两台MSR3620组建ipsec vpn建立不起来

如图所示，使用HCL做MSR3620 ipsec vpn的实验，总部和分部之间ipsec建立不起来，开启debug也看不到任何告警信息！

总部配置：

<ZYY_R3>dis curr

#

version 7.1.064, Release 0821P11

#

sysname ZYY_R3

#

system-working-mode standard xbar load-single password-recovery enable lpu-type f-series

#

vlan 1

#

interface NULL0

#

interface GigabitEthernet0/0

port link-mode route

combo enable copper

ip address 10.27.247.1 255.255.255.0

#

interface GigabitEthernet0/1

port link-mode route

combo enable copper

ip address 218.28.x.x 255.255.255.252

nat outbound 2000

ipsec apply policy map1

#

interface GigabitEthernet0/2

port link-mode route

combo enable copper

#

scheduler logfile size 16

#

ip route-static 0.0.0.0 0 218.28.x.x

ip route-static 10.24.1.0 24 10.27.247.2

#

acl number 2000

rule 0 permit source 10.24.1.0 0.0.0.255

rule 5 permit source 10.27.247.0 0.0.0.255

#

acl advanced 3101

rule 0 permit ip source 10.24.1.0 0.0.0.255 destination 10.25.254.0 0.0.0.255

#

domain system

#

domain default enable system

#

user-group system

#

ipsec logging packet enable

#

ipsec transform-set tran1

esp encryption-algorithm des-cbc

esp authentication-algorithm sha1

#

ipsec policy map1 10 isakmp

transform-set tran1

security acl 3101

local-address 218.28.x.x

remote-address 125.46.x.x

ike-profile profile1

#

ike profile profile1

keychain keychain1

local-identity address 218.28.x.x

match remote identity address 125.46.x.x 255.255.255.252

#

ike keychain keychain1

pre-shared-key address 125.46.x.x 255.255.255.252 key cipher $c$3$OVa4cGTU49+OY4RB+FIi/dKHmWgJyqH7lc0=

#

return

<ZYY_R3>

分部配置：

<QinYang>dis curr

#

version 7.1.064, Release 0821P11

#

sysname QinYang

#

system-working-mode standard xbar load-single password-recovery enable lpu-type f-series

#

vlan 1

#

interface NULL0

#

interface GigabitEthernet0/0

port link-mode route

combo enable copper

ip address 125.46.x.x 255.255.255.252

nat outbound 2000

ipsec apply policy use1

#

interface GigabitEthernet0/1

port link-mode route

combo enable copper

ip address 10.25.254.1 255.255.255.0

#

interface GigabitEthernet0/2

port link-mode route

combo enable copper

ip address 192.168.3.10 255.255.255.0

#

scheduler logfile size 16

#

ip route-static 0.0.0.0 0 125.46.x.x

#

acl number 2000

rule 0 permit source 10.25.254.0 0.0.0.255

#

acl advanced 3101

rule 0 permit ip source 10.25.254.0 0.0.0.255 destination 10.24.1.0 0.0.0.255

#

domain system

#

domain default enable system

#

user-group system

#

ipsec transform-set tran1

esp encryption-algorithm des-cbc

esp authentication-algorithm sha1

#

ipsec policy use1 10 isakmp

transform-set tran1

security acl 3101

local-address 125.46.x.x

remote-address 218.28.x.x

ike-profile profile1

#

ike profile profile1

keychain keychain1

local-identity address 125.46.x.x

match remote identity address 218.28.x.x 255.255.255.252

#

ike keychain keychain1

pre-shared-key address 218.28.x.x 255.255.255.252 key cipher $c$3$aOH18DGzJ+PFJbN7b1LfDkX/7PeXmC4uiu0=

#

return

<QinYang>