Добрый день! Пытаемся настроить VPN между Cisco 871 and Linux
config cisco такой

!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname TEST84
!
boot-start-marker
boot-end-marker
!
.
!
no aaa new-model
!
resource policy
!
clock timezone PCTime 3
clock summer-time PCTime date Mar 30 2003 2:00 Oct 26 2003 3:00
ip subnet-zero
ip cef
!
!
!
!

!
!
!
!
!
!
crypto isakmp policy 10
authentication pre-share
group 2
crypto isakmp key key_gen address 111.111.111.111
!
!
crypto ipsec transform-set secure ah-sha-hmac esp-3des esp-sha-hmac
mode transport
!
crypto map test 210 ipsec-isakmp
set peer 111.111.111.111
set transform-set secure
set pfs group2
match address test32
!
bridge irb
!
!
!
interface Tunnel200
description virtual sklad
ip address 172.20.0.1 255.255.255.252
ip mtu 1440
tunnel source BVI1
tunnel destination 111.111.111.111
!
interface ATM0
no ip address
no atm ilmi-keepalive
pvc 0 0/62
  protocol ip 222.222.222.225
  encapsulation aal5snap
!
dsl operating-mode auto
bridge-group 1
!
interface FastEthernet0
!
interface FastEthernet1

!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
ip address 10.10.10.49 255.255.255.0
ip access-group vl1_in in
ip nat inside
ip virtual-reassembly

interface BVI1
ip address 222.222.222.226 255.255.255.252
ip nat outside
ip virtual-reassembly
ip route-cache flow
crypto map test
!
ip classless
ip route 0.0.0.0 0.0.0.0 222.222.222.225

!
!
no ip http server
no ip http secure-server
!
ip nat inside source list 1 interface BVI1 overload

!
ip access-list extended bvi1_in
permit ip any any
ip access-list extended test32
permit gre host 222.222.222.226 host 111.111.111.111
permit ip host 222.222.222.226 host 111.111.111.111
permit ip host 111.111.111.111 host 222.222.222.226
ip access-list extended vl1_in
permit ip host 10.10.10.96 any
permit ip any host 10.10.10.96
permit ip host 10.10.10.32 any
permit ip any host 10.10.10.32
permit ip any host 10.10.10.2
permit ip host 10.10.10.2 any
deny   ip any any
!
logging trap debugging
logging facility syslog
logging 10.10.10.32
access-list 1 permit 10.10.10.0 0.0.0.255
access-list 36 permit 10.10.10.32
no cdp run
!
!
control-plane
!
bridge 1 protocol ieee
bridge 1 route ip
!
line con 0
no modem enable
line aux 0
line vty 0 4
login local
transport input ssh
!
scheduler max-task-time 5000
end

То что касается линуха - админ прислал свой

racoon.conf:
path pre_shared_key "/etc/racoon/psk.txt";

padding {
            maximum_length 20;      # maximum padding length.
            randomize off;          # enable randomize length.
            strict_check off;       # enable strict check.
            exclusive_tail off;     # extract last one octet.
}

listen {
            isakmp 111.111.111.111 [500];
}

remote anonymous {
                exchange_mode main,aggressive;
                doi ipsec_doi;
                situation identity_only;

                my_identifier address 172.20.0.2;

                nonce_size 16;
                lifetime time 2 min;   # sec,min,hour
                initial_contact on;
                proposal_check obey;    # obey, strict or claim

        proposal {
                encryption_algorithm 3des;
                hash_algorithm sha1;
                authentication_method pre_shared_key;
                dh_group 2 ;
        }
}

sainfo  anonymous {
#       pfs_group 1;
        encryption_algorithm 3des;
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate ;
}

log debug;

Вот такой лог циски

*Mar  6 21:17:17.687: ISAKMP:(1010):Checking IPSec proposal 1
*Mar  6 21:17:17.687: ISAKMP: transform 1, ESP_3DES
*Mar  6 21:17:17.687: ISAKMP:   attributes in transform:
*Mar  6 21:17:17.687: ISAKMP:      SA life type in seconds
*Mar  6 21:17:17.687: ISAKMP:      SA life duration (basic) of 28800
*Mar  6 21:17:17.687: ISAKMP:      encaps is 1 (Tunnel)
*Mar  6 21:17:17.687: ISAKMP:      authenticator is HMAC-SHA
*Mar  6 21:17:17.687: ISAKMP:      group is 2
*Mar  6 21:17:17.687: ISAKMP:(1010):atts are acceptable.
*Mar  6 21:17:17.687: IPSEC(validate_proposal_request): proposal part #1
*Mar  6 21:17:17.687: IPSEC(validate_proposal_request): proposal part #1,
(key eng. msg.) INBOUND local= 222.222.222.226, remote= 111.111.111.111,
   local_proxy= 172.20.0.1/255.255.255.255/0/0 (type=1),
   remote_proxy= 172.20.0.2/255.255.255.255/0/0 (type=1),
   protocol= ESP, transform= esp-3des esp-sha-hmac  (Tunnel),
   lifedur= 0s and 0kb,
   spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x0
*Mar  6 21:17:17.691: IPSEC(crypto_ipsec_process_proposal): no IPSEC cryptomap exists for local address 222.222.222.226
*Mar  6 21:17:17.691: ISAKMP:(1010): IPSec policy invalidated proposal
*Mar  6 21:17:17.691: ISAKMP:(1010): phase 2 SA policy not acceptable! (local 222.222.222.226 remote 111.111.111.111)

то есть как я понял он пишет что не найдена карта для адреса - хотя прописана на интерфейсе BVI1

помогите разобраться с ошибкой

• не получается настроить VPN между циской и линухом,ViKu, 14:37 , 13-Авг-08
  • не получается настроить VPN между циской и линухом,rostpyton, 16:05 , 14-Авг-08

cry map на тунеле нужна.

Кстати таки не понял зачем нужен тунель если IPSEC в режиме тунеля? Знатоки просветите плиз , на след неделе придетси делать. В нете много примеров для fbsd, чаще с тунелем, толкового обьяснения конфигов нет, для pix - bsd вмдел пример без тунеля.

>cry map на тунеле нужна.
>

Дв все то же самое.. все равно та же ошибка