NS5GT外网无法访问内网，急

冷闪

我配好的NS5GT突然就无法访问内网了，但内网可以任意访问外网，重新配置，把一切干扰因素都去掉了，还是不行，哪位大侠帮我看看怎么回事啊，急，下面是我的最简配置
我的trust区是211.100.28.192/28，untrust区是211.100.28.132/29，内网网关是211.100.28.202，这个是配在我的外网之下，外网由电信分配，是从211.100.28.132－211.100.28.227的一个段，网关是211.100.28.129，掩码211.100.28.128

get cof  nfig
Total Config size 3132:
set clock timezone 0
set vrouter trust-vr sharable
unset vrouter "trust-vr" auto-route-export
set auth-server "Local" id 0
set auth-server "Local" server-name "Local"
set auth default auth server "Local"
set admin name "eastfirewall"
set admin password "nJwWKArZNnNJccHMEsvA7zCtKJGe4n"
set admin auth timeout 10
set admin auth server "Local"
set admin format dos
set zone "Trust" vrouter "trust-vr"
set zone "Untrust" vrouter "trust-vr"
set zone "VLAN" vrouter "trust-vr"
set zone "Trust" block
unset zone "Trust" tcp-rst
set zone "Untrust" block
unset zone "Untrust" tcp-rst
set zone "MGT" block
set zone "VLAN" block
set zone "VLAN" tcp-rst
--- more ---
set zone "Untrust" screen tear-drop
set zone "Untrust" screen syn-flood
set zone "Untrust" screen ping-death
set zone "Untrust" screen ip-filter-src
set zone "Untrust" screen land
set zone "V1-Untrust" screen tear-drop
set zone "V1-Untrust" screen syn-flood
set zone "V1-Untrust" screen ping-death
set zone "V1-Untrust" screen ip-filter-src
set zone "V1-Untrust" screen land
set interface "trust" zone "Trust"
set interface "untrust" zone "Untrust"
unset interface vlan1 ip
set interface trust ip 211.100.28.202/28
set interface trust nat
set interface untrust ip 211.100.28.132/29
set interface untrust route
set interface untrust gateway 211.100.28.129
unset interface vlan1 bypass-others-ipsec
unset interface vlan1 bypass-non-ip
set interface trust manage-ip 211.100.28.203
set interface trust ip manageable
--- more ---
set interface untrust ip manageable
set interface untrust manage ping
set interface untrust manage ssh
set interface untrust manage telnet
set interface untrust manage snmp
set interface untrust manage ssl
set interface untrust manage web
set zone V1-Untrust manage ping
set zone V1-Untrust manage ssh
set zone V1-Untrust manage telnet
set flow tcp-mss
set hostname ns5gt
set ike respond-bad-spi 1
set pki authority default scep mode "auto"
set pki x509 default cert-path partial
set policy id 1 from "Trust" to "Untrust" "Any" "Any" "ANY" permit
set policy id 2 from "Untrust" to "Trust" "Any" "Any" "ANY" permit
--- more ---
set global-pro policy-manager primary outgoing-interface untrust
set global-pro policy-manager secondary outgoing-interface untrust
set ssh version v2
set config lock timeout 5
set modem speed 115200
set modem retry 3
set modem interval 10
set modem idle-time 10
set snmp port listen 161
set snmp port trap 162
set vrouter "untrust-vr"
set preference ebgp 250
set preference ibgp 40
exit
set vrouter "trust-vr"
set preference ebgp 250
set preference ibgp 40
unset add-default-route
set route 0.0.0.0/0 interface trust gateway 211.100.28.202
set route 0.0.0.0/0 interface untrust gateway 211.100.28.132
exit