路由器msr5620组建ipsec vpn，本地多网段和对端多网段之间需要互访。

对端在云上是深信服防火墙设备，单臂部署。对方工程师说他们没问题，华三路由器这边可能需要建立多个加密数据流？

本地网段192.168.200.0/24和192.168.25.0/24。对端10.10.200.0/24和10.10.25.0/24。

为什么在本地填写多网段，对端也填写多网段，本地只有192.168.200.0网段能访问对端10.10.200.0网段。本地192.168.25.0无法访问对端10.10.200.0和10.10.25.0，本地192.168.200.0网段也无法访问对端10.10.250网段？

本端出口192.168.1.1，对端172.16.1.1

#

interface GigabitEthernet2/0/1

 port link-mode route

 description 核心业务

 combo enable copper

 ip address 192.168.1.1 255.255.255.0

 ip last-hop hold

 nat outbound 3999

 nat server protocol tcp global 192.168.1.1 5000 inside 192.168.25.10 5000

 ipsec apply policy map1

#

 ip route-static 10.10.25.0 24 GigabitEthernet2/0/1 192.168.1.2

 ip route-static 10.10.200.0 24 GigabitEthernet2/0/1 192.168.1.2

 ip route-static 172.16.1.1 32 GigabitEthernet2/0/1 192.168.1.2

#

acl advanced 3001

 description 云上业务

 rule 0 permit ip source 192.168.25.0 0.0.0.255 destination 10.10.200.0 0.0.0.255

 rule 1 permit ip source 192.168.25.0 0.0.0.255 destination 10.10.25.0 0.0.0.255

 rule 5 permit ip source 192.168.200.0 0.0.0.255 destination 10.10.200.0 0.0.0.255

 rule 6 permit ip source 192.168.200.0 0.0.0.255 destination 10.10.25.0 0.0.0.255

acl advanced 3999

 description vpn排除nat

 rule 15 deny ip source 192.168.25.0 0.0.0.255 destination 10.10.200.0 0.0.0.255

 rule 16 deny ip source 192.168.25.0 0.0.0.255 destination 10.10.25.0 0.0.0.255

 rule 17 deny ip source 192.168.200.0 0.0.0.255 destination 10.10.200.0 0.0.0.255

 rule 20 deny ip source 192.168.200.0 0.0.0.255 destination 10.10.25.0 0.0.0.255

 rule 1000 permit ip

ipsec transform-set test1

 esp encryption-algorithm aes-cbc-256

 esp authentication-algorithm sha256

#

ipsec policy map1 10 isakmp

 transform-set test1

 security acl 3001

 local-address 192.168.1.1

 remote-address 172.16.1.1

 ike-profile profile1

#

#

ike profile profile1

 keychain test1

 dpd interval 30 retry 3 periodic

 local-identity address 192.168.1.1

 match remote identity address 172.16.1.1 255.255.255.255

 proposal 10

#

ike proposal 10

 encryption-algorithm aes-cbc-256

 dh group14

 authentication-algorithm sha256

#

ike keychain test1

 pre-shared-key address 172.16.1.1 255.255.255.255 key cipher test1

#