Доброго времени суток!
Кто-нибудь сталкивался (поборол?) с такой проблемой?
Провайдер дает честный IP через IP-IP туннель. Опорные адреса туннеля "серые". За циской сетка, на которую надо построить IPSec-туннель. Но проходит только первая фаза, туннель не строится. debug crypto isakmp показывает

*Mar  2 00:44:58.119: ISAKMP:(1013):Checking IPSec proposal 1
*Mar  2 00:44:58.119: ISAKMP: transform 1, ESP_AES
*Mar  2 00:44:58.119: ISAKMP:   attributes in transform:
*Mar  2 00:44:58.119: ISAKMP:      encaps is 1 (Tunnel)
*Mar  2 00:44:58.119: ISAKMP:      SA life type in seconds
*Mar  2 00:44:58.119: ISAKMP:      SA life duration (basic) of 28800
*Mar  2 00:44:58.119: ISAKMP:      SA life type in kilobytes
*Mar  2 00:44:58.119: ISAKMP:      SA life duration (VPI) of  0x0 0x46 0x50 0x0
*Mar  2 00:44:58.119: ISAKMP:      authenticator is HMAC-SHA
*Mar  2 00:44:58.119: ISAKMP:      key length is 128
*Mar  2 00:44:58.119: ISAKMP:      group is 2
*Mar  2 00:44:58.119: ISAKMP:(1013):atts are acceptable.
*Mar  2 00:44:58.119: ISAKMP:(1013): IPSec policy invalidated proposal
*Mar  2 00:44:58.119: ISAKMP:(1013): phase 2 SA policy not acceptable! (local x.y.z.t remote A.B.C.D)

debug crypto ipsec:
*Mar  2 00:46:57.859: IPSEC(key_engine): got a queue event with 1 KMI message(s)
*Mar  2 00:46:58.059: IPSEC(key_engine): got a queue event with 1 KMI message(s)
*Mar  2 00:46:58.147: IPSEC(validate_proposal_request): proposal part #1
*Mar  2 00:46:58.147: IPSEC(validate_proposal_request): proposal part #1,
  (key eng. msg.) INBOUND local= x.y.z.t, remote= A.B.C.D,
    local_proxy= 192.168.121.0/255.255.255.128/0/0 (type=4),
    remote_proxy= 192.168.0.0/255.255.0.0/0/0 (type=4),
    protocol= ESP, transform= esp-aes esp-sha-hmac  (Tunnel),
    lifedur= 0s and 0kb,
    spi= 0x0(0), conn_id= 0, keysize= 128, flags= 0x0
*Mar  2 00:46:58.147: IPSEC(crypto_ipsec_process_proposal): invalid local address x.y.z.t

#sh ver | incl image
System image file is "flash:c870-advsecurityk9-mz.124-4.T3.bin"

#sh running
...
crypto keyring HQ-keyring
pre-shared-key address A.B.C.D key SupersecreT

crypto isakmp policy 10
encr aes
authentication pre-share
group 2  
lifetime 28800

crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 60

crypto ipsec transform-set HQ-transform esp-aes esp-sha-hmac

crypto ipsec df-bit clear

crypto map HQ-map local-address Tunnel0

crypto map HQ-map 1 ipsec-isakmp
set peer A.B.C.D
set transform-set HQ-transform
set pfs group2
match address HQ-IPSEC-list
reverse-route

interface Tunnel0
description WAN tunnel
ip address x.y.z.t 255.255.255.252
ip nat outside
ip virtual-reassembly
tunnel source FastEthernet4
tunnel destination 172.16.44.1
tunnel mode ipip
crypto map HQ-map

...

interface FastEthernet4
description WAN carrier
ip address 172.20.43.33 255.255.255.0
duplex auto
speed auto
no cdp enable

interface Vlan1
ip address 192.168.121.1 255.255.255.128
ip nat inside
ip virtual-reassembly

ip route 0.0.0.0 0.0.0.0 x.y.z.(t-1)
ip route 172.16.44.1 255.255.255.255 172.20.43.1

ip nat inside source list NAT-list interface Tunnel0 overload

ip access-list extended NAT-list
deny   ip any 192.168.0.0 0.0.255.255
permit ip 192.168.121.0 0.0.0.127 any
ip access-list extended HQ-IPSEC-list
permit ip 192.168.121.0 0.0.0.127 192.168.0.0 0.0.255.255

...