H3C F100防火墙策略

看着策略路由配置没什么问题，192.168.100.0/24段的网关是192.168.100.1吗？检查一下安全策略是否放行了

建议优先检查策略路由“pbr_troute”中是否存在节点编号小于10且**未配置任何`if-match`子句**的空节点。这是因为策略路由会按照节点编号从小到大进行匹配，一旦报文命中了某个节点，就不再继续匹配后续节点。如果一个节点（例如节点0或节点5）没有配置`if-match`条件，则会**默认匹配所有流量**；如果该节点也没有配置`apply`动作，那么所有流量将直接根据路由表转发，导致您后续配置的节点10（匹配ACL 3100）完全失效。

可以执行以下命令查看并清理此类空节点：

display policy-based-route pbr_troute

如果发现类似下方的配置，其中节点5没有 `if-match` 和 `apply` 语句，则需要将其删除。
policy-based-route pbr_troute permit node 5
# 此节点为空配置，将导致策略路由失效


请删除这个空的策略路由节点：
system-view
undo policy-based-route pbr_troute permit node 5

完成上述操作后，您的节点10应该可以正常匹配并生效。

有全部配置吗？去掉敏感信息

已去掉一些信息。网络通的。

#

version 7.1.064, Ess 9536P1916
#
sysname H3C
#
clock protocol none
#
context Admin id 1
#
telnet server enable
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
dhcp enable
#
dns server 202.96.134.133
dns server 202.96.128.86
#
ip subscriber access-user log enable successful-login failed-login logout normal abnormal
#
password-recovery enable
#
vlan 1
#
vlan 10 to 11
#
vlan 20
#
vlan 30
#
object-group ip address LAN
0 network subnet 192.168.0.0 255.255.0.0
#
object-group ip address VLAN10
0 network subnet 192.168.100.0 255.255.255.0
#
object-group ip address VLAN20
0 network subnet 192.168.101.0 255.255.255.0
#
object-group ip address VLAN30
0 network subnet 192.168.102.0 255.255.255.0
#
object-group ip address VPN
0 network range 192.168.200.1 192.168.201.255
#
object-group service high-risk_ports
0 service tcp destination range 20 21
10 service tcp destination eq 22
20 service tcp destination eq 23
30 service tcp destination eq 69
40 service udp destination eq 69
50 service tcp destination eq 135
60 service udp destination eq 135
70 service tcp destination range 137 139
80 service udp destination range 137 139
90 service tcp destination eq 445
100 service udp destination eq 445
110 service tcp destination eq 389
120 service tcp destination eq 177
130 service tcp destination eq 4899
140 service tcp destination eq 513
150 service tcp destination range 1433 1435
160 service tcp destination range 1521 1530
170 service tcp destination eq 3306
180 service tcp destination eq 3389
190 service tcp destination eq 6379
200 service tcp destination range 6000 6063
210 service tcp destination eq 8888
220 service tcp destination range 50000 50050
#
dhcp server ip-pool vlan10
gateway-list 192.168.100.1
network 192.168.100.0 mask 255.255.255.0
address range 192.168.100.10 192.168.100.200
dns-list 202.96.128.68 202.96.134.133
expired day 0 hour 8
#
dhcp server ip-pool vlan20
gateway-list 192.168.101.1
network 192.168.101.0 mask 255.255.255.0
address range 192.168.101.10 192.168.101.255
dns-list 202.96.128.68 202.96.134.133
expired day 0 hour 8
forbidden-ip 192.168.101.118
static-bind ip-address 192.168.101.118 mask 255.255.255.0 hardware-address 9483-c4e0-2b09
#
dhcp server ip-pool vlan30
gateway-list 192.168.102.1
network 192.168.102.0 mask 255.255.255.0
dns-list 202.96.128.68 202.96.134.133
expired day 0 hour 8
#
policy-based-route pbr_softroute permit node 10
if-match acl 3100
apply next-hop 192.168.101.118
#
controller Cellular1/0/0
#
interface NULL0
#
interface Vlan-interface10
ip address 192.168.100.1 255.255.255.0
dhcp server apply ip-pool vlan10
ip policy-based-route pbr_softroute
#
interface Vlan-interface20
ip address 192.168.101.1 255.255.255.0
dhcp server apply ip-pool vlan20
#
interface Vlan-interface30
ip address 192.168.102.1 255.255.255.0
dhcp server apply ip-pool vlan30
#
interface GigabitEthernet1/0/0
port link-mode route
combo enable copper
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet1/0/1
port link-mode route
description GuideWan Interface
bandwidth 10000000
combo enable copper
ip address 000.000.000.000 255.255.255.0
dns server 202.96.128.68
dns server 202.96.134.133
nat outbound 3000
ipsec apply policy ipsec1
gateway 000.000.000.000
#
interface GigabitEthernet1/0/2
port link-mode route
description GuideLan Interface
ip address 192.168.140.1 255.255.255.0
#
interface GigabitEthernet1/0/3
port link-mode route
ip address 192.168.120.1 255.255.255.0
#
interface GigabitEthernet1/0/4
port link-mode route
