1676562158,CRM论坛（CRMbbs.com）——一个让用户更懂CRM的垂直性行业内容平台,CRM论坛致力于互联网、客户管理、销售管理、SCRM私域流量内容输出5年。 如果您有好的内容，欢迎向我们投稿，共建CRM多元化生态体系，创建CRM客户管理一体化生态解决方案。内容来源：知了社区森森不熄_ 森森不熄_ 四段 粉丝：0人 关注：0人

问题描述：

组网及组网描述：

如图，某局点出口组网：设备型号：F1000-AI-25   软件版本:Version 7.1.064, Release 8860P28

RBM＋VRRP＋NAT组网，联动VRRP主备切换正常，联通和移动的VRRP虚地址ping不通公网网关，NAT不能转换。

 nat outbound接口地址可以转换，，，

FW1

nat address-group 1   移动

 address X.

 VRRP vrid 112 

 #

nat address-group 2  联通

 address X.56.36.196 X.X.36.196 

 vrrp vrid 113

 # 

interface GigabitEthernet1/0/12

 port link-mode route description YiDong-internet

 ip address X.

 vrrp vrid 112 virtual-ip X.

 nat outbound 3000 address-group 1 

# 

interface GigabitEthernet1/0/13 

 port link-mode route 

 description LianTong-internet 

 ip address X.56.36.194 255.255.255.224

vrrp vrid 113 virtual-ip X.56.36.196 active

 nat outbound 3000 address-group 2

 #

acl advanced 3000 description NAT-OUT

 rule 1000 permit ip 

# 

 ip route-static 0.0.0.0 0 X.56.36.193 

 ip route-static 0.0.0.0 0 X.

#

security-zone name Untrust 

import interface GigabitEthernet1/0/12

 import interface GigabitEthernet1/0/13

 #

security-policy ip

rule 1 name any 

 action pass 

#

# interface GigabitEthernet1/0/14 

 port link-mode route description RBM 

 port link-aggregation group 64 

#

 interface GigabitEthernet1/0/15 

 port link-mode route description RBM

 port link-aggregation group 64

 # 

remote-backup group 

 data-channel interface Route-Aggregation64 

 configuration sync-check interval 12

delay-time 1 

 local-ip 1.1.1.1 

 remote-ip 1.1.1.2 

 device-role primary 

# 

FW2

nat address-group 1   移动

 address X.

 vrrp vrid 112 

 #

nat address-group 2  联通

 address X.56.36.196 X.X.36.196 

 vrrp vrid 113

 # 

interface GigabitEthernet1/0/12

 port link-mode route description YiDong-internet

 ip address X.

 vrrp vrid 112 virtual-ip X.

 nat outbound 3000 address-group 1 

# 

interface GigabitEthernet1/0/13 

 port link-mode route 

 description LianTong-internet 

 ip address X.56.36.195 255.255.255.224

vrrp vrid 113 virtual-ip X.56.36.196 active

 nat outbound 3000 address-group 2

 #

acl advanced 3000 description NAT-OUT

 rule 1000 permit ip 

# 

 ip route-static 0.0.0.0 0 X.56.36.193 

 ip route-static 0.0.0.0 0 X.

#

security-zone name Untrust 

import interface GigabitEthernet1/0/12

 import interface GigabitEthernet1/0/13

 #

security-policy ip

rule 1 name any 

 action pass 

#

# interface GigabitEthernet1/0/14 

 port link-mode route description RBM 

 port link-aggregation group 64 

#

 interface GigabitEthernet1/0/15 

 port link-mode route description RBM

 port link-aggregation group 64

 # 

remote-backup group 

 data-channel interface Route-Aggregation64 

 configuration sync-check interval 12

delay-time 1 

 local-ip 1.1.1.2

 remote-ip 1.1.1.1

 device-role se

# 

1小时前提问

没有看见安全策略，安全策略有放通vrrp虚地址所属域访问untrust吗？

1小时前回答

VRRP对上的，直接全放通的，any

森森不熄_

你正在,RBM＋VRRP＋NAT组网，VRRP虚地址ping不通网关，NAT不能转换