对接深信服配置IPSec VPN，模式为野蛮模式

VPN隧道建立起来了，但内网网段无法互通。总部公网IP地址是禁ping，82端口开放。ping 总部IP地址，接收的数据包一直为0。

配置如下：

interface GigabitEthernet1/0/3

 port link-mode route

 description GuideWan Interface

 ip address 39.129.130.x 255.255.255.0

 nat outbound 3888

 manage ping inbound

 manage ping outbound

 ipsec apply policy fenzhi

#

interface GigabitEthernet1/0/5

 port link-mode route

 description GuideLan Interface

 ip address 192.168.200.x 255.255.255.252

 undo dhcp select server

#

security-zone name Trust

 import interface GigabitEthernet1/0/0

 import interface GigabitEthernet1/0/5

#

security-zone name Untrust

 import interface GigabitEthernet1/0/3

 import interface Virtual-Template1

#

security-zone name Management

 import interface GigabitEthernet1/0/1

#

 ip route-static 0.0.0.0 0 39.129.130.x

 ip route-static 10.5.x.0 24 192.168.200.x

#

 ssh server enable

#

acl advanced 3888

 rule 0 deny ip source 10.5.0.0 0.0.127.255 destination 10.110.0.0 0.0.3.255

 rule 5 permit ip

#

acl advanced name IPsec_fenzhi_IPv4_1

 rule 0 permit ip source 10.5.0.0 0.0.127.255 destination 10.110.0.0 0.0.3.255

#

ipsec transform-set fenzhi_IPv4_1

 esp encryption-algorithm 3des-cbc 

 esp authentication-algorithm sha1 

#

ipsec policy fenzhi 1 isakmp

 transform-set fenzhi_IPv4_1 

 security acl name IPsec_fenzhi_IPv4_1 

 local-address 39.129.130.x

 remote-address 122.9.x.x

 ike-profile fenzhi_IPv4_1

#

ike profile fenzhi_IPv4_1

 keychain fenzhi_IPv4_1

 dpd interval 5 on-demand

 exchange-mode aggressive

 local-identity fqdn mx

 match remote identity fqdn sx

 match local address GigabitEthernet1/0/3

 proposal 1 

#

ike proposal 1

 encryption-algorithm 3des-cbc

 dh group5

 authentication-algorithm md5

#

ike keychain fenzhi_IPv4_1

 match local address GigabitEthernet1/0/3

 pre-shared-key address 122.9.x.x 255.255.255.255 key simple 12345678

#

security-policy ip

 rule 7 name IPsec_fenzhi_1_20241209160701_IN

  action pass

  source-zone Local

  source-zone Untrust

  destination-zone Local

  destination-zone Untrust

  source-ip-host 39.129.130.x

  source-ip-host 122.9.x.x

  destination-ip-host 39.129.130.x

  destination-ip-host 122.9.x.x

  service ipsec-esp

  service ike

 rule 3 name GuideSecPolicy

  action pass

  source-zone Trust

  source-zone Local

  source-zone Management

  destination-zone Untrust

  destination-zone Local

  destination-zone Trust

  destination-zone Management

  source-ip ipzu

 rule 5 name untr-lo

  action pass

  source-zone Untrust

  destination-zone Local

  service pptp

  service l2tp

 rule 4 name l2tpip

  action pass

  source-zone Untrust

  destination-zone Local

  destination-zone Trust

  destination-ip l2tpipzu

 rule 0 name AUTONET_LOCAL2ANY_DONTMODIFY

  action pass

#