ER3260与AR120建立IPSEC

总部ER3260 固定IP，分支是AR120 pppoe拨号上网。总部与分支之间无法建IPSEC VPN。不知道我配置对不对。跪求大神帮忙。

[SZ-BG-HX-R-AR120-01-acl-adv-ju-vpn]dis ike sa
    Conn-ID  Peer            VPN   Flag(s)                Phase 
  ---------------------------------------------------------------
     2751    0.0.0.0         0                            1    

  Flag Description:
  RD--READY   ST--STAYALIVE   RL--REPLACED   FD--FADING   TO--TIMEOUT
  HRT--HEARTBEAT   LKG--LAST KNOWN GOOD SEQ NO.   BCK--BACKED UP

AR120的配置：

acl name ju-vpn 3999  
 rule 10 permit ip destination 192.168.21.0 0.0.0.255
#
ipsec proposal Ju-vpn10
 esp authentication-algorithm sha1
 esp encryption-algorithm aes-256
#
ike proposal 1
 encryption-algorithm aes-cbc-256
 dh group2
 authentication-algorithm sha1
 prf hmac-sha2-256
#
ike peer ju-vpn-sh v1
 exchange-mode aggressive
 pre-shared-key simple 123456
 ike-proposal 1
 remote-name shanghai
 local-id shenzhen
 remote-address x.x.x.x

#
ipsec policy Ju-vpn 10 isakmp
 security acl 3999
 ike-peer ju-vpn-sh
 proposal Ju-vpn10
 sa trigger-mode traffic-based
 route inject dynamic

3260配置：