无线本地转发后连不上绿洲

无线原先是集中转发，DHCP和网关在AC上，划分两个无线信号，信号1使用VLAN21连绿洲认证后，只能上内网，信号2使用VLAN24输密码后只能上网，无法访问内网。改成本地转发，网关改到核心上，核心默认路由到F1000，为了无线跳转到F100，写了策略路由，先重定向到F100，再允许访问内网，但跳转不到绿洲平台

信号1配置

acl number 3001（定义绿洲平台和DNS）

rule 26 permit ip source 192.168.21.0 0.0.0.255 destination 139.217.22.79 0

rule 27 permit ip source 192.168.21.0 0.0.0.255 destination 60.191.123.44 0

rule 32 permit ip source 192.168.21.0 0.0.0.255 destination 139.217.7.53 0

rule 33 permit ip source 192.168.21.0 0.0.0.255 destination 40.73.22.36 0

rule 46 permit ip source 192.168.21.0 0.0.0.255 destination 101.36.161.44 0

rule 47 permit ip source 192.168.21.0 0.0.0.255 destination 202.96.128.86 0

rule 48 permit ip source 192.168.21.0 0.0.0.255 destination 114.114.114.114 0

#

acl number 3002

rule 61 permit ip source 192.168.21.0 0.0.0.255

#

traffic classifier 3001 operator and

if-match acl 3001

#

traffic classifier 3002 operator and

if-match acl 3002

#

traffic behavior permit

filter permit

#

traffic behavior tiaozuan

redirect next-hop 192.168.60.250

#

traffic behavior deny

filter deny

#

qos policy 21

classifier 3002 behavior tiaozuan

classifier 3001 behavior permit

#

qos vlan-policy 21 vlan 21 inbound

外网双防火墙接入，F1000做有线防火墙，F100做无线防火墙，默认走F1000，F100之前有做安全策略，允许VLAN21访问绿洲，再禁止VLAN21上网