用两个ipsec vpn设备建立连接

总部选择内网下的一台ipsec 设备 ，通过一对一nat到出口，分部是直接ipsec vpn设备做出口，第一阶段都没起来。

总部的关键配置

#

ipsec transform-set 1

 esp encryption-algorithm aes-cbc-128

 esp authentication-algorithm md5

#

ipsec policy ipsec 10 isakmp

 transform-set 1

 security acl 3000

 local-address 192.168.1.2

 remote-address 116.125.42.175

 ike-profile 1

#             

#

ike profile 1

 keychain 1

 local-identity address 192.168.1.2

 match remote identity address 116.125.42.175 255.255.255.248

 proposal 1

#

#

ike proposal 1

 encryption-algorithm aes-cbc-128

 dh group2

 authentication-algorithm md5

 sa duration 28800

#

ike keychain 1

 pre-shared-key address  116.125.42.175   255.255.255.248 key cipher $c$3$ZJNhCVXgMqvK9H6IJSVa+hg4rf/4Nw98lTzbcOOOkw==

分部的关键配置

ipsec transform-set 1

 esp encryption-algorithm aes-cbc-128

 esp authentication-algorithm md5

#

ipsec policy 1 1 isakmp

 transform-set 1

 security acl 3000

 local-address 116.125.42.175

 remote-address 122.220.148.219

 ike-profile 1

#

#

ike profile 1

 keychain 1

 local-identity address 116.125.42.175

 match remote identity address   122.220.148.219     255.255.255.248

 proposal 1   

#

#

ike proposal 1

 encryption-algorithm aes-cbc-128

 dh group2

 authentication-algorithm md5

 sa duration 28800

#

ike keychain 1

 pre-shared-key address 122.220.148.219 255.255.255.248 key cipher $c$3$K4ahHqi03wlc7GIjY2uZcl8DSWg7eJz6+3qcKFV9Og==

#

因为说v7版本是自适应的，所以就直接没在意那个nat，可以用正常那个的ipsec 主模式。不过结果第一阶段都起不来，兄弟们帮忙看看？