I found my purposed routine is : Local -- local rsa --> Proxy -- proxy rsa --> Target
But ssh only allow: Local -- local rsa --> Proxy -- local rsa --> Target
So, the solution is add local rsa pub_key to Target:
ssh root@aa
ssh root@bb
echo 'your_rsa.pub file content' >> ~/.ssh/authorized_keys
then `ProxyCommand` works .