ipsec ikev2 一阶段协商成功但是，二阶段通讯失败 ；vFW1000

在测试环境下，vFW1000 作为Hub节点与对端一台CPE-工业路由器设备作为spoke节点，建立ipsec vpn 并使用ikev2，匹配多子网，ikev2一阶段已经协商成功，存在ikev2 sa 条目，但是无法形成ipsec sa条目，双方子网互不可达，ikev1测试正常，双方单子网可达。求教，非常感谢！

vfw配置如下：

ipsec transform-set 5G_IPv4_1

 esp encryption-algorithm aes-cbc-128 

 esp authentication-algorithm sha1 

#

ipsec policy-template 5G 1

 transform-set 5G_IPv4_1 

 security acl 3000 

 local-address 192.168.16.3

 ikev2-profile 5G_IPv4_1

#

ipsec policy 5G 1 isakmp template 5G

#

ikev2 keychain 5G_IPv4_1

 peer spoke

  address 0.0.0.0 0.0.0.0

  identity address 0.0.0.0

  pre-shared-key local ciphertext $c$3$KmXx9E8WMEG/xIYbLjgDW1DIK7rH3gn8lrx4LCzuw5c=

  pre-shared-key remote ciphertext $c$3$Xam3Cu1WFRhXkyaobzRVVc3jhuTi3IismdwGXMv9l+k=

#

ikev2 profile 5G_IPv4_1

 authentication-method local pre-share

 authentication-method remote pre-share

 keychain 5G_IPv4_1

 identity local address 192.168.16.3

 match remote identity address 0.0.0.0 0.0.0.0

#

ikev2 proposal 5

 encryption 3des-cbc 

 integrity sha256 

 dh group14 

#

ikev2 policy 5G_IPv4_1

 proposal 5 

接口下都已经调用策略，ikev1测试正常，双方单子网可达。

对端设备配置如下：