добрый день всем

такая проблема с туннелем ipsec

linux - cisco

очень долго не может пройти первая фаза, постоянно выдает

ERROR: phase1 negotiation failed due to time up.

иногда все-таки схватывает, проходит вторая фаза, поднимается туннель, и через полминуты падает,

INFO: IPsec-SA expired: ESP/Tunnel

опять начинается первая фаза.

path pre_shared_key "/etc/racoon/psk.txt";                                      
#path certificate "/etc/racoon/certs";                                          
                                                                                
                                                                                
log notify;                                                                    
padding                                                                        
{                                                                              
        maximum_length 20;      # maximum padding length.                      
        randomize off;          # enable randomize length.                      
        strict_check off;       # enable strict check.                          
        exclusive_tail off;     # extract last one octet.                      
}                                                                              
                                                                                
listen                                                                          
{                                                                              
        isakmp xxx.xxx.xxx.xxx [500];                                              
}                                                                              
                                                                                
timer                                                                          
{                                                                              
        # These value can be changed per remote node.                          
        counter 1;              # maximum trying count to send.
        interval 20 sec;        # maximum interval to resend.                  
        persend 1;              # the number of packets per a send.            
        # timer for waiting to complete each phase.                            
        phase1 30 sec;                                                        
        phase2 15 sec;                                                        
}                                                                              
                                                                                
                                                                                
remote anonymous                                                                
{                                                                              
        exchange_mode base,main,aggressive;                                    
        lifetime time 28800 sec;                                                
        ike_frag on;                                                            
#       passive on;                                                            
        nat_traversal off;                                                      
        proposal {                                                              
                encryption_algorithm 3des;                                      
                hash_algorithm sha1;                                            
                authentication_method pre_shared_key ;                          
                dh_group 2 ;                                                    
        }

        generate_policy off;                                                    
}                                                                              
                                                                                
sainfo anonymous                                                                
{                                                                              
        pfs_group 2;                                                            
        lifetime time 28800 sec;                                                
        encryption_algorithm 3des;                                              
        authentication_algorithm hmac_sha1;                                    
        compression_algorithm deflate ;                                        
}

при phase1 300sec;                                                        
        phase2 180 sec;

удалось добиться что туннель держится минут 40, потом падает и 20 минут пытается подняться.

Вот такие пироги, хоть провайдера меняй. (На стороне киски уже пробовал)
Удаленных офисов более 30, везде нет проблем кроме этого....