description GuideDmz Interface
ip address 192.168.130.1 255.255.255.0
#
interface GigabitEthernet1/0/5
port link-mode bridge
description link_lan
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 20
port trunk pvid vlan 10
#
interface GigabitEthernet1/0/6
port link-mode bridge
port access vlan 20
#
interface GigabitEthernet1/0/7
port link-mode bridge
description link_lan
port access vlan 10
#
interface GigabitEthernet1/0/8
port link-mode bridge
description link_lan
port access vlan 10
#
interface GigabitEthernet1/0/9
port link-mode bridge
description link_lan
port access vlan 10
#
interface GigabitEthernet1/0/10
port link-mode bridge
description link_lan
port access vlan 20
#
interface GigabitEthernet1/0/11
port link-mode bridge
description link_lan
port access vlan 30
#
interface SSLVPN-AC1
ip address 10.1.1.1 255.255.255.0
#
security-zone name Local
#
security-zone name Trust
import interface GigabitEthernet1/0/2
import interface Vlan-interface10
import interface Vlan-interface20
import interface Vlan-interface30
import interface GigabitEthernet1/0/5 vlan 1
import interface GigabitEthernet1/0/6 vlan 20
import interface GigabitEthernet1/0/7 vlan 10
import interface GigabitEthernet1/0/8 vlan 10
import interface GigabitEthernet1/0/9 vlan 10
import interface GigabitEthernet1/0/10 vlan 20
import interface GigabitEthernet1/0/11 vlan 30
#
security-zone name DMZ
import interface GigabitEthernet1/0/4
#
security-zone name Untrust
import interface GigabitEthernet1/0/1
import interface SSLVPN-AC1
#
security-zone name Management
import interface GigabitEthernet1/0/0
#
scheduler logfile size 16
#
line class aux
user-role network-operator
#
line class console
authentication-mode scheme
user-role network-admin
#
line class usb
user-role network-admin
#
line class vty
user-role network-operator
#
line aux 0
user-role network-admin
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-admin
#
ip route-static 0.0.0.0 0 GigabitEthernet1/0/1 000.000.000.000
#
customlog format dpi ips
customlog format dpi anti-virus
customlog format dpi ip-reputation
customlog with-sn
#
ssh server enable
#
arp ip-conflict log prompt
#
acl basic 2000
rule 0 permit
#
acl advanced 3000
rule 10 deny ip source 192.168.0.0 0.0.255.255 destination 192.168.200.0 0.0.0.255
rule 20 deny ip source 192.168.0.0 0.0.255.255 destination 192.168.201.0 0.0.0.255
rule 999 permit ip
#
acl advanced 3100
rule 10 permit ip source 192.168.100.0 0.0.0.255
#
acl advanced 3101
rule 999 permit ip
#
acl advanced name IPsec_ipsec1_IPv4_1
rule 0 permit ip source 192.168.100.0 0.0.0.255 destination 192.168.200.0 0.0.0.255
rule 1 permit ip source 192.168.100.0 0.0.0.255 destination 192.168.201.0 0.0.0.255
rule 2 permit ip source 192.168.101.0 0.0.0.255 destination 192.168.200.0 0.0.0.255
rule 3 permit ip source 192.168.101.0 0.0.0.255 destination 192.168.201.0 0.0.0.255
#
undo password-control length enable
undo password-control composition enable
undo password-control complexity user-name check
#
domain system
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password hash
service-type ssh telnet terminal https
authorization-attribute user-role level-3
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
local-user sslvpn class network
password cipher
service-type sslvpn
authorization-attribute acl 2000
authorization-attribute user-role network-operator
authorization-attribute sslvpn-policy-group resourcegrp
#
ssl renegotiation disable
#
ipsec logging negotiation enable
#
ipsec transform-set ipsec1_IPv4_1
esp encryption-algorithm 3des-cbc
esp authentication-algorithm sha1
#
ipsec policy ipsec1 1 isakmp
transform-set ipsec1_IPv4_1
security acl name IPsec_ipsec1_IPv4_1
local-address 0.0.0.0
remote-address 0.0.0.0
ike-profile ipsec1_IPv4_1
sa trigger-mode auto
#
apr signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
ike logging negotiation enable
#
ike profile ipsec1_IPv4_1
keychain ipsec1_IPv4_1
local-identity address 0.0.0.0
match remote identity address 0.0.0.0 255.255.255.255
match local address GigabitEthernet1/0/1
#
ike proposal 1
encryption-algorithm 3des-cbc
dh group2
