模拟器+两台路由器建立ipsec，无法协商

两台路由器route1和route3建立ipsec vpn。

配置完成后协商不起来。是不是配置有问题。

route-1 ping route-3是通的。

route-1 上行口 1.1.1.2/30   loopback 10.0.0.1/32

route-3  上行口 2.2.2.2/30  loopback  10.0.0.2/32

route-2只作为三成转发

route-1:

[1.1.1.2]display ipsec sa

[1.1.1.2]

[1.1.1.2]display  current-configuration

#

 version 7.1.064, Release 0427P22

#

 sysname 1.1.1.2

#

 

interface LoopBack1

 ip address 10.0.0.1 255.255.255.255

#

 

interface GigabitEthernet0/1

 port link-mode route

 combo enable copper

 ip address 1.1.1.2 255.255.255.252

 ipsec apply policy map1

#

 

 ip route-static 2.2.2.2 32 1.1.1.1

 ip route-static 10.0.0.2 32 1.1.1.1

#

acl advanced 3000

 rule 0 permit ip source 10.0.0.1 0 destination 10.0.0.2 0

#

 

ipsec transform-set tran1

 esp encryption-algorithm aes-cbc-128

 esp authentication-algorithm sha1

#

ipsec policy map1 1 isakmp

 transform-set tran1

 security acl 3000

 local-address 1.1.1.2

 remote-address 2.2.2.2

 ike-profile profile1

#

ike profile profile1

 keychain key1

 match remote identity address 2.2.2.2 255.255.255.252

#

ike keychain key1

 pre-shared-key address 2.2.2.2 255.255.255.252 key cipher $c$3$SccfIhz8UEm5dNbm0xMXYhy6G2aovw==

#

return

[1.1.1.2]

 

 

 

route-3

<2.2.2.2>

<2.2.2.2>display ipsec sa

<2.2.2.2>

<2.2.2.2>display current-configuration

#

 version 7.1.064, Release 0427P22

#

 sysname 2.2.2.2

#

 

interface LoopBack1

 ip address 10.0.0.2 255.255.255.255

#

 

interface GigabitEthernet0/1

 port link-mode route

 combo enable copper

 ip address 2.2.2.2 255.255.255.252

 ipsec apply policy use1

#

 

 ip route-static 1.1.1.2 32 2.2.2.1

 ip route-static 10.0.0.1 32 2.2.2.1

#

acl advanced 3000

 rule 0 permit ip source 10.0.0.2 0 destination 10.0.0.1 0

#

 

ipsec transform-set tran1

 esp encryption-algorithm aes-cbc-128

 esp authentication-algorithm sha1

#

ipsec policy use1 1 isakmp

 transform-set tran1

 security acl 3000

 local-address 2.2.2.2

 remote-address 1.1.1.2

 ike-profile profile1

#

ike profile profile1

 keychain key1

 match remote identity address 1.1.1.2 255.255.255.252

#

ike keychain key1

 pre-shared-key address 1.1.1.2 255.255.255.252 key cipher $c$3$7xmCmphkh+pNrIJ6NyMwwxrrBFJ7dA==

#

return

<2.2.2.2>