
135. #
136. domain default enable system
137. #
138. role name level-0
139. description Predefined level-0 role
140. #
141. role name level-1
142. description Predefined level-1 role
143. #
144. role name level-2
145. description Predefined level-2 role
146. #
147. role name level-3
148. description Predefined level-3 role
149. #
150. role name level-4
151. description Predefined level-4 role
152. #
153. role name level-5
154. description Predefined level-5 role
155. #
156. role name level-6
157. description Predefined level-6 role
158. #
159. role name level-7
160. description Predefined level-7 role
161. #
162. role name level-8
163. description Predefined level-8 role
164. #
165. role name level-9
166. description Predefined level-9 role
167. #
168. role name level-10
169. description Predefined level-10 role
170. #
171. role name level-11
172. description Predefined level-11 role
173. #
174. role name level-12
175. description Predefined level-12 role
176. #
177. role name level-13
178. description Predefined level-13 role
179. #
180. role name level-14
181. description Predefined level-14 role
182. #
183. user-group system
184. #
185. local-user admin class manage
186. service-type ftp
187. service-type ssh telnet terminal http https
188. authorization-attribute user-role network-admin
189. #
190. local-user xxzx class manage
191. service-type ftp
192. service-type ssh telnet terminal http https
193. authorization-attribute user-role network-admin
194. #
195. local-user wfbhdl class network
196. password cipher $c$3$SNoYkIy94zcgZ+SK4WE0y8R/x4aRRiKxnrsctP8=
197. service-type ppp
198. authorization-attribute user-role network-operator
199. #
200. ftp server enable
201. #
202. l2tp-group 1 mode lns
203. allow l2tp virtual-template 1
204. undo tunnel authentication
205. #
206. l2tp enable
207. #
208. ip http port 6627
209. ip http enable
210. #
211. wlan global-configuration
212. #
213. wlan ap-group default-group
214. #
215. cloud-management server domain oasis.h3c.com
216. #
217. return

 为什么GigabitEthernet0/2的nat映射必须加acl2001才能通呢？