#
ike keychain ipsec1_IPv4_1
match local address GigabitEthernet1/0/1
pre-shared-key address 0.0.0.0 255.255.255.255 key cipher $c$3$6a
netconf soap http enable
netconf soap https enable
restful http enable
restful https enable
#
ip http enable
ip https enable
#
blacklist logging enable
#
url-filter signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
ips signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
app-profile 1_IPv4
ips apply policy default mode protect
anti-virus apply policy default mode protect
#
app-profile 2_IPv4
ips apply policy default mode protect
anti-virus apply policy default mode protect
#
app-profile 3_IPv4
ips apply policy default mode protect
anti-virus apply policy default mode protect
#
app-profile 4_IPv4
ips apply policy default mode protect
anti-virus apply policy default mode protect
#
app-profile 6_IPv4
#
app-profile 7_IPv4
ips apply policy guideipspolicy mode protect
#
inspect logging parameter-profile av_logging_default_parameter
#
inspect logging parameter-profile ips_logging_default_parameter
#
inspect logging parameter-profile url_logging_default_parameter
#
loadbalance isp file flash:/lbispinfo_v1.5.tp
#
traffic-policy
rule 3 name GuideWANAccPolicy
action qos profile guidewanaccprofile
source-zone Trust
destination-zone DMZ
destination-zone Untrust
service ike
service ipsec-ah
service ipsec-esp
service l2tp
service nat-t-ipsec
rule 4 name GuideAVCPolicy
action qos profile guideavcprofile1
source-zone Trust
destination-zone DMZ
destination-zone Untrust
profile name guideavcprofile1
bandwidth downstream guaranteed 7000000
bandwidth downstream maximum 7000000
profile name guidewanaccprofile
bandwidth downstream guaranteed 3000000
bandwidth downstream maximum 3000000
#
sslvpn ip address-pool sslvpnpool 10.1.1.2 10.1.1.200
#
sslvpn gateway gw
ip address 0.0.0.0 port 4430
service enable
#
sslvpn context ctxip
gateway gw domain domainip
ip-tunnel interface SSLVPN-AC1
ip-tunnel address-pool sslvpnpool mask 255.255.255.0
ip-route-list rtlist
include 0.0.0.0 0.0.0.0
policy-group resourcegrp
ip-tunnel access-route ip-route-list rtlist
service enable
#
ip-mac binding ipv4 192.168.101.118 mac-address 9483-c4e0-2b09 vlan 20
#
security-policy ip
rule 11 name ipsec-vpn-ike
action pass
service ipsec-esp
service nat-t-ipsec
service ike
rule 8 name ipsec_vpn
action pass
source-ip LAN
destination-ip VPN
rule 5 name trust-trust
logging enable
source-zone trust
destination-zone trust
source-ip VLAN10
source-ip VLAN20
destination-ip VLAN30
rule 9 name ܾ vlan30
source-zone Trust
destination-zone Trust
source-ip VLAN30
destination-ip VLAN10
destination-ip VLAN20
rule 10 name vlan1020
action pass
source-zone Trust
destination-zone Trust
source-ip VLAN10
source-ip VLAN20
destination-ip VLAN10
destination-ip VLAN20
rule 7 name GuideSecPolicy
action pass
profile 7_IPv4
source-zone Trust
destination-zone Untrust
destination-zone DMZ
rule 0 name Disable_high-risk_ports
source-zone Untrust
source-zone Local
destination-zone Trust
destination-zone Local
destination-zone DMZ
destination-zone Untrust
service high-risk_ports
rule 1 name any-local
action pass
logging enable
profile 1_IPv4
source-zone trust
source-zone untrust
destination-zone local
rule 2 name local-any
action pass
logging enable
profile 2_IPv4
source-zone trust
source-zone local
destination-zone untrust
destination-zone trust
rule 4 name untrust-trust
action pass
logging enable
profile 4_IPv4
source-zone untrust
destination-zone trust
rule 3 name trust-untrust
action pass
logging enable
profile 3_IPv4
source-zone trust
destination-zone untrust
#
ips policy guideipspolicy
severity-level critical
protect-target WebServer Any
protect-target WebServer Apache
protect-target WebServer IIS
protect-target WebServer Other
protect-target WebServer Tomcat
protect-target WebServer WebLogic
#
ips logging parameter-profile ips_logging_default_parameter
#
anti-virus signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
anti-virus logging parameter-profile av_logging_default_parameter
#
cloud-management server domain opstunnel-seccloud.h3c.com
#
return

