IPSec over Gre

配置如下：

MSR1

interface GigabitEthernet0/0
 port link-mode route
 combo enable copper
 ip address 192.168.1.1 255.255.255.0
#
interface GigabitEthernet0/1
 port link-mode route
 combo enable copper
 ip address 202.115.22.48 255.255.255.0
#
interface Tunnel0 mode gre
 ip address 10.1.1.1 255.255.255.0
 source 202.115.22.48
 destination 202.115.24.50
 ipsec apply policy r1
#
#
 ip route-static 192.168.2.0 24 Tunnel0
#
acl advanced 3000
 rule 0 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255
#
#
ipsec transform-set r1
 esp encryption-algorithm des-cbc
 esp authentication-algorithm md5
#
ipsec policy r1 1 isakmp
 transform-set r1
 security acl 3000
 remote-address 10.1.1.2
#
ike proposal 1
#
ike keychain r1
 pre-shared-key address 10.1.1.2 255.255.255.0 key cipher $c$3$lE9zBv6CxVx6Xu+ulMfYMJ3f9wj0HA==
#
MSR3

#
interface GigabitEthernet0/0
 port link-mode route
 combo enable copper
 ip address 202.115.24.50 255.255.255.0
#
interface GigabitEthernet0/1
 port link-mode route
 combo enable copper
 ip address 192.168.2.1 255.255.255.0
#

interface Tunnel0 mode gre
 ip address 10.1.1.2 255.255.255.0
 source 202.115.24.50
 destination 202.115.22.48
 ipsec apply policy r3

#
 ip route-static 192.168.1.0 24 Tunnel0
#
acl advanced 3000
 rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255
#
#
ipsec transform-set r3
 esp encryption-algorithm des-cbc
 esp authentication-algorithm md5
#
ipsec policy r3 1 isakmp
 transform-set r3
 security acl 3000
 remote-address 10.1.1.1
#
ike proposal 1
#
ike keychain r3
 pre-shared-key address 10.1.1.1 255.255.255.0 key cipher $c$3$NaadwuD8WcfsfsoKCrCANi3frGku8Q==
#
return

为什么tun口up不了。