路由器接口在接口调用IPSec VPN服务模板建立不起隧道

路由器在接口调用IPSec VPN服务器模板无法建立隧道，不启用服务模板就可以建立隧道，采用主模式方式建立连接请问是什么原因，配置关键配置如下

R1:

interface GigabitEthernet0/0

port link-mode route

ip address 10.1.1.1 255.255.255.0

ipsec apply policy R3

#

interface GigabitEthernet0/1

port link-mode route

ip address 192.168.1.254 255.255.255.0

#

ip route-static 0.0.0.0 0 10.1.1.2

# acl advanced 3000

rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

rule 5 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.3.0 0.0.0.255

#

ipsec transform-set R3

esp encryption-algorithm des-cbc

esp authentication-algorithm md5

# ipsec transform-set R4

esp encryption-algorithm des-cbc

esp authentication-algorithm md5

#

ipsec policy-template R3 1

transform-set R3

security acl 3000

remote-address 10.2.2.3

ike-profile R3

#

ipsec policy-template R4 1

transform-set R4

security acl 3000

remote-address 10.3.3.4

ike-profile R4

#

ipsec policy R 1 isakmp template R3 

ipsec policy R 2 isakmp template R4

#

ike profile R3

keychain R3

match remote identity address 10.2.2.3 255.255.255.255

proposal 1

#

ike profile R4

keychain R4

match remote identity address 10.3.3.4 255.255.255.255

proposal 1

#

 ike proposal 1

# ike keychain R3 pre-shared-key address 10.2.2.3 255.255.255.255 key cipher $c$3$Tfb5ajdHiKDT8yz6AwmOUkd32awdTsMKUg==

# ike keychain R4 pre-shared-key address 10.3.3.4 255.255.255.255 key cipher $c$3$9XURWzVVie6tYeDcksejMPSLMjifkQZhnA== #

R2:

interface GigabitEthernet0/0

port link-mode route

combo enable copper

ip address 10.1.1.2 255.255.255.0

# interface GigabitEthernet0/1

port link-mode route

 ip address 10.2.2.2 255.255.255.0

#

interface GigabitEthernet0/2

port link-mode route

ip address 10.3.3.2 255.255.255.0

#

R3:

interface GigabitEthernet0/0

port link-mode route

combo enable copper

ip address 10.2.2.3 255.255.255.0

ipsec apply policy R

#

interface GigabitEthernet0/1

port link-mode route

combo enable copper

ip address 192.168.2.254 255.255.255.0

#

ip route-static 0.0.0.0 0 10.2.2.2

#

acl advanced 3000

rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

#

ipsec transform-set R1

esp encryption-algorithm des-cbc

esp authentication-algorithm md5

#

ipsec policy-template R1 1

transform-set R1

security acl 3000

remote-address 10.1.1.1

ike-profile R1

#

ipsec policy R 1 isakmp template R1

#

ike profile R1

keychain R1

match remote identity address 10.1.1.1 255.255.255.255

proposal 1

#

ike proposal 1

#

ike keychain R1

pre-shared-key address 10.1.1.1 255.255.255.255 key cipher $c$3$NmhSLv5EFcfcqwuWt1hcTvySA24lws2voA== #

R4：

interface GigabitEthernet0/0

port link-mode route

combo enable copper

ip address 10.3.3.4 255.255.255.0

ipsec apply policy R

#

interface GigabitEthernet0/1

port link-mode route

combo enable copper

ip address 192.168.3.254 255.255.255.0

#

ip route-static 0.0.0.0 0 10.3.3.2

#

acl advanced 3000

rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

#

ipsec transform-set R1

esp encryption-algorithm des-cbc

esp authentication-algorithm md5

#

ipsec policy-template R1 1

transform-set R1

security acl 3000

remote-address 10.1.1.1

ike-profile R1

#

ipsec policy R 1 isakmp template R1

#

ike profile R1

keychain R1

match remote identity address 10.1.1.1 255.255.255.255

proposal 1

#

ike proposal 1

#

ike keychain R1

pre-shared-key address 10.1.1.1 255.255.255.255 key cipher $c$3$XSiYqcoRRvsNR9eza+gdCDXobyGkL//Zeg==