MSR36-20路由器多条ipsecvpn配置问题

组网及组网描述：

杭州配置如下：                                                                           

杭州端

interface GigabitEthernet0/1

 port link-mode route

 description [MSR3040-ROUTE1-G0/1<--->ISP]

 nat outbound static

 nat outbound address-group 1

 nat outbound 3010

 nat outbound 2000 address-group 1

ipsec policy v5

ike proposal 10

 encryption-algorithm 3des-cbc

 authentication-algorithm md5

#

ike peer v5

 proposal 10

 pre-shared-key cipher $c$3$pWHy1u0DXcvnvpktm1XaD/tbPKwwIXM+OSln

 remote-address 11.11.11.2

 local-address 10.10.10.2

#

ipsec transform-set v5

 encapsulation-mode tunnel

 transform esp

 esp authentication-algorithm md5

 esp encryption-algorithm 3des

#              

ipsec policy v5 1 isakmp

 security acl 3000

 ike-peer v5

 transform-set v5

acl number 3000

 rule 0 permit ip source 192.168.127.0 0.0.0.255 destination 192.168.95.0 0.0.0.255

acl number 3010

 rule 0 deny ip source 192.168.127.0 0.0.0.255 destination 192.168.95.0 0.0.0.255

 rule 10 permit ip

内蒙端配置如下：

内蒙端：

interface GigabitEthernet0/0

 port link-mode route

 combo enable copper

 ip address  11.11.11.2   255.255.255.248

 nat outbound 3001

 nat outbound 2001 address-group 1

 ipsec apply policy hangzhouidc

acl advanced 3001

 rule 1 deny ip source 192.168.95.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

 rule 2 deny ip source 192.168.95.0 0.0.0.255 destination 10.1.0.0 0.0.255.255

 rule 4 deny ip source 192.168.134.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

 rule 6 deny ip source 192.168.134.0 0.0.0.255 destination 10.1.0.0 0.0.255.255

 rule 8 deny ip source 192.168.95.0 0.0.0.255 destination 192.168.127.0 0.0.0.255

 rule 100 permit ip

acl advanced 3002

 rule 0 deny tcp destination-port eq 139

#

acl advanced 3011

 rule 0 permit ip source 192.168.95.0 0.0.0.255 destination 192.168.127.0 0.0.0.255

#

acl advanced 3066

 rule 0 permit ip source 192.168.95.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

 rule 1 permit ip source 192.168.95.0 0.0.0.255 destination 10.1.0.0 0.0.255.255

ipsec transform-set neimeng-hangzhou

 esp encryption-algorithm aes-cbc-128

 esp authentication-algorithm md5

#

ipsec transform-set v7

 esp encryption-algorithm 3des-cbc

 esp authentication-algorithm md5

#

ipsec policy hangzhouidc 65530 isakmp

 transform-set hangzhouidc

 security acl 3000

 remote-address 12.12.12.2

 ike-profile hangzhouidc

 sa duration time-based 3600

 sa duration traffic-based 1843200

#

ipsec policy hangzhouidc 65533 isakmp

 transform-set v7

 security acl 3011

 remote-address 10.10.10.2

 ike-profile v7

#

 l2tp enable

#

ike profile hangzhouidc

 keychain hangzhouidc

 dpd interval 10 on-demand

 exchange-mode aggressive

 local-identity fqdn liansheng

 match remote identity fqdn hangzhouidc

 proposal 65530

#

ike profile v7

 keychain v7

 local-identity address 11.11.11.2

 match remote identity address  10.10.10.2   255.255.255.255

 proposal 65533

#

ike proposal 65530

 encryption-algorithm 3des-cbc

 dh group2

 authentication-algorithm md5

 sa duration 28800

#

ike proposal 65533

 encryption-algorithm 3des-cbc

 authentication-algorithm md5

#

ike keychain hangzhouidc

 pre-shared-key address  12.12.12.2   255.255.255.255 key cipher $c$3$uAVYpTh7Gj

3YgOvIasg2KyrBVujP7+EDRw==

#

ike keychain v7

 pre-shared-key address 10.10.10.2 255.255.255.255 key cipher $c$3$JygZhP8Ue3

uDGZrKNHMs4cpQ2w7ApbF8nU0a

#