HCL模拟器 防火墙1060做IPSec实验sa起不来,懂的大佬帮忙排一下错

防火墙1配置：

#

interface LoopBack0

 ip address 1.1.1.1 255.255.255.255

#

interface GigabitEthernet1/0/0

 ip address 10.1.1.1 255.255.255.0

 ipsec apply policy 1

#

security-zone name Trust

 import interface GigabitEthernet1/0/0

 import interface LoopBack0

#

security-policy ip

 rule 0 name any

  action pass

#

acl advanced 3000

 rule 5 permit ip source 1.1.1.1 0 destination 2.2.2.2 0

#

ipsec transform-set 1

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm sha1

#

ipsec policy 1 10 isakmp

 transform-set 1

 security acl 3000

 local-address 10.1.1.1

 remote-address 10.1.1.2

 ike-profile 1

#

ike profile 1

 keychain 1

 dpd interval 10 periodic

 local-identity address 10.1.1.1

 match remote identity address 10.1.1.2 255.255.255.255

 match local address GigabitEthernet1/0/0

 proposal 1

#

ike proposal 1

#

ike keychain 1

 match local address GigabitEthernet1/0/0

 pre-shared-key address 10.1.1.2 255.255.255.255 key simple 123

防火墙2配置：

#

interface LoopBack0

 ip address 2.2.2.2 255.255.255.255

#

interface GigabitEthernet1/0/0

 ip address 10.1.1.2 255.255.255.0

 ipsec apply policy 1

#

security-zone name Trust

 import interface GigabitEthernet1/0/0

 import interface LoopBack0

#

security-policy ip

 rule 0 name any

  action pass

#

acl advanced 3000

 rule 5 permit ip source 2.2.2.2 0 destination 1.1.1.1 0

#

ipsec transform-set 1

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm sha1

#

ipsec policy 1 10 isakmp

 transform-set 1

 security acl 3000

 local-address 10.1.1.2

 remote-address 10.1.1.1

 ike-profile 1

#

ike profile 1

 keychain 1

 dpd interval 10 on-demand

 local-identity address 10.1.1.2

 match remote identity address 10.1.1.1 255.255.255.255

 match local address GigabitEthernet1/0/0

 proposal 1

#

ike proposal 1

#

ike keychain 1

 match local address GigabitEthernet1/0/0

 pre-shared-key address 10.1.1.1 255.255.255.255 key simple 123