在policy里设置deny pingfrom-zone untrust to-zone trust {policy vpnpolicy-unt-tr {match {source-address remote-net;destination-address local-net;application ping;}then {deny
policy设置