已去信息，网络通的。

#
version 7.1.064, Ess 9536P1916
#
sysname H3C
#
clock protocol none
#
context Admin id 1
#
telnet server enable
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
dhcp enable
#
dns server 202.96.134.133
dns server 202.96.128.86
#
ip subscriber access-user log enable successful-login failed-login logout normal abnormal
#
password-recovery enable
#
vlan 1
#
vlan 10 to 11
#
vlan 20
#
vlan 30
#
object-group ip address LAN
0 network subnet 192.168.0.0 255.255.0.0
#
object-group ip address VLAN10
0 network subnet 192.168.100.0 255.255.255.0
#
object-group ip address VLAN20
0 network subnet 192.168.101.0 255.255.255.0
#
object-group ip address VLAN30
0 network subnet 192.168.102.0 255.255.255.0
#
object-group ip address VPN
0 network range 192.168.200.1 192.168.201.255
#
object-group service high-risk_ports
0 service tcp destination range 20 21
10 service tcp destination eq 22
20 service tcp destination eq 23
30 service tcp destination eq 69
40 service udp destination eq 69
50 service tcp destination eq 135
60 service udp destination eq 135
70 service tcp destination range 137 139
80 service udp destination range 137 139
90 service tcp destination eq 445
100 service udp destination eq 445
110 service tcp destination eq 389
120 service tcp destination eq 177
130 service tcp destination eq 4899
140 service tcp destination eq 513
150 service tcp destination range 1433 1435
160 service tcp destination range 1521 1530
170 service tcp destination eq 3306
180 service tcp destination eq 3389
190 service tcp destination eq 6379
200 service tcp destination range 6000 6063
210 service tcp destination eq 8888
220 service tcp destination range 50000 50050
#
dhcp server ip-pool vlan10
gateway-list 192.168.100.1
network 192.168.100.0 mask 255.255.255.0
address range 192.168.100.10 192.168.100.200
dns-list 202.96.128.68 202.96.134.133
expired day 0 hour 8
#
dhcp server ip-pool vlan20
gateway-list 192.168.101.1
network 192.168.101.0 mask 255.255.255.0
address range 192.168.101.10 192.168.101.255
dns-list 202.96.128.68 202.96.134.133
expired day 0 hour 8
forbidden-ip 192.168.101.118
static-bind ip-address 192.168.101.118 mask 255.255.255.0 hardware-address 9483-c4e0-2b09
#
dhcp server ip-pool vlan30
gateway-list 192.168.102.1
network 192.168.102.0 mask 255.255.255.0
dns-list 202.96.128.68 202.96.134.133
expired day 0 hour 8
#
policy-based-route pbr_softroute permit node 10
if-match acl 3100
apply next-hop 192.168.101.118
#
controller Cellular1/0/0
#
interface NULL0
#
interface Vlan-interface10
ip address 192.168.100.1 255.255.255.0
dhcp server apply ip-pool vlan10
ip policy-based-route pbr_softroute
#
interface Vlan-interface20
ip address 192.168.101.1 255.255.255.0
dhcp server apply ip-pool vlan20
#
interface Vlan-interface30
ip address 192.168.102.1 255.255.255.0
dhcp server apply ip-pool vlan30
#
interface GigabitEthernet1/0/0
port link-mode route
combo enable copper
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet1/0/1
port link-mode route
description GuideWan Interface
bandwidth 10000000
combo enable copper
ip address 000.000.000.000 255.255.255.0
dns server 202.96.128.68
dns server 202.96.134.133
nat outbound 3000
ipsec apply policy ipsec1
gateway 000.000.000.000
#
interface GigabitEthernet1/0/2
port link-mode route
description GuideLan Interface
ip address 192.168.140.1 255.255.255.0
#
interface GigabitEthernet1/0/3
port link-mode route
ip address 192.168.120.1 255.255.255.0
#
interface GigabitEthernet1/0/4
port link-mode route
description GuideDmz Interface
ip address 192.168.130.1 255.255.255.0
#
interface GigabitEthernet1/0/5
port link-mode bridge
description link_lan
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 20
port trunk pvid vlan 10
#
interface GigabitEthernet1/0/6
port link-mode bridge
port access vlan 20
#
interface GigabitEthernet1/0/7
port link-mode bridge
description link_lan
port access vlan 10
