一端有公网一端无公网ipsec组网

可以，参考案例

https://zhiliao.h3c.com/Theme/details/45582

没公网 不行（pppoe可以）

ipv6也可以 但是都没 肯定是不行的（可以问运营商开通 企业用的话必须要有公网的）

可以的兄弟，用野蛮模式

自用建立三条ipsec 举例。你可以参考一下。

bject-group ip addres vpnip
network subnet 192.168.86.0 255.255.255.0
network subnet 192.168.91.0 255.255.255.0
network subnet 192.168.95.0 255.255.255.0
#
acl adv name acldenyvpn
rule 1010 deny ip destination object-group vpnip
rule 1010 comment 拒绝访问VPNip地址从静态IP出去
rule 2000 permit ip
#
acl advanced 3100
rule 1 permit ip source 192.168.88.0 0.0.0.255 destination 192.168.91.0 0.0.0.255
rule 2 permit ip source 192.168.72.0 0.0.0.255 destination 192.168.91.0 0.0.0.255

#
acl advanced 3102
rule 2 permit ip source 192.168.88.0 0.0.0.255 destination 192.168.95.0 0.0.0.255
#
acl advanced 3104
rule 2 permit ip source 192.168.88.0 0.0.0.255 destination 192.168.86.0 0.0.0.255
#
ipsec transform-set 1
esp encryption-algorithm aes-cbc-256
esp authentication-algorithm sha1
pfs dh-group14
#
ipsec policy-template hb 1
transform-set 1
security acl 3100
ike-profile hb
sa duration time-based 3600
sa duration traffic-based 3200
#
ipsec policy-template hb1 1
transform-set 1
security acl 3104
ike-profile hb1
sa duration time-based 3600
sa duration traffic-based 3200
#
ipsec policy-template yrp 1
transform-set 1
security acl 3102
ike-profile yrp
sa duration time-based 3600
sa duration traffic-based 3200
ipsec policy zb 2 isakmp template yrp
#
ipsec policy zb 3 isakmp template hb
#
ipsec policy zb 5 isakmp template hb1
#
ike identity fqdn zb
#
ike profile hb
keychain hb
dpd interval 30 on-demand
exchange-mode aggressive
local-identity fqdn zteZPkgslJH9d4pn10iKjByXWfqoQ2rC
match remote identity fqdn q2Ju6yVQiKxRX09Tv1tZEzLAHC3eSWs4
proposal 1
#
ike profile hb1
keychain hb1
dpd interval 30 on-demand
exchange-mode aggressive
local-identity fqdn kPRXzw6nBCfUdjsYaeSIy2VvG53FEM4c
match remote identity fqdn be0q2zKLJhi76kDrUXgOaAENY5BCo84m
proposal 1
#
ike profile yrp
keychain yrp
dpd interval 30 on-demand
exchange-mode aggressive
local-identity fqdn oFt2AJBeHIPUb86Qzcw1CSjTlduaqXvK
match remote identity fqdn cN0xhq2EL8oYQPtg3arMk7GAU6KfsZX1
match remote identity fqdn cN0xhq2EL8oYQPtg3arMk7GAU6KfsZX
proposal 1
#
ike proposal 1
encryption-algorithm aes-cbc-256
dh group14
#
ike keychain hb
pre-shared-key address 0.0.0.0 0.0.0.0 key cipher xxxxxx
#
ike keychain hb1
pre-shared-key address 0.0.0.0 0.0.0.0 key cipher xxxxxx
#
ike keychain yrp
pre-shared-key address 0.0.0.0 0.0.0.0 key cipher xxxxxx
#
int gi0/3
ipsec apply policy zb
ipsec no-nat-process enable
nat outbound name acldenyvpn
undo nat outbound


acl advanced name acllinkdataapply
rule 1012 deny ip destination object-group vpnip
rule comm 需要相应路由规则中加禁止VPNIP通过，在固态IP端口，如果有多个路由都需要在相应的规则上禁止，否刚可能是断是续