F100-C-G3 IPSEC VPN能够建立但是无法通信

TP-LINK R473 和F100-C-G3建立ipsec vpn ，隧道可以建立 ，但是无法通信，（不是所有的不能通信），R473处于非POE拨号下可以通信，但是处于PPPOE模式下获得公网地址的，不能通信。

正常可以通信的状态(NAT穿越是打开的）：

  -----------------------------

  IPsec policy: JSAS

  Sequence number: 1

  Mode: Template

  -----------------------------

    Tunnel id: 0

    Encapsulation mode: tunnel

    Perfect Forward Secrecy:

    Inside VPN:

    Extended Sequence Numbers enable: N

    Traffic Flow Confidentiality enable: N

    Path MTU: 1436

    Tunnel:

        local  address: 218.95.47.205

        remote address: 111.73.113.230

    Flow:

        sour addr: 10.106.0.0/255.255.0.0  port: 0  protocol: ip

        dest addr: 10.27.218.0/255.255.255.0  port: 0  protocol: ip

    [Inbound ESP SAs]

      SPI: 3940029544 (0xead81468)

      Connection ID: 4294967296

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA duration (kilobytes/sec): 1843200/86400

      SA remaining duration (kilobytes/sec): 1843200/85868

      Max received sequence-number: 0

      Anti-replay check enable: Y

      Anti-replay window size: 1024

      UDP encapsulation used for NAT traversal: Y

      Status: Active

    [Outbound ESP SAs]

      SPI: 3255990874 (0xc2127a5a)

      Connection ID: 12884901889

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA duration (kilobytes/sec): 1843200/86400

      SA remaining duration (kilobytes/sec): 1843200/85868

      Max sent sequence-number: 0

      UDP encapsulation used for NAT traversal: Y

      Status: Active

无法通信的（NAT穿越是关闭的）

  -----------------------------

  IPsec policy: JSAS

  Sequence number: 1

  Mode: Template

  -----------------------------

    Tunnel id: 2

    Encapsulation mode: tunnel

    Perfect Forward Secrecy:

    Inside VPN:

    Extended Sequence Numbers enable: N

    Traffic Flow Confidentiality enable: N

    Path MTU: 1444

    Tunnel:

        local  address: 218.95.47.205

        remote address: 182.96.201.25

    Flow:

        sour addr: 10.106.0.0/255.255.0.0  port: 0  protocol: ip

        dest addr: 10.20.99.0/255.255.255.0  port: 0  protocol: ip

    [Inbound ESP SAs]

      SPI: 1450917191 (0x567b3d47)

      Connection ID: 4294967300

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA duration (kilobytes/sec): 1843200/86400

      SA remaining duration (kilobytes/sec): 1843200/85868

      Max received sequence-number: 0

      Anti-replay check enable: Y

      Anti-replay window size: 1024

      UDP encapsulation used for NAT traversal: N

      Status: Active

    [Outbound ESP SAs]

      SPI: 3373570391 (0xc9149957)

      Connection ID: 4294967301

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA duration (kilobytes/sec): 1843200/86400

      SA remaining duration (kilobytes/sec): 1843200/85868

      Max sent sequence-number: 0

      UDP encapsulation used for NAT traversal: N

      Status: Active

NAT全局 已经剔除感兴趣流量的NAT

nat global-policy

 rule name ipsec

  source-ip 总部

  destination-ip 门店

  source-zone Local

  source-zone Trust

  destination-zone Untrust

  action snat no-nat

object-group ip address 门店

 security-zone Untrust

 0 network subnet 10.27.0.0 255.255.0.0

 10 network subnet 10.20.99.0 255.255.255.0

#

object-group ip address 总部

 security-zone Trust

 0 network subnet 10.106.0.0 255.255.0.0

F100-C-G3 处于中心，采用 IPSEC 中心模式， R473处于门店 采用IPSEC 发起模式，无法单独选择谁开启NAT穿越 谁不开启。