MSR930 IPSEC动态域名组网 VOIP电话单通

MSR930 PPPoE动态域名IPSEC VPN组网，总部（192.168.100.0/24）和分支（192.168.2.0/24）均可ping通，网关间也可web互相访问，VOIP电话服务器放置在总部局域网内（192.168.100.0/24），通过内网访问，VOIP电话单通，即总部可以打到分支，分支却无法打通总部，请问各位高手问题出在哪里？

[H3C]dis cur

#

 version 5.20, Release 2516P19

#

 sysname H3C

#

 clock timezone Beijing add 08:00:00

#

 password-control enable

 undo password-control aging enable

 undo password-control history enable

 password-control length 6

 password-control login-attempt 3 exceed lock-time 10

 password-control password update interval 0

 password-control login idle-time 0

 password-control complexity user-name check

#

 l2tp enable

#

 undo nat alg h323

 undo nat alg sip

#

 domain default enable system

#

 dns resolve   

 dns proxy enable

 dns server 61.132.163.68

 dns server 202.102.213.68

#

 telnet server enable

#

 dar p2p signature-file flash:/p2p_default.mtd

#

 ndp enable

#

 ntdp enable

#

 cluster enable

#

 port-security enable

#

 password-recovery enable

#

acl number 3000

 rule 0 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.100.0 0.0.0.255

 rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.101.0 0.0.0.255

 rule 10 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.0.0 0.0.0.255

 rule 15 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.103.0 0.0.0.255

 rule 20 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.3.0 0.0.0.255

#

vlan 1

#

domain system

 authentication ppp local

 authorization ppp none

 access-limit disable

 state active

 idle-cut disable

 self-service-url disable

 ip pool 1 192.168.92.150 192.168.92.200

#

ike proposal 1

#

ike peer office

 exchange-mode aggressive

 proposal 1

 pre-shared-key cipher $c$3$ZaAdHeNlsx6YiCfsGJMLgJj2xWpEaSnmHSrU

 id-type name

 remote-name ***.***

 remote-address ***.*** dynamic

 local-name ***.***

 nat traversal

#

ipsec transform-set office

 encapsulation-mode tunnel

 transform esp

 esp authentication-algorithm sha1

 esp encryption-algorithm 3des

#

ipsec policy 720896 1 isakmp

 connection-name office

 security acl 3000

 ike-peer office

 transform-set office

 sa duration traffic-based 1843200

 sa duration time-based 3600

ddns policy xmrf

 interval 0 0 5

 url ***.***/dyndns/update?system=dyndns&hostname=<h>&myip=<a>

 username root

 password cipher $c$3$oe2sNYpG7sJzBl/JFjMk0Kwm2AG/0+g2yr4d

#

l2tp-group 1

 undo tunnel authentication

 allow l2tp virtual-template 0

 tunnel name LNS

#

interface Aux0 

 async mode flow

 link-protocol ppp

#

interface Cellular0/0

 async mode protocol

 link-protocol ppp

 tcp mss 1024

#

interface Dialer10

 nat outbound

 link-protocol ppp

 ppp chap user 055191715959

 ppp chap password cipher $c$3$4f2IsbqJ3M3iNkoVXDhMgPdze0hb09PpIA==

 ppp pap local-user 055191715959 password cipher $c$3$G1znMz0dTj1YuI6YZk85srCB65S/wkN3Vw==

 ppp ipcp dns admit-any

 ppp ipcp dns request

 mtu 1492

 ip address ppp-negotiate

 tcp mss 1024

 dialer user username

 dialer-group 10

 dialer bundle 10

 ipsec no-nat-process enable

 ipsec policy 720896

 ddns apply policy xmrf fqdn ***.***