#
interface GigabitEthernet1/0/8
port link-mode bridge
description link_lan
port access vlan 10
#
interface GigabitEthernet1/0/9
port link-mode bridge
description link_lan
port access vlan 10
#
interface GigabitEthernet1/0/10
port link-mode bridge
description link_lan
port access vlan 20
#
interface GigabitEthernet1/0/11
port link-mode bridge
description link_lan
port access vlan 30
#
interface SSLVPN-AC1
ip address 10.1.1.1 255.255.255.0
#
security-zone name Local
#
security-zone name Trust
import interface GigabitEthernet1/0/2
import interface Vlan-interface10
import interface Vlan-interface20
import interface Vlan-interface30
import interface GigabitEthernet1/0/5 vlan 1
import interface GigabitEthernet1/0/6 vlan 20
import interface GigabitEthernet1/0/7 vlan 10
import interface GigabitEthernet1/0/8 vlan 10
import interface GigabitEthernet1/0/9 vlan 10
import interface GigabitEthernet1/0/10 vlan 20
import interface GigabitEthernet1/0/11 vlan 30
#
security-zone name DMZ
import interface GigabitEthernet1/0/4
#
security-zone name Untrust
import interface GigabitEthernet1/0/1
import interface SSLVPN-AC1
#
security-zone name Management
import interface GigabitEthernet1/0/0
#
scheduler logfile size 16
#
line class aux
user-role network-operator
#
line class console
authentication-mode scheme
user-role network-admin
#
line class usb
user-role network-admin
#
line class vty
user-role network-operator
#
line aux 0
user-role network-admin
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-admin
#
ip route-static 0.0.0.0 0 GigabitEthernet1/0/1 000.000.000.000
#
customlog format dpi ips
customlog format dpi anti-virus
customlog format dpi ip-reputation
customlog with-sn
#
ssh server enable
#
arp ip-conflict log prompt
#
acl basic 2000
rule 0 permit
#
acl advanced 3000
rule 10 deny ip source 192.168.0.0 0.0.255.255 destination 192.168.200.0 0.0.0.255
rule 20 deny ip source 192.168.0.0 0.0.255.255 destination 192.168.201.0 0.0.0.255
rule 999 permit ip
#
acl advanced 3100
rule 10 permit ip source 192.168.100.0 0.0.0.255
#
acl advanced 3101
rule 999 permit ip
#
acl advanced name IPsec_ipsec1_IPv4_1
rule 0 permit ip source 192.168.100.0 0.0.0.255 destination 192.168.200.0 0.0.0.255
rule 1 permit ip source 192.168.100.0 0.0.0.255 destination 192.168.201.0 0.0.0.255
rule 2 permit ip source 192.168.101.0 0.0.0.255 destination 192.168.200.0 0.0.0.255
rule 3 permit ip source 192.168.101.0 0.0.0.255 destination 192.168.201.0 0.0.0.255
#
undo password-control length enable
undo password-control composition enable
undo password-control complexity user-name check
#
domain system
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password hash
service-type ssh telnet terminal https
authorization-attribute user-role level-3
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
local-user sslvpn class network
password cipher
service-type sslvpn
authorization-attribute acl 2000
authorization-attribute user-role network-operator
authorization-attribute sslvpn-policy-group resourcegrp
#
ssl renegotiation disable
#
ipsec logging negotiation enable
#
ipsec transform-set ipsec1_IPv4_1
esp encryption-algorithm 3des-cbc
esp authentication-algorithm sha1
#
ipsec policy ipsec1 1 isakmp
transform-set ipsec1_IPv4_1
security acl name IPsec_ipsec1_IPv4_1
local-address 0.0.0.0
remote-address 0.0.0.0
ike-profile ipsec1_IPv4_1
sa trigger-mode auto
#
apr signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
ike logging negotiation enable
#
ike profile ipsec1_IPv4_1
keychain ipsec1_IPv4_1
local-identity address 0.0.0.0
match remote identity address 0.0.0.0 255.255.255.255
match local address GigabitEthernet1/0/1
#
ike proposal 1
encryption-algorithm 3des-cbc
dh group2
#
ike keychain ipsec1_IPv4_1
match local address GigabitEthernet1/0/1
pre-shared-key address 0.0.0.0 255.255.255.255 key cipher $c$3$6a
netconf soap http enable
netconf soap https enable
restful http enable
