GRE over IPsec野蛮模式配置

大佬麻烦看一下ipsec为啥没起来

R1：

interface LoopBack0 

     ip address 172.16.1.1 255.255.255.255

# 

interface LoopBack1 

     ip address 192.168.1.1 255.255.255.0

#

 ip route-static 192.168.2.0 24 Tunnel0 

# interface GigabitEthernet0/1 

 ip address 1.1.1.1 255.255.255.0 

 ipsec apply policy h3c 

#

interface Tunnel0 mode gre

 ip address 10.1.1.1 255.255.255.0 

 source LoopBack0 

 destination 172.16.1.2 

 keepalive 3 3

#

acl advanced 3000 

 rule 0 permit ip source 172.16.1.1 0 destination 172.16.1.2 0

# ipsec transform-set 1 

 esp encryption-algorithm des-cbc

 esp authentication-algorithm md5 

 # 

ipsec policy h3c 10 isakmp 

 transform-set 1 

 security acl 3000 

 remote-address 2.2.2.1

 ike-profile 1 

# 

 ike identity user-fqdn 

 # 

ike profile 1 

 keychain 1 

 exchange-mode aggressive 

 local-identity user-fqdn r1 

 match remote identity user-fqdn r3

 # 

ike keychain 1 

 pre-shared-key address 2.2.2.1 255.255.255.255 key simple h3c

_________________________________

R3:

interface LoopBack0 

 ip address 172.16.1.2 255.255.255.255 

#

 interface LoopBack1 

 ip address 192.168.2.1 255.255.255.0

#

interface GigabitEthernet0/1 

 ip address 2.2.2.1 255.255.255.0

 ipsec apply policy h3c

#

interface Tunnel0 mode gre 

 ip address 10.1.1.2 255.255.255.0 

 source LoopBack0 

 destination 172.16.1.1

 keepalive 3 3

#

ip route-static 0.0.0.0 0 2.2.2.2

 ip route-static 192.168.1.0 24 Tunnel0

#

ipsec transform-set 1

 esp encryption-algorithm des-cbc 

 esp authentication-algorithm md5 

 #

 ipsec policy-template r1 1 

 transform-set 1 

 ike-profile 1 

#

 ipsec policy h3c 10 isakmp template r1 

#

 ike identity user-fqdn 

 #

 ike profile 1 

 keychain 1 

 exchange-mode aggressive 

 local-identity user-fqdn r3 

 match remote identity user-fqdn r1 

#

 ike keychain 1 pre-shared-key hostname r1 key simple h3c