msr3610+VPN连不上，外网正常。

# version 7.1.064, Release 0615P15 

# sysname H3C 

# clock timezone Beijing add 08:00:00 clock protocol none 

# telnet server enable 

# dhcp enable dhcp server always-broadcast 

# dns proxy enable 

# password-recovery enable 

# vlan 1 

# vlan 10 

# dhcp server ip-pool lan1 

 gateway-list 192.168.238.1 

 network 192.168.238.0 mask 255.255.255.128 

 address range 192.168.238.2 192.168.238.126 

 dns-list 202.96.64.68 202.96.69.38 

# controller Cellular0/0 

# interface Virtual-Template0 

# interface NULL0 

# interface GigabitEthernet0/0 port link-mode route ip address 192.168.238.1 255.255.255.128 tcp mss 1280 

# interface GigabitEthernet0/1 port link-mode route 

# interface GigabitEthernet0/2 port link-mode route combo enable copper 

# interface GigabitEthernet0/3 

 port link-mode route 

 description Multiple_Line 

 bandwidth 100000 

 combo enable copper 

 ip address 42.176.179.45 255.255.255.0 

 dns server 202.96.64.68 

 dns server 202.96.69.38 

 nat outbound 

 ipsec apply policy DIDI 

# interface GigabitEthernet0/4 

 port link-mode route 

# interface GigabitEthernet0/5 

 port link-mode route

 # security-zone name Local 

# security-zone name Trust 

# security-zone name DMZ 

# security-zone name Untrust 

# security-zone name Management 

# scheduler logfile size 16 

# line class console user-role network-admin 

# line class tty user-role network-operator 

# line class usb user-role network-admin 

# line class vty user-role network-operator 

# line con 0 user-role network-admin 

# line vty 0 63 authentication-mode scheme user-role network-operator 

# ip route-static 0.0.0.0 0 GigabitEthernet0/3 42.176.179.1 

# ssh server enable sftp server enable scp server enable

# acl advanced 3999 

 rule 0 permit ip source 192.168.238.0 0.0.0.127 destination 10.91.130.0 0.0.0.255 

 rule 5 permit ip source 192.168.238.0 0.0.0.127 destination 10.91.131.0 0.0.0.255 

rule 10 permit ip source 192.168.238.0 0.0.0.127 destination 10.91.132.0 0.0.0.255  

rule 15 permit ip source 192.168.238.0 0.0.0.127 destination 10.91.133.0 0.0.0.255  

rule 20 permit ip source 192.168.238.0 0.0.0.127 destination 10.91.134.0 0.0.0.255  

rule 25 permit ip source 192.168.238.0 0.0.0.127 destination 10.85.128.0 0.0.0.255 

# password-control enable 

 undo password-control aging enable 

 undo password-control history enable 

 password-control length 6 

 password-control login-attempt 3 exceed lock-time 10 

 password-control update-interval 0 

 password-control login idle-time 0 

 password-control complexity user-name check 

# domain system 

# domain default enable system 

# role name level-0 description Predefined level-0 role 

# role name level-1 description Predefined level-1 role

 # role name level-2 description Predefined level-2 role 

# role name level-3 description Predefined level-3 role 

# role name level-4 description Predefined level-4 role 

# role name level-5 description Predefined level-5 role 

# role name level-6 description Predefined level-6 role 

# role name level-7 description Predefined level-7 role 

# role name level-8 description Predefined level-8 role 

# role name level-9 description Predefined level-9 role 

# role name level-10 description Predefined level-10 role 

# role name level-11 description Predefined level-11 role 

# role name level-12 description Predefined level-12 role 

# role name level-13 description Predefined level-13 role 

# role name level-14 description Predefined level-14 role 

# user-group system 

# local-user admin class manage service-type ssh telnet terminal http https 

 authorization-attribute user-role network-admin 

# ipsec transform-set DIDI 

 esp encryption-algorithm 3des-cbc 

 esp authentication-algorithm sha1 pfs dh-group2 

# ipsec policy DIDI 65535 isakmp 

 transform-set DIDI 

 security acl 3999 

 remote-address 114.247.106.82 

 ike-profile DIDI 

 sa duration time-based 3600 

 sa duration traffic-based 1843200 

# ike profile DIDI 

 keychain DIDI 

 dpd interval 10 on-demand 

 local-identity address 42.176.179.45 

 match remote identity address 114.247.106.82 255.255.255.255 

 proposal 65535 

# ike proposal 65535 encryption-algorithm 3des-cbc 

 dh group2 

# ike keychain DIDI 

pre-shared-key address 114.247.106.82 255.255.255.255 key cipher $c$3$vd4S9WVnSj6nn6n5BtmMFv4a/2r0DO0srd4L1g== 

# ip http enable 

# wlan global-configuration 

# wlan ap-group default-group 

# cloud-management server domain oasis.h3c.com 

# 

return