GRE over IPsec between USG6510E and USG6630E

Thanks for contacting the Huawei community!

We are checking your question and will provide an answer to you shortly.

Hi,
Can you please check the status that the IPSec tunnel is stucked in?

Hi user_4283387,
When configuring an IPSec proposal, ensure that the parameters, such as the security protocol, authentication algorithm, encryption algorithm, and packet encapsulation mode, are the same on both ends of the IPSec tunnel. Otherwise, tunnel negotiation fails. If the PFS algorithm is configured on both ends, ensure that the PFS algorithm configured on both ends is the same. Otherwise, tunnel negotiation fails. Check whether the parameters on the USG6510E are consistent with those on the USG6630E.
The following link describes the troubleshooting procedure for an IPSec tunnel establishment failure, you can refer to https://support.huawei.com/hedex/hdx.do?docid=EDOC1000179233&id=EN-US_TOPIC_0115283187&lang=en
https://support.huawei.com/hedex/hdx.do?docid=EDOC1000179233&id=EN-US_TOPIC_0115283189&lang=en

If the error shows "flow or peer mismatch", please check the ACL configuration on both ends, the mismatch ACL would affect the IPSec tunnel establishing.

We have found a solution of our problem. We re-create IPsec policies on 6630 and 6510 with default parameters and it working.

We checked ACL on both device and its looks similar to each other

Thank you for your answers!

Good answer.

NICE