IPSEC VPN联动NQA不生效

实验环境，配置完IPSEC VPN和NQA后，关掉一个设备端口，不会进行自动切换线路

#

 version 7.1.064, Release 0427P22

#

 sysname R1

#

track 1 nqa entry nwhw nwhw reaction 1

#

 system-working-mode standard

 xbar load-single

 password-recovery enable

 lpu-type f-series

#

vlan 1

#

nqa entry nwhw nwhw

 type icmp-echo

  destination ip 3.3.3.2

  frequency 5

  next-hop ip 2.2.2.2

  reaction 1 checked-element probe-fail threshold-type consecutive 5 action-type trap-only

  source ip 2.2.2.1

#

 nqa schedule nwhw nwhw start-time now lifetime forever

#

interface Serial1/0

#

interface Serial2/0

#

interface Serial3/0

#

interface Serial4/0

#

interface NULL0

#

interface GigabitEthernet0/0

 port link-mode route

 combo enable copper

 ip address 1.1.1.2 255.255.255.0

#

interface GigabitEthernet0/1

 port link-mode route

 combo enable copper

 shutdown

 ip address 2.2.2.1 255.255.255.0

 ipsec apply policy policy1

#

interface GigabitEthernet0/2

 port link-mode route

 combo enable copper

 ip address 5.5.5.1 255.255.255.0

 ipsec apply policy policy2

#

interface GigabitEthernet5/0

 port link-mode route

 combo enable copper

#

interface GigabitEthernet5/1

 port link-mode route

 combo enable copper

#

interface GigabitEthernet6/0

 port link-mode route

 combo enable copper

#

interface GigabitEthernet6/1

 port link-mode route

 combo enable copper

#

 scheduler logfile size 16

#

line class aux

 user-role network-operator

#

line class console

 user-role network-admin

#

line class tty

 user-role network-operator

#

line class vty

 user-role network-operator

#

line aux 0

 user-role network-operator

#

line con 0

 user-role network-admin

#

line vty 0 63

 user-role network-operator

#

 ip route-static 3.3.3.0 24 2.2.2.2 track 1

 ip route-static 4.4.4.0 24 2.2.2.2 track 1

 ip route-static 4.4.4.0 24 5.5.5.2 preference 80

 ip route-static 6.6.6.0 24 5.5.5.2 preference 80

#

acl advanced 3000

 rule 100 permit ip source 1.1.1.0 0.0.0.255 destination 4.4.4.0 0.0.0.255

#

domain system

#

 domain default enable system

#

role name level-0

 description Predefined level-0 role

#

role name level-1

 description Predefined level-1 role

#

role name level-2

 description Predefined level-2 role

#

role name level-3

 description Predefined level-3 role

#

role name level-4

 description Predefined level-4 role

#

role name level-5

 description Predefined level-5 role

#

role name level-6

 description Predefined level-6 role

#

role name level-7

 description Predefined level-7 role

#

role name level-8

 description Predefined level-8 role

#

role name level-9

 description Predefined level-9 role

#

role name level-10

 description Predefined level-10 role

#

role name level-11

 description Predefined level-11 role

#

role name level-12

 description Predefined level-12 role

#

role name level-13

 description Predefined level-13 role

#

role name level-14

 description Predefined level-14 role

#

user-group system

#

ipsec transform-set tran1

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm sha1

#

ipsec policy policy1 10 isakmp

 transform-set tran1

 security acl 3000

 remote-address 3.3.3.2

 ike-profile profile1

#

ipsec policy policy2 20 isakmp

 transform-set tran1

 security acl 3000

 remote-address 6.6.6.2

 ike-profile profile2

#

ike profile profile1

 keychain key1

 local-identity address 2.2.2.1

 match remote identity address 3.3.3.2 255.255.255.255

#

ike profile profile2

 keychain key2

 local-identity address 5.5.5.1

 match remote identity address 6.6.6.2 255.255.255.255

#

ike keychain key1

 pre-shared-key address 3.3.3.2 255.255.255.255 key cipher $c$3$el5frUUSVQ5UCpLmw44//dQJy/L2Kuj65Q==

#

ike keychain key2

 pre-shared-key address 6.6.6.2 255.255.255.255 key cipher $c$3$l5SADAMSrcSwB9h8TWz1wHeGehvVZOUmSA==

#

return