sec path F1000-AI-90,同一接口如何建立多个ipsec

通过命令行方式建立吧，web 页面不行

//使用g1/0/0接口 和其他位置建立点对点ipsec

interface GigabitEthernet1/0/0
port link-mode route
combo enable copper
ip address 10.3.1.1 255.255.255.252
ipsec apply policy ipsec
ipsec no-nat-process enable

//添加到对端私网的路由
ip route-static 10.10.10.0 24 10.3.1.2
ip route-static 10.10.20.0 24 10.3.1.2

//ipsec 第二阶段认证的加密方式和认证算法
ipsec transform-set 10
esp encryption-algorithm aes-cbc-256
esp authentication-algorithm sha256
#
//ipsec 第二阶段认证的加密方式和认证算法，如果策略相同可以公用
ipsec transform-set tosheng
esp encryption-algorithm aes-cbc-256
esp authentication-algorithm sha256
#

// ipsec 名称"ipsec",改名称用于在接口上调用 10 在web 页面上显示为优先级，用来做区分
ipsec policy ipsec 10 isakmp
transform-set tosheng
security acl 3001
local-address 10.3.1.1
remote-address 10.1.1.1
ike-profile tosheng
sa trigger-mode auto
#
ipsec policy ipsec 20 isakmp
transform-set 10
security acl 3002
local-address 10.3.1.1
remote-address 10.2.1.1
ike-profile toshi
sa trigger-mode auto
#

//ike 的策略 引用了ike 的交换密钥 ，配置本地标识 ，匹配远端标识、引用ike 认证加密的算法
ike profile tosheng
keychain tisheng
local-identity address 10.3.1.1
match remote identity address 10.1.1.1 255.255.255.255
match local address 10.3.1.1
proposal 10
#
ike profile toshi
keychain tisshi
local-identity address 10.3.1.1
match remote identity address 10.2.1.1 255.255.255.255
match local address 10.3.1.1
proposal 10
#
ike proposal 10
encryption-algorithm aes-cbc-256
dh group14
authentication-algorithm sha256
sa duration 28800
#
ike proposal 20
encryption-algorithm aes-cbc-256
dh group14
authentication-algorithm sha256
sa duration 28800
#

用于协商的ike 密钥
ike keychain tisheng
match local address 10.3.1.1
pre-shared-key address 10.1.1.1 255.255.255.255 key cipher $c$3$vxaquitxDYDpfUvuVrPms3MYqUv3i+GHlw==
#
ike keychain tisshi
match local address 10.3.1.1
pre-shared-key address 10.2.1.1 255.255.255.255 key cipher $c$3$hzMrisN6Diru5UUeRRMC4rMUgcgKB3b3OQ==