ike sa 和ipsec sa都有，业务不通

【总部野蛮模式对接多分支 ipsec组网，隧道完成后，其中一个站点业务ip172.17.95.101访问总部192.168.4.224不通，在建立ipsec隧道的设备上配测试ip：222.1.1.1访问总部业务192.168.4.224可以通】                         求大神解惑！！！！！！！！

总部侧互联网出口下nat outbound acl 3110 和总部侧dis ipsec sa 如下：

Advanced IPv4 ACL 3110, 17 rules,

dianxin

ACL's step is 5

 rule 10 deny ip source 192.168.4.224 0 destination 172.17.95.101 0

 rule 20 deny ip source 192.168.4.224 0 destination 182.138.28.200 0

 rule 30 deny ip source 192.168.4.224 0 destination 172.20.101.112 0 (57 times matched)

 rule 40 deny ip source 192.168.4.224 0 destination 172.17.0.101 0

 rule 50 deny ip source 192.168.4.224 0 destination 172.17.70.101 0

 rule 60 deny ip source 192.168.4.224 0 destination 172.16.71.101 0

 rule 70 deny ip source 192.168.4.224 0 destination 172.16.72.101 0

 rule 80 deny ip source 192.168.4.1 0 destination 172.17.95.101 0

 rule 90 deny ip source 192.168.4.1 0 destination 182.138.28.200 0

 rule 100 deny ip source 192.168.4.1 0 destination 172.20.101.112 0

 rule 110 deny ip source 192.168.4.1 0 destination 172.17.0.101 0

 rule 120 deny ip source 192.168.4.1 0 destination 172.17.70.101 0

 rule 130 deny ip source 192.168.4.1 0 destination 172.16.71.101 0

 rule 140 deny ip source 192.168.4.1 0 destination 172.16.72.101 0

 rule 150 deny ip source 192.168.4.1 0 destination 182.138.28.1 0

 rule 160 deny ip source 192.168.4.224 0 destination 182.138.80.56 0

 rule 1000 permit ip (9957730 times matched)

 

<>display  ipsec sa remote 116.115.107.222

-------------------------------

Interface: Ten-GigabitEthernet7/1/7

-------------------------------

 

  -----------------------------

  IPsec policy: 1

  Sequence number: 1

  Mode: Template

  Flow table status: Active

  -----------------------------

    Tunnel id: 4

    Encapsulation mode: tunnel

    Perfect Forward Secrecy: 

    Inside VPN: 

    Extended Sequence Numbers enable: N

    Traffic Flow Confidentiality enable: N

    Transmitting entity: Responder

    Path MTU: 1444

    Tunnel:

        local  address: 1.180.81.254

        remote address: 116.115.107.222

    Flow:

        sour addr: 192.168.4.224/255.255.255.255  port: 0  protocol: ip

        dest addr: 222.1.1.1/255.255.255.255  port: 0  protocol: ip

 

    [Inbound ESP SAs]

      SPI: 1049243898 (0x3e8a30fa)

      Connection ID: 416611827713

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA idle time: 86400

      SA duration (kilobytes/sec): 1843200/3600

      SA remaining duration (kilobytes/sec): 1843199/3549

      Max received sequence-number: 0

      Anti-replay check enable: N

      Anti-replay window size: 

      UDP encapsulation used for NAT traversal: N

      Status: Active

 

    [Outbound ESP SAs]

      SPI: 4046920036 (0xf1371964)

      Connection ID: 313532612615

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA idle time: 86400

      SA duration (kilobytes/sec): 1843200/3600

      SA remaining duration (kilobytes/sec): 1843199/3549

      Max sent sequence-number: 9

      UDP encapsulation used for NAT traversal: N

      Status: Active

 

  -----------------------------

  IPsec policy: 1

  Sequence number: 1

  Mode: Template

  Flow table status: Active

  -----------------------------

    Tunnel id: 2

    Encapsulation mode: tunnel

    Perfect Forward Secrecy: 

    Inside VPN: 

    Extended Sequence Numbers enable: N

    Traffic Flow Confidentiality enable: N

    Transmitting entity: Responder

    Path MTU: 1444

    Tunnel:

        local  address: 1.180.81.254

        remote address: 116.115.107.222

    Flow:

        sour addr: 192.168.4.224/255.255.255.255  port: 0  protocol: ip

        dest addr: 172.17.95.101/255.255.255.255  port: 0  protocol: ip

               

    [Inbound ESP SAs]

      SPI: 1974883458 (0x75b65482)

      Connection ID: 270582939650

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA idle time: 86400

      SA duration (kilobytes/sec): 1843200/3600

      SA remaining duration (kilobytes/sec): 1843170/3254

      Max received sequence-number: 0

      Anti-replay check enable: N

      Anti-replay window size: 

      UDP encapsulation used for NAT traversal: N

      Status: Active

 

    [Outbound ESP SAs]

      SPI: 945201555 (0x3856a193)

      Connection ID: 270582939648

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA idle time: 86400

      SA duration (kilobytes/sec): 1843200/3600

      SA remaining duration (kilobytes/sec): 1843200/3254

      Max sent sequence-number: 0

      UDP encapsulation used for NAT traversal: N

      Status: Active

 

  -----------------------------

  IPsec policy: 1

  Sequence number: 1

  Mode: Template

  Flow table status: Active

  -----------------------------

    Tunnel id: 2

    Encapsulation mode: tunnel

    Perfect Forward Secrecy: 

    Inside VPN: 