restful https enable
#
ip http enable
ip https enable
#
blacklist logging enable
#
url-filter signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
ips signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
app-profile 1_IPv4
ips apply policy default mode protect
anti-virus apply policy default mode protect
#
app-profile 2_IPv4
ips apply policy default mode protect
anti-virus apply policy default mode protect
#
app-profile 3_IPv4
ips apply policy default mode protect
anti-virus apply policy default mode protect
#
app-profile 4_IPv4
ips apply policy default mode protect
anti-virus apply policy default mode protect
#
app-profile 6_IPv4
#
app-profile 7_IPv4
ips apply policy guideipspolicy mode protect
#
inspect logging parameter-profile av_logging_default_parameter
#
inspect logging parameter-profile ips_logging_default_parameter
#
inspect logging parameter-profile url_logging_default_parameter
#
loadbalance isp file flash:/lbispinfo_v1.5.tp
#
traffic-policy
rule 3 name GuideWANAccPolicy
action qos profile guidewanaccprofile
source-zone Trust
destination-zone DMZ
destination-zone Untrust
service ike
service ipsec-ah
service ipsec-esp
service l2tp
service nat-t-ipsec
rule 4 name GuideAVCPolicy
action qos profile guideavcprofile1
source-zone Trust
destination-zone DMZ
destination-zone Untrust
profile name guideavcprofile1
bandwidth downstream guaranteed 7000000
bandwidth downstream maximum 7000000
profile name guidewanaccprofile
bandwidth downstream guaranteed 3000000
bandwidth downstream maximum 3000000
#
sslvpn ip address-pool sslvpnpool 10.1.1.2 10.1.1.200
#
sslvpn gateway gw
ip address 0.0.0.0 port 4430
service enable
#
sslvpn context ctxip
gateway gw domain domainip
ip-tunnel interface SSLVPN-AC1
ip-tunnel address-pool sslvpnpool mask 255.255.255.0
ip-route-list rtlist
include 0.0.0.0 0.0.0.0
policy-group resourcegrp
ip-tunnel access-route ip-route-list rtlist
service enable
#
ip-mac binding ipv4 192.168.101.118 mac-address 9483-c4e0-2b09 vlan 20
#
security-policy ip
rule 11 name ipsec-vpn-ike
action pass
service ipsec-esp
service nat-t-ipsec
service ike
rule 8 name ipsec_vpn
action pass
source-ip LAN
destination-ip VPN
rule 5 name trust-trust
logging enable
source-zone trust
destination-zone trust
source-ip VLAN10
source-ip VLAN20
destination-ip VLAN30
rule 9 name ܾ vlan30
source-zone Trust
destination-zone Trust
source-ip VLAN30
destination-ip VLAN10
destination-ip VLAN20
rule 10 name vlan1020
action pass
source-zone Trust
destination-zone Trust
source-ip VLAN10
source-ip VLAN20
destination-ip VLAN10
destination-ip VLAN20
rule 7 name GuideSecPolicy
action pass
profile 7_IPv4
source-zone Trust
destination-zone Untrust
destination-zone DMZ
rule 0 name Disable_high-risk_ports
source-zone Untrust
source-zone Local
destination-zone Trust
destination-zone Local
destination-zone DMZ
destination-zone Untrust
service high-risk_ports
rule 1 name any-local
action pass
logging enable
profile 1_IPv4
source-zone trust
source-zone untrust
destination-zone local
rule 2 name local-any
action pass
logging enable
profile 2_IPv4
source-zone trust
source-zone local
destination-zone untrust
destination-zone trust
rule 4 name untrust-trust
action pass
logging enable
profile 4_IPv4
source-zone untrust
destination-zone trust
rule 3 name trust-untrust
action pass
logging enable
profile 3_IPv4
source-zone trust
destination-zone untrust
#
ips policy guideipspolicy
severity-level critical
protect-target WebServer Any
protect-target WebServer Apache
protect-target WebServer IIS
protect-target WebServer Other
protect-target WebServer Tomcat
protect-target WebServer WebLogic
#
ips logging parameter-profile ips_logging_default_parameter
#
anti-virus signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
anti-virus logging parameter-profile av_logging_default_parameter
#
cloud-management server domain opstunnel-seccloud.h3c.com
#
return

