MSR路由器ipsec ike協商SA失敗

從思科轉為MSR5620，ipsec vpn協商sa在第二階段失敗，報錯如下；檢查了ACL匹配到流量的，對端設備無法知道是什麼設備也無法看到配置，隻確認將ipsec 目的地址更改過。這配置是否有問題呢？

%Jan 13 15:28:44:172 2025 sge IKE/6/IKE_P2_SA_ESTABLISH_FAIL: Failed to establish phase 2 SA in IKE_P2_STATE_GETSP state.

Reason: Failed to get IPsec policy as phase 2 responder.

SA information:

Role: responder

Local address: 117.131.55.162

Remote address: 183.195.117.253

Sour addr: / Port: 0 Protocol: 

Dest addr: / Port: 0 Protocol: 

Inside VPN instance: 

Outside VPN instance: 

Inbound AH SPI: 0

Outbound AH SPI: 0

Inbound ESP SPI: 0

Outbound ESP SPI: 0

Initiator COOKIE: a0654bcc9a86874f

Responder COOKIE: 4428d755ad7310c3

Message ID: 0xdae5fa1a

Connection ID: 3204

Tunnel ID: 1

%Jan 13 15:28:46:227 2025 sge IPSEC/6/IPSEC_SA_ESTABLISH_FAIL: Failed to establish IPsec SA.

Reason: The policy contains incorrect ACL or IKE profile configuration..

SA information:

Role: responder.

Local address: 117.131.55.162

Remote address: 183.195.117.253

Sour addr: 19.255.34.80/255.255.255.240 Port: 0 Protocol: IP

Dest addr: 19.194.208.0/255.255.254.0 Port: 0 Protocol: IP

Inside VPN instance: 

Outside VPN instance: 

Inbound AH SPI: 0

Outbound AH SPI: 0

MSR配置

acl advanced name IPSec

 rule 0 permit ip source 19.255.34.80 0.0.0.15 destination 19.194.208.0 0.0.1.255

#

pki domain sge 

 ca identifier sge

 certificate request from ca

 certificate request entity sge

 public-key rsa general name sge

 undo crl check enable

#

pki entity sge

 common-name sge

#

pki certificate access-control-policy policy1

 rule 1 permit group2

#

pki certificate attribute-group group2

 attribute 1 subject-name dn ctn sge

#

 ipsec logging packet enable

 ipsec sa idle-time 7200

 ipsec logging negotiation enable

 ipsec logging ipsec-p2mp enable

#

ipsec transform-set tran1

 esp encryption-algorithm 3des-cbc 

 esp authentication-algorithm sha1 

 pfs dh-group2

#

ipsec policy IPSec_CMCC 10 isakmp

 transform-set tran1 

 security acl name IPSec 

 remote-address 183.195.117.253

 ike-profile To_CMCC

 sa duration time-based 7200

#

 ike logging negotiation enable

#

ike profile To_CMCC

 certificate domain sge

 proposal 10 

#

ike proposal 10

 authentication-method rsa-signature

 encryption-algorithm 3des-cbc

 dh group2

 authentication-algorithm md5

 sa duration 7200

#

原思科設備配置

crypto isakmp policy 10

 encr 3des

 hash md5

 group 2

 lifetime 7200

!

crypto ipsec security-association lifetime seconds 7200

!

crypto ipsec transform-set set1 esp-3des esp-sha-hmac 

 mode tunnel

!

!

!

crypto map vpnmap 10 ipsec-isakmp 

 set peer 183.195.117.253

 set transform-set set1 

 match address 100