    Extended Sequence Numbers enable: N

    Traffic Flow Confidentiality enable: N

    Transmitting entity: Responder

    Path MTU: 1444

    Tunnel:

        local  address: 1.180.81.254

        remote address: 116.115.107.222

    Flow:

        sour addr: 192.168.4.224/255.255.255.255  port: 0  protocol: ip

        dest addr: 172.17.95.101/255.255.255.255  port: 0  protocol: ip

 

    [Inbound ESP SAs]

      SPI: 1222714221 (0x48e1236d)

      Connection ID: 236223201289

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA idle time: 86400

      SA duration (kilobytes/sec): 1843200/3600

      SA remaining duration (kilobytes/sec): 1843199/3242

      Max received sequence-number: 0

      Anti-replay check enable: N

      Anti-replay window size: 

      UDP encapsulation used for NAT traversal: N

      Status: Active

 

    [Outbound ESP SAs]

      SPI: 1406892491 (0x53db79cb)

      Connection ID: 236223201288

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA idle time: 86400

      SA duration (kilobytes/sec): 1843200/3600

      SA remaining duration (kilobytes/sec): 1843200/3242

      Max sent sequence-number: 0

      UDP encapsulation used for NAT traversal: N

      Status: Active、

 

 

分支侧配置和ipsec sa：

Advanced IPv4 ACL 3001, 3 rules,    ///////////互联网出口下nat outbound acl

ACL's step is 5

 rule 10 deny ip source 222.1.1.1 0 destination 192.168.4.224 0 (5 times matched)

 rule 20 deny ip source 172.17.95.101 0 destination 192.168.4.224 0 (3 times matched)

 rule 40 permit ip (33894 times matched)

 

Advanced IPv4 ACL 3100, 2 rules,           /////////////ipsec保护流

ACL's step is 5

 rule 20 permit ip source 172.17.95.101 0 destination 192.168.4.224 0 (12 times matched)

 rule 30 permit ip source 222.1.1.1 0 destination 192.168.4.224 0 (18 times matched)

 

ipsec transform-set 1

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm md5

#

ipsec policy 1 1 isakmp

 transform-set 1

 security acl 3100

 remote-address x.x.x.x

 ike-profile 1

#

 ike identity fqdn yc

#

ike profile 1

 keychain 1

 exchange-mode aggressive

 local-identity fqdn yc

 match remote identity fqdn zb

 proposal 1

#

ike proposal 1

#

ike keychain 1

 pre-shared-key address x.x.x.x 255.255.255.255 key cipher $c$3$+wD3SQPI4U9z593eImxlnkn+g2MG/aQ2Sg==

#

 

<H3C>display  ipsec sa

-------------------------------

Interface: GigabitEthernet1/0/4

-------------------------------

 

 IPsec policy: 1

  Sequence number: 1

  Mode: ISAKMP

  -----------------------------

    Tunnel id: 0

    Encapsulation mode: tunnel

    Perfect Forward Secrecy:

    Inside VPN:

    Extended Sequence Numbers enable: N

    Traffic Flow Confidentiality enable: N

    Path MTU: 1444

    Tunnel:

        local  address: 116.115.107.222

        remote address: 1.180.81.254

    Flow:

        sour addr: 172.17.95.101/255.255.255.255  port: 0  protocol: ip

        dest addr: 192.168.4.224/255.255.255.255  port: 0  protocol: ip

 

    [Inbound ESP SAs]

      SPI: 945201555 (0x3856a193)

      Connection ID: 124554051589

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA duration (kilobytes/sec): 1843200/3600

      SA remaining duration (kilobytes/sec): 1843200/2357

      Max received sequence-number: 0

      Anti-replay check enable: Y

      Anti-replay window size: 64

      UDP encapsulation used for NAT traversal: N

      Status: Active

 

    [Outbound ESP SAs]

      SPI: 1974883458 (0x75b65482)

      Connection ID: 124554051588

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA duration (kilobytes/sec): 1843200/3600

      SA remaining duration (kilobytes/sec): 1843099/2357

      Max sent sequence-number: 1174

      UDP encapsulation used for NAT traversal: N

      Status: Active

 

  -----------------------------

  IPsec policy: 1

  Sequence number: 1

  Mode: ISAKMP

  -----------------------------

    Tunnel id: 2

    Encapsulation mode: tunnel

    Perfect Forward Secrecy:

    Inside VPN:

    Extended Sequence Numbers enable: N

    Traffic Flow Confidentiality enable: N

    Path MTU: 1444

    Tunnel:

        local  address: 116.115.107.222

        remote address: 1.180.81.254

    Flow:

        sour addr: 222.1.1.1/255.255.255.255  port: 0  protocol: ip

        dest addr: 192.168.4.224/255.255.255.255  port: 0  protocol: ip

 

    [Inbound ESP SAs]

      SPI: 4046920036 (0xf1371964)

      Connection ID: 158913789958

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA duration (kilobytes/sec): 1843200/3600

      SA remaining duration (kilobytes/sec): 1843199/2652

      Max received sequence-number: 9

      Anti-replay check enable: Y

      Anti-replay window size: 64

      UDP encapsulation used for NAT traversal: N

      Status: Active

 

    [Outbound ESP SAs]

      SPI: 1049243898 (0x3e8a30fa)

      Connection ID: 158913789959

      Transform set: ESP-ENCRYPT-3DES-CBC ESP-AUTH-MD5

      SA duration (kilobytes/sec): 1843200/3600

      SA remaining duration (kilobytes/sec): 1843199/2652

      Max sent sequence-number: 9

      UDP encapsulation used for NAT traversal: N

      Status: Active