HCL 配置野蛮模式问题

这是我以前测试的过程：

RT1一、     实验组网

二、     组网要求

需求1：RT1端采用拨号接入公网，RT3端公网口固定IP地址。

需求2：RT1作为IPsec发起端，RT3作为IPsec响应端。

配置ipsec 、NAT

#

acl advanced 3000

 rule 10 permit ip source 192.168.1.0 0.0.0.255 destination 192.168.2.0 0.0.0.255

#                                 //配置需要通过ipsec vpn的数据流

acl advanced 3001

 rule 5 deny ip destination 192.168.2.0 0.0.0.255

 rule 10 permit ip                   //配置需要nat上网的地址，拒绝需要加密的数据

#

ipsec transform-set 1                 

 esp encryption-algorithm aes-cbc-128

 esp authentication-algorithm sha1      //配置安全提议

#

ipsec policy 1 1 isakmp

 transform-set 1

 security acl 3000

 remote-address 2.2.2.1

 ike-profile 1                    //配置安全策略

#

 ike identity fqdn cai              //配置IKE身份信息

#

ike profile 1

 keychain 1

 exchange-mode aggressive

 match remote identity fqdn pp

 proposal 1                        //配置ike profile、IKE第一阶段协商为野蛮模式

#             

ike proposal 1                       //配置ike proposal

#

ike keychain 1

 pre-shared-key address 2.2.2.1 255.255.255.255 key cipher $c$3$03LztnEtNqCoz1Rup5JAUDfHAceJTQ==          //配置ike keychain

#   

2.3、配置RT3的ipsec

ip route-static 0.0.0.0 0 2.2.2.2        //配置静态路由

acl advanced 3000

rule 10 permit ip source 192.168.2.0 0.0.0.255 destination 192.168.1.0 0.0.0.255

##                                 //配置需要通过ipsec vpn的数据流

ipsec transform-set 1                 

 esp encryption-algorithm aes-cbc-128

 esp authentication-algorithm sha1      //配置安全提议

#

ipsec policy-template 1 1

 transform-set 1

 security acl 3000

 ike-profile 1                        //配置模板

ipsec policy 1 1 isakmp template 1       //配置安全策略绑定模板

#

 ike identity fqdn pp              //配置IKE身份信息

#

i ike profile 1

 keychain 1

 exchange-mode aggressive

 match remote identity fqdn cai

 proposal 1                        //配置ike profile、IKE第一阶段协商为野蛮模式

#             

ike proposal 1                       //配置ike proposal

#

ike keychain 1

   pre-shared-key hostname cai key cipher $c$3$i1Sgj37FIGHtP0c8UasgqnVjXP3Rjw==    

//配置ike keychain

#   

2.4、测试