H3C SecPath F100-M-G V5.20端口回流的问题？

主要配置吧：需要其他再补充

policy-based-route 1 permit node 1 

 if-match acl 3010 

 apply ip-address next-hop 111.21.x.c

 interface GigabitEthernet0/3 

 port link-mode route 

 description NeiWang 

 nat outbound 3002 

 nat server protocol tcp global 111.21.x.x 90 inside 172.16.3.250 90 

 ip address 192.168.10.254 255.255.255.0 

 ip policy-based-route 1 

 acl number 3002 

 rule 5 permit ip source 172.16.0.0 0.7.255.255 destination 172.16.3.0 0.0.0.255

 rule 10 permit ip source 192.168.0.0 0.0.255.255 destination 172.16.3.0 0.0.0.255 

acl number 3001 

 description nat-private 

 rule 0 permit ip 

 rule 5 permit tcp 

acl number 3010 

 rule 0 permit ip source 192.168.11.0 0.0.0.255 

 rule 1 permit ip source 192.168.12.0 0.0.0.255 

 rule 2 permit ip source 192.168.13.0 0.0.0.255 

 rule 3 permit ip source 192.168.14.0 0.0.0.255 

 rule 4 permit ip source 172.17.0.0 0.0.15.255 

 rule 6 permit ip source 192.168.0.0 0.0.0.255 

 rule 8 permit ip source 172.16.0.0 0.0.255.255 

 rule 9 permit ip source 172.17.0.0 0.0.7.255 

 rule 10 permit ip source 172.16.0.0 0.0.7.255 

 rule 30 deny ip 

 interface GigabitEthernet0/1

 port link-mode route 

 description To_Internet 

 nat outbound 3001 

 nat server protocol tcp global 111.21.x.x 90 inside 172.16.3.250 90 

 ip address 111.21.x.x 255.255.255.252 

 111.21.x.x 企业公网地址 111.21.x.c isp