苹果iOS自带VPN连接报错

火墙配置了L2TP over IPSec方式，PC客户端（对应ike profile ycjr）使用正常。苹果iOS系统自带VPN类型IPSec连接时报错。

IKE/6/IKE_P1_SA_ESTABLISH_FAIL: -COntext=1; Failed to establish phase 1  SA in Aggressive mode IKE_P1_STATE_INIT state.

Reason: No acceptable transform.

SA information:

Role: responder

Local IP: 1.1.1.1

Local ID type: Unknown

Local ID: 

Local port: 500

Retransmissions: 0

Remote IP: 2.2.2.2

Remote ID type: USER_FQDN

Remote ID: apple

Remote port: 500

Recived retransmissions: 0

Inside VPN instance: 

Outside VPN instance: 

Initiator COOKIE: b6e03dfecc462290

Responder COOKIE: 5ab06e72c57f67a3

Connection ID: 11617

Tunnel ID: 4294967295

IKE profile name: 

设备相关配置

【ike密钥】

ike keychain ycjr

 pre-shared-key address 0.0.0.0 0.0.0.0 key simple xxx

#

【ike配置】

#

ike profile ycjr

 keychain ycjr

 exchange-mode aggressive

 local-identity fqdn LNS

 match remote identity address 0.0.0.0 0.0.0.0

 match remote identity fqdn LAC

 proposal 1 2 3 4 5 6 

#

#

ike profile ycjr-apple

 keychain ycjr

 exchange-mode aggressive

 match remote identity address 0.0.0.0 0.0.0.0

 match remote identity fqdn apple

 proposal 1 2 3 4 5 6 

 client-authentication xauth

【ipsec策略模板】

#

ipsec policy-template ycjr 1

 transform-set 7 

 description YCJR-PC

 ike-profile ycjr

#

ipsec policy-template ycjr 2

 transform-set 1 2 3 4 5 6 

 description YCJR-APPLE

 ike-profile ycjr-apple

#

【ike proposal】

 Priority Authentication Authentication Encryption  Diffie-Hellman Duration

              method       algorithm    algorithm       group      (seconds)

----------------------------------------------------------------------------

 1        PRE-SHARED-KEY     MD5        AES-CBC-128 Group 2        86400    

 2        PRE-SHARED-KEY     MD5        3DES-CBC    Group 2        86400    

 3        PRE-SHARED-KEY     SHA1       3DES-CBC    Group 2        86400    

 4        PRE-SHARED-KEY     SHA1       AES-CBC-256 Group 2        86400    

 5        PRE-SHARED-KEY     SHA1       DES-CBC     Group 2        86400    

 6        PRE-SHARED-KEY     SHA1       AES-CBC-192 Group 2        86400    

 default  PRE-SHARED-KEY     SHA1       DES-CBC     Group 1        86400   

【ipsec加密算法】

#

ipsec transform-set 1

 encapsulation-mode transport

 esp encryption-algorithm 3des-cbc 

 esp authentication-algorithm md5 

#

ipsec transform-set 2

 encapsulation-mode transport

 esp encryption-algorithm aes-cbc-128 

 esp authentication-algorithm sha1 

#

ipsec transform-set 3

 encapsulation-mode transport

 esp encryption-algorithm aes-cbc-256 

 esp authentication-algorithm sha1 

#

ipsec transform-set 4

 encapsulation-mode transport

 esp encryption-algorithm des-cbc 

 esp authentication-algorithm sha1 

#

ipsec transform-set 5

 encapsulation-mode transport

 esp encryption-algorithm 3des-cbc 

 esp authentication-algorithm sha1 

#

ipsec transform-set 6

 encapsulation-mode transport

 esp encryption-algorithm aes-cbc-192 

 esp authentication-algorithm sha1 

#

ipsec transform-set 7

 esp encryption-algorithm aes-cbc-256 

 esp authentication-algorithm sha1 

#

H3C Comware Software, Version 7.1.064, Release 9660P29

Copyright (c) 2004-2022 New H3C Technologies Co., Ltd. All rights reserved.

H3C SecPath F5000-AI-20