苹果ipad l2tp over ipsec 问题

苹果ipad 版本18.2.1  防火墙1242 version 7.1.064, Release 9660P55   配置l2tp over ipsec VPN后，PC安装inode可以正常连接，IPAD自带的VPN连接不成功，一阶段可以协商成功能看到IKE SA，但ipsec 协商不成功，试过各种验证和加密组合都失败。有做成功的朋友贴个配置参考下，

这是我的配置，策略端口都已经放通

 version 7.1.064, Release 9660P55

#

 s security-zone intra-zone default permit

#

 ip pool l2tp 172.20.255.2 172.20.255.200 

#

interface Virtual-Template1

 ppp authentication-mode chap pap 

 remote address pool l2tp 

 ip address 172.20.255.1 255.255.255.0

#

interface GigabitEthernet1/0/14

 port link-mode route

 ip address 公网地址

 nat outbound 3602

  ipsec apply policy l2tp

#

 acl advanced 3602

 rule 9 deny udp source-port eq 1701

 rule 10 deny ip source 172.20.255.0 0.0.0.255

 rule 11 deny ip destination 172.20.255.0 0.0.0.255

 rule 200 permit ip

#

acl advanced 3603

 rule 10 permit udp source-port eq 1701

 rule 200 permit ip source 172.20.255.0 0.0.0.255

 rule 201 permit ip destination 172.20.255.0 0.0.0.255

#              

 session statistics enable

#

 ipsec logging negotiation enable

#

ipsec transform-set 1

 encapsulation-mode transport

 esp encryption-algorithm 3des-cbc 

 esp authentication-algorithm md5 

#

ipsec transform-set 2

 encapsulation-mode transport

 esp encryption-algorithm aes-cbc-128 

 esp authentication-algorithm sha1 

#

ipsec transform-set 3

 encapsulation-mode transport

 esp encryption-algorithm aes-cbc-256 

 esp authentication-algorithm sha1 

#              

ipsec transform-set 4

 encapsulation-mode transport

 esp encryption-algorithm des-cbc 

 esp authentication-algorithm sha1 

#

ipsec transform-set 5

 encapsulation-mode transport

 esp encryption-algorithm 3des-cbc 

 esp authentication-algorithm sha1 

#

ipsec transform-set 6

 encapsulation-mode transport

 esp encryption-algorithm aes-cbc-128 

 esp authentication-algorithm sha256 

#

ipsec transform-set 7

 esp encryption-algorithm aes-cbc-128 

 esp authentication-algorithm sha256 

#

ipsec transform-set 22

#

ipsec transform-set 123

 esp encryption-algorithm 3des-cbc 

 esp authentication-algorithm sha1 

#

ipsec policy-template l2tp 10

 transform-set 1 2 3 4 5 6 

 security acl 3603 

 ike-profile cc

#

ipsec policy l2tp 10 isakmp template l2tp

#

l2tp-group 1 mode lns

 allow l2tp virtual-template 1

 undo tunnel authentication

#

 l2tp enable

#

 ike identity user-fqdn zongbu

 ike logging negotiation enable

#

ike profile cc

 keychain 10

 match remote identity address 0.0.0.0 0.0.0.0

 proposal 1 2 3 4 5 6 

#

ike proposal 1

 encryption-algorithm aes-cbc-128

 dh group2

 authentication-algorithm md5

#

ike proposal 2

 encryption-algorithm 3des-cbc

 dh group2

 authentication-algorithm md5

#

ike proposal 3

 encryption-algorithm 3des-cbc

 dh group2

#              

ike proposal 4

 encryption-algorithm aes-cbc-256

 dh group2

#

ike proposal 5

 dh group2

#

ike proposal 6

 encryption-algorithm aes-cbc-192

 dh group2

#

ike keychain 10

 pre-shared-key address 0.0.0.0 255.255.255.255 key cipher $c$3$pCesm5wZph+8Oi8KneMSMFLnAuZBRg==