AR161f

@abka2980 hello,
are you trying to configure PPPoE on the Cellular interface？

no , my configuration is return
[Huawei-Cellular0/0/0]dis this
[V200R009C00SPC500]
#
interface Cellular0/0/0
tcp adjust-mss 1460
dialer enable-circular
apn-profile stat
dialer timer autodial 10
dialer number *99# autodial
ipsec policy PolicyMap
ip address negotiate
#
notice if i not use ipsec its come up

but in anther vrp virgin it work normally

my ipsec configuration is
acl number 3000
rule 1 permit ip
#
ipsec proposal IPSec_Phase2
esp authentication-algorithm sha1
esp encryption-algorithm aes-128
#
ike proposal default
encryption-algorithm aes-128
dh group2
authentication-algorithm sha1
authentication-method pre-share
integrity-algorithm hmac-sha1-96
prf hmac-sha1
ike proposal 2
encryption-algorithm aes-128
dh group2
authentication-algorithm sha1
authentication-method pre-share
integrity-algorithm hmac-sha1-96
prf hmac-sha1
#
ike peer Backup_PE
pre-shared-key simple cisco
ike-proposal 2
local-address x.x.x.x.
remote-address y.y.y.y
#
ipsec policy PolicyMap 1 isakmp
security acl 3000
pfs dh-group2
ike-peer Backup_PE
proposal IPSec_Phase2

So, you mean the connection could work normal while the ipsec policy doesn't configured, connection interrupted while the ipsec policy configured.
Am I right?

yes ., i think that

but the save ipsec configuration used for anther router , its work normal

sorry ,
same ipsec

Hello,

Please note that Private networks fail to communicate with each other after IPSec is configured. The possible causes are as follows:

• The public addresses of two IPSec-enabled devices cannot ping each other.

• The data flow defined for IPSec encapsulation is the same as that defined for NAT. You can run the display acl all command to view the matching ACL rule. In this case, use either of the following methods to prevent the data flow overlapping:

  • Ensure that the destination IP address in the ACL rule referenced by IPSec is denied in the ACL rule referenced by NAT. By doing so, the device does not perform NAT on the data flow protected by IPSec.
  • The ACL rule referenced by IPSec matches NAT-translated IP address.
• The device incorrectly learns private routes. The outbound interface to the destination private network is not the public network interface with IPSec enabled.
• When the authentication algorithm used in an IPSec proposal is SHA2, the encryption and decryption methods on both ends are inconsistent.