从你的描述来看，ACL 3100没有匹配到流量是策略未生效的直接表现。这个问题在H3C防火墙上比较典型，通常可以从以下几个方向来排查：

🔍 第一步：检查ACL配置是否“精准打击”

这是最需要确认的一点：ACL 3100的规则是否确实放行了你想匹配的流量。

• 核心问题：acl advanced 3100 中可能没有配置 permit ip source 192.168.100.0 0.0.0.255 这条规则，或者存在更早的 deny 规则将其拒绝了。

• ACL匹配原则：ACL是按编号从小到大顺序匹配的，一旦匹配上某条规则就立即执行，不再继续往下匹配。

• 解决办法：请检查ACL 3100的完整配置。如果存在 deny 规则在 permit 之前，会导致流量被拒绝。建议先删除或注释掉旧的ACL规则，然后重新配置，确保有一条明确的规则放行整个 192.168.100.0/24 网段。

🧭 第二步：检查策略路由应用的方向

策略路由（PBR）只对从该接口进入（inbound）的流量生效。

• 你的配置：将策略应用在 Vlan-interface10 上。

• 这意味着：只有从 Vlan-interface10 进入防火墙的流量（即源IP为 192.168.100.0/24 的PC发起的流量），才会被这个策略路由处理。

• 检查点：请确认你的测试流量（如从办公PC ping 192.168.101.118）确实是从 Vlan-interface10 进入防火墙的。如果流量是从其他接口进入的，自然不会匹配这条策略。

🛡️ 第三步：检查安全策略是否“提前拦截”

H3C防火墙的报文处理顺序通常是：入接口安全策略 → 策略路由（PBR）→ 路由表转发。

这意味着，如果安全策略（Security Policy）在第一步就丢弃了数据包，那么策略路由根本就不会被执行。

• 检查点：请检查防火墙的安全策略，确保从 Vlan-interface10 所在安全域到 192.168.101.118 所在安全域的流量是允许（permit） 的。

🧭 第四步：检查下一跳是否“可达”

策略路由中指定的下一跳 192.168.101.118 必须路由可达。

• 检查点：防火墙必须有到达 192.168.101.118 的路由。请检查防火墙的路由表，确认去往 192.168.101.118 的路径是存在的，并且出接口状态是UP的。

