模拟器中的 IPsc VPN不通

我有2个网络，leftside和rightside模拟2个分公司，他们的FW都接入internet

leftside内网地址是10.1.0.0/16

我想用ipsec vpn对两台FW做VPN，但始终不成功，关键配置如下

JQ-FW的配置开始：

interface GigabitEthernet 0/2
port link-mode route
description BusinessWan interface
bandwidth 50000
ip address 100.1.1.2 255.255.255.0
nat outbound 3000
ipsec apply policy to_right

acl advanced 3000
rule 10 deny ip source 10.1.0.0 0.0.255.255 destination 10.2.0.0 0.0.255.255
rule 40 deny ip source 10.1.0.0 0.0.255.255
rule 90 permit ip

ipsec policy to_right 65535 isakmp
transform-set tsn_to_right
security acl name san_to_right
local-address 100.1.1.2
remote-address 100.1.2.2
ike-profile ipn_to_right
sa duration time-based 28800
sa duration traffic-based 1843200

ipsec transform-set tsn_to_right
esp encryption-algorithm 3des-cbc
esp authentication-algorithm md5

acl advanced name san_to_right
rule 0 permit ip source 10.1.0.0 0.0.255.255 destination 10.2.0.0 0.0.255.255

ike profile ipn_to_right
keychain ikn_to_right
exchange-mode aggressive
local-identity fqdn leftside
match remote identity fqdn rightside
match local address GigabitEthernet 0/2
proposal 65535

ike keychain ikn_to_right
match local address GigabitEthernet 0/2
pre-shared-key hostname rightside key simple 123456

ike proposal 65535
encryption-algorithm 3des-cbc
dh group2

JQ-FW的配置结束

NH-FW的配置开始：

interface GigabitEthernet 0/2
port link-mode route
description BusinessWan interface
bandwidth 50000
ip address 100.1.2.2 255.255.255.0
nat outbound 3000
ipsec apply policy to_left

acl advanced 3000
rule 10 deny ip source 10.2.0.0 0.0.255.255 destination 10.1.0.0 0.0.255.255
rule 40 deny ip source 10.2.0.0 0.0.255.255
rule 90 permit ip

ipsec policy to_left 65535 isakmp
transform-set tsn_to_left
security acl name san_to_left
local-address 100.1.2.2
remote-address 100.1.1.2
ike-profile ipn_to_left
sa duration time-based 28800
sa duration traffic-based 1843200

ipsec transform-set tsn_to_left
esp encryption-algorithm 3des-cbc
esp authentication-algorithm md5

acl advanced name san_to_left
rule 0 permit ip source 10.2.0.0 0.0.255.255 destination 10.1.0.0 0.0.255.255

ike profile ipn_to_left
keychain ikn_to_left
exchange-mode aggressive
local-identity fqdn rightside
match remote identity fqdn leftside
match local address GigabitEthernet 0/2
proposal 65535

ike keychain ikn_to_left
match local address GigabitEthernet 0/2
pre-shared-key hostname leftside key simple 123456

ike proposal 65535
encryption-algorithm 3des-cbc
dh group2

NH-FW的配置结束