ipsec sa 未建立

r2 ，r3 两端通过建立gre隧道通信，r2下方连接交换机，vlan11 处于vrf中，r3以通过gre隧道获取vlan11地址，

ike sa建立，ipsec sa未建立，未在端口调用ipsec前, ping -a 10.3.0.10 10.1.1.1可以ping通，调用ipsec之后不能访问，

r3 ipsec配置:

ipsec transform-set myset

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm md5

#

ipsec policy mymap 1 isakmp

 transform-set myset

 security acl 3000

 local-address 172.17.0.3

 remote-address 172.17.0.2

 ike-profile 1

#

ike profile 1

 keychain 1

 local-identity address 172.17.0.3

 match remote identity address 172.17.0.2 255.255.255.0

 proposal 1

#

ike proposal 1

 encryption-algorithm 3des-cbc

 authentication-algorithm md5

#

ike keychain 1

 pre-shared-key address 172.17.0.2 255.255.255.0 key simple Test@123

r2 ipsec 配置:

ipsec transform-set myset

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm md5

#

ipsec policy mymap 1 isakmp

 transform-set myset

 security acl 3000

 local-address 172.17.0.2

 remote-address 172.17.0.3

 ike-profile 1

#

ike profile 1

 keychain 1

 local-identity address 172.17.0.2

 match remote identity address 172.17.0.3 255.255.255.0 vpn-instance SC

 proposal 1

 inside-vpn vpn-instance SC

#

ike proposal 1

 encryption-algorithm 3des-cbc

 authentication-algorithm md5

#

ike keychain 1 vpn-instance SC

 pre-shared-key address 172.17.0.3 255.255.255.0 key simple Test@123