🛠️ 第五步：用命令验证，而不是只看ACL计数

在H3C防火墙上，通过 display acl 查看的匹配计数可能不准确，因为硬件转发的流量可能不会增加计数。

建议使用以下更可靠的命令来验证策略路由是否生效：

• 查看策略路由统计：

  bash

  display ip policy-based-route interface Vlan-interface10

  这个命令会显示该接口上策略路由的匹配次数和转发次数。

• 查看会话表：

  bash

  display session table ipv4 source-ip 192.168.100.x

  通过查看特定源IP的会话，可以确认流量是否经过了防火墙以及它的出接口和下一跳

关闭快速转发，采用PBR的话

rule 10 permit ip source 192.168.100.0 0.0.0.255 华三防火墙要匹配目的 0.0.0.0才行

一、先定位核心故障：ACL3100 无命中计数、PBR 不生效的 4 个根本原因
结合你截图里的 ACL 现状 + 配置逻辑逐一分析：
原因 1：策略路由绑定接口错误（最高概率）
内网终端网段是 192.168.100.0/24，网关在 Vlan-interface 10，你确实在 Vlan10 下绑定了 ip policy-based-route。
PBR 的生效逻辑：数据包入接口匹配 PBR 才会处理。
如果终端上行不是走 Vlan10 进防火墙（比如终端来自其他 VLAN、跨三层接入防火墙），流量不会进入 Vlan10 接口，ACL3100 永远无法命中。
验证命令：
bash
display ip policy-based-route interface
查看 PBR 是否成功绑定在 Vlan-interface10。
原因 2：防火墙域间安全策略拦截，流量根本没抵达 PBR 处理环节
防火墙处理顺序：域间安全策略放行 → 再执行接口 PBR。
你 ACL3000 存在拦截规则：
plaintext
rule 10 deny ip source 192.168.0.0 0.0.255.255 destination 192.168.200.0/24
rule 20 deny ip source 192.168.0.0 0.0.255.255 destination 192.168.201.0/24
rule 999 permit ip
192.168.100.0 属于 192.168.0.0/16，如果目标地址是 200/201 网段，会被 ACL3000 拒绝转发，流量直接丢弃，自然不会触发 PBR、ACL3100 无统计。
原因 3：下一跳 192.168.101.118 不可达，PBR 匹配后执行失败
PBR 命中 ACL 之后，会尝试把报文转发至apply next-hop 192.168.101.118；
若防火墙路由表没有去往192.168.101.118的路由、或者该网关不通：
PBR 匹配成功，但转发失败，流量回退到普通路由转发；
ACL3100 依旧不会产生匹配计数（部分固件下，下一跳不可达时不会统计 ACL 命中）。
排查连通性：
bash
ping 192.168.101.118
display ip routing-table 192.168.101.118
原因 4：方向搞反 + 防火墙 PBR 部署误区
ip policy-based-route 是入方向策略路由：只对从 Vlan10 进入防火墙的流量生效。
若流量是从外网进防火墙、回包去往 192.168.100.0，不会匹配该 PBR；
若 192.168.100.0 网段本身不在 Vlan10 内，ACL 自然匹配不到流量。
原因 5：ACL 3100 仅放行源网段，缺少目的限制不影响匹配，但容易混淆
你的 ACL3100 只写了source 192.168.100.0/24，所有源为此网段的流量都会匹配，语法没问题，但建议加上目的任意保证严谨。
二、分步修复方案（按顺序操作）
步骤 1：排查下一跳可达性，确保网关 192.168.101.118 防火墙能通
bash
# 防火墙内 ping 下一跳网关
ping 192.168.101.118
# 查看是否存在路由
display ip routing-table 192.168.101.118
不通则添加静态路由指向该网关所在出接口：
bash
ip route-static 192.168.101.118 255.255.255.255 出接口名称
步骤 2：修正 ACL3100，补充完整规则并开启计数
bash
acl advanced 3100
rule 10 permit ip source 192.168.100.0 0.0.0.255 destination any count
# count 开启匹配计数，方便观察命中
步骤 3：优化 PBR，增加下一跳探测（NQA 联动，下一跳断了自动切回默认路由）
bash
# 1、创建NQA探测实例，检测网关存活
nqa entry admin test
type icmp-echo
destination ip 192.168.101.118
frequency 1000
reaction 1 checked-element probe-fail threshold-type consecutive 3 action-type trigger-only
start nqa entry admin test

# 2、修改策略路由，绑定NQA，网关失效自动不执行这条PBR
policy-based-route pbr_troute permit node 10
if-match acl 3100
apply next-hop 192.168.101.118 track nqa admin test
步骤 4：确认 PBR 绑定正确、并且放行域间安全策略
确认绑定：
bash
interface Vlan-interface 10
ip policy-based-route pbr_troute
内网安全区域务必放行 192.168.100.0 所有流量，避免被 ACL3000 拦截：
bash
# 安全策略示例，trust→untrust全部放行
security-zone trust
source 192.168.100.0 mask 255.255.255.0
security-zone untrust
policy interzone trust untrust permit
步骤 5：验证生效
内网 192.168.100.x 终端上网，持续产生流量
查看 ACL 命中：
bash
display acl 3100
rule10 出现匹配次数 = PBR 已经正常命中。
3. 追踪路由确认出口：
bash
tracert 公网IP
第二跳应为 192.168.101.118。
三、两种补充场景方案
场景 A：想要所有去往外网的 192.168.100.0 流量走 192.168.101.118
ACL 增加目的为非内网网段，避免内网互访也触发 PBR：
bash
acl advanced 3100
rule 10 permit ip source 192.168.100.0 0.0.0.255 destination not 192.168.0.0 0.0.255.255 count
场景 B：全网全局 PBR（不用绑定 Vlanif，全局生效）
如果 192.168.100.0 分布在多个 VLAN，不需要逐个接口绑定：
bash
policy-based-route pbr_global permit node 10
if-match acl 3100
apply next-hop 192.168.101.118 track nqa admin test

# 全局开启策略路由
ip policy-based-route pbr_global
四、最常见踩坑总结
下一跳网关不通 → PBR 匹配但转发失败，ACL3100 无计数；
流量被域间安全策略 / ACL3000 提前丢弃，根本到不了 PBR 阶段；
网段不在 Vlan10 接入，PBR 绑定接口错误；
没加count，看不到 ACL 命中误以为策略没匹配。