NS5GT外网无法访问内网，急

冷闪

我配好的NS5GT突然就无法访问内网了，但内网可以任意访问外网，重新配置，把一切干扰因素都去掉了，还是不行，哪位大侠帮我看看怎么回事啊，急，下面是我的最简配置\r\n我的trust区是211.100.28.192/28，untrust区是211.100.28.132/29，内网网关是211.100.28.202，这个是配在我的外网之下，外网由电信分配，是从211.100.28.132－211.100.28.227的一个段，网关是211.100.28.129，掩码211.100.28.128\r\n\r\nget cof  nfig\r\nTotal Config size 3132:\r\nset clock timezone 0\r\nset vrouter trust-vr sharable\r\nunset vrouter \"trust-vr\" auto-route-export\r\nset auth-server \"Local\" id 0\r\nset auth-server \"Local\" server-name \"Local\"\r\nset auth default auth server \"Local\"\r\nset admin name \"eastfirewall\"\r\nset admin password \"nJwWKArZNnNJccHMEsvA7zCtKJGe4n\"\r\nset admin auth timeout 10\r\nset admin auth server \"Local\"\r\nset admin format dos\r\nset zone \"Trust\" vrouter \"trust-vr\"\r\nset zone \"Untrust\" vrouter \"trust-vr\"\r\nset zone \"VLAN\" vrouter \"trust-vr\"\r\nset zone \"Trust\" block \r\nunset zone \"Trust\" tcp-rst \r\nset zone \"Untrust\" block \r\nunset zone \"Untrust\" tcp-rst \r\nset zone \"MGT\" block \r\nset zone \"VLAN\" block \r\nset zone \"VLAN\" tcp-rst \r\n--- more --- \r\nset zone \"Untrust\" screen tear-drop\r\nset zone \"Untrust\" screen syn-flood\r\nset zone \"Untrust\" screen ping-death\r\nset zone \"Untrust\" screen ip-filter-src\r\nset zone \"Untrust\" screen land\r\nset zone \"V1-Untrust\" screen tear-drop\r\nset zone \"V1-Untrust\" screen syn-flood\r\nset zone \"V1-Untrust\" screen ping-death\r\nset zone \"V1-Untrust\" screen ip-filter-src\r\nset zone \"V1-Untrust\" screen land\r\nset interface \"trust\" zone \"Trust\"\r\nset interface \"untrust\" zone \"Untrust\"\r\nunset interface vlan1 ip\r\nset interface trust ip 211.100.28.202/28\r\nset interface trust nat\r\nset interface untrust ip 211.100.28.132/29\r\nset interface untrust route\r\nset interface untrust gateway 211.100.28.129\r\nunset interface vlan1 bypass-others-ipsec\r\nunset interface vlan1 bypass-non-ip\r\nset interface trust manage-ip 211.100.28.203\r\nset interface trust ip manageable\r\n--- more --- \r\nset interface untrust ip manageable\r\nset interface untrust manage ping\r\nset interface untrust manage ssh\r\nset interface untrust manage telnet\r\nset interface untrust manage snmp\r\nset interface untrust manage ssl\r\nset interface untrust manage web\r\nset zone V1-Untrust manage ping\r\nset zone V1-Untrust manage ssh\r\nset zone V1-Untrust manage telnet\r\nset flow tcp-mss\r\nset hostname ns5gt\r\nset ike respond-bad-spi 1\r\nset pki authority default scep mode \"auto\"\r\nset pki x509 default cert-path partial\r\nset policy id 1 from \"Trust\" to \"Untrust\" \"Any\" \"Any\" \"ANY\" permit \r\nset policy id 2 from \"Untrust\" to \"Trust\" \"Any\" \"Any\" \"ANY\" permit \r\n--- more --- \r\nset global-pro policy-manager primary outgoing-interface untrust\r\nset global-pro policy-manager secondary outgoing-interface untrust\r\nset ssh version v2\r\nset config lock timeout 5\r\nset modem speed 115200\r\nset modem retry 3\r\nset modem interval 10\r\nset modem idle-time 10\r\nset snmp port listen 161\r\nset snmp port trap 162\r\nset vrouter \"untrust-vr\"\r\nset preference ebgp 250\r\nset preference ibgp 40\r\nexit\r\nset vrouter \"trust-vr\"\r\nset preference ebgp 250\r\nset preference ibgp 40\r\nunset add-default-route\r\nset route 0.0.0.0/0 interface trust gateway 211.100.28.202\r\nset route 0.0.0.0/0 interface untrust gateway 211.100.28.132\r\nexit