Здравствуйте.

Подскажите если кому удавалось соединить циску и ХР по L2TP IPSec, в чем может быть у меня проблема. Есть 2811 на нем уже работал ВПН по РРТР. РРТР был настроен через vpdn. При конекте ХР клиентов по РРТР радиус им выдавал ИП. Эта сеточка которую раздавал радиус имеет определенные права и привилегии. Теперь есть необходимость к 2811 по ВПН подключить 871 циску. Так как  циска не может быть РРТР клиентом то решено было соеденить 2 циски по L2TP IPsec. Здача состоит в том что бы как и раньше радиус выдавал ИП L2TP клиентам. Для этого опять я подлючил vpdn. Так как циска 871 еще не куплена я хотел попробовать эту схему с ХР, но застрял вот на этом:

May 26 16:39:31 192.168.1.2 13647: *May 26 13:45:59.541: IPSEC(crypto_ipsec_process_proposal): invalid transform proposal flags -- 0x4
May 26 16:39:31 192.168.1.2 13648: *May 26 13:45:59.541: ISAKMP:(1013): IPSec policy invalidated proposal with error 1024
May 26 16:39:31 192.168.1.2 13649: *May 26 13:45:59.541: IPSEC(crypto_ipsec_process_proposal): transform proposal not supported for identity:
May 26 16:39:31 192.168.1.2 13650:     {esp-3des esp-sha-hmac }
May 26 16:39:31 192.168.1.2 13651: *May 26 13:45:59.541: ISAKMP:(1013): IPSec policy invalidated proposal with error 256
May 26 16:39:31 192.168.1.2 13652: *May 26 13:45:59.541: IPSEC(crypto_ipsec_process_proposal): transform proposal not supported for identity:
May 26 16:39:31 192.168.1.2 13653:     {ah-sha-hmac esp-3des }
May 26 16:39:31 192.168.1.2 13654: *May 26 13:45:59.541: ISAKMP:(1013): IPSec policy invalidated proposal with error 256
May 26 16:39:31 192.168.1.2 13655: *May 26 13:45:59.541: IPSEC(crypto_ipsec_process_proposal): invalid transform proposal flags -- 0x4
May 26 16:39:31 192.168.1.2 13656: *May 26 13:45:59.541: ISAKMP:(1013): IPSec policy invalidated proposal with error 1024
May 26 16:39:31 192.168.1.2 13657: *May 26 13:45:59.541: IPSEC(crypto_ipsec_process_proposal): transform proposal not supported for identity:
May 26 16:39:31 192.168.1.2 13658:     {ah-sha-hmac esp-3des esp-sha-hmac }
May 26 16:39:31 192.168.1.2 13659: *May 26 13:45:59.541: ISAKMP:(1013): IPSec policy invalidated proposal with error 256
May 26 16:39:31 192.168.1.2 13660: *May 26 13:45:59.541: IPSEC(crypto_ipsec_process_proposal): transform proposal not supported for identity:
May 26 16:39:31 192.168.1.2 13661:     {ah-md5-hmac esp-3des esp-md5-hmac }
May 26 16:39:31 192.168.1.2 13662: *May 26 13:45:59.541: ISAKMP:(1013): IPSec policy invalidated proposal with error 256
May 26 16:39:31 192.168.1.2 13663: *May 26 13:45:59.541: IPSEC(crypto_ipsec_process_proposal): transform proposal not supported for identity:
May 26 16:39:31 192.168.1.2 13664:     {esp-des esp-md5-hmac }
May 26 16:39:31 192.168.1.2 13665: *May 26 13:45:59.541: ISAKMP:(1013): IPSec policy invalidated proposal with error 256
May 26 16:39:31 192.168.1.2 13666: *May 26 13:45:59.541: IPSEC(crypto_ipsec_process_proposal): transform proposal not supported for identity:
May 26 16:39:31 192.168.1.2 13667:     {esp-des esp-sha-hmac }
May 26 16:39:31 192.168.1.2 13668: *May 26 13:45:59.541: ISAKMP:(1013): IPSec policy invalidated proposal with error 256
May 26 16:39:31 192.168.1.2 13669: *May 26 13:45:59.545: IPSEC(crypto_ipsec_process_proposal): transform proposal not supported for identity:
May 26 16:39:31 192.168.1.2 13670:     {ah-sha-hmac esp-des }
May 26 16:39:31 192.168.1.2 13671: *May 26 13:45:59.545: ISAKMP:(1013): IPSec policy invalidated proposal with error 256
May 26 16:39:31 192.168.1.2 13672: *May 26 13:45:59.545: IPSEC(crypto_ipsec_process_proposal): transform proposal not supported for identity:
May 26 16:39:31 192.168.1.2 13673:     {ah-md5-hmac esp-des }
May 26 16:39:31 192.168.1.2 13674: *May 26 13:45:59.545: ISAKMP:(1013): IPSec policy invalidated proposal with error 256
May 26 16:39:31 192.168.1.2 13675: *May 26 13:45:59.545: IPSEC(crypto_ipsec_process_proposal): transform proposal not supported for identity:
May 26 16:39:31 192.168.1.2 13676:     {ah-sha-hmac esp-des esp-sha-hmac }
May 26 16:39:31 192.168.1.2 13677: *May 26 13:45:59.545: ISAKMP:(1013): IPSec policy invalidated proposal with error 256
May 26 16:39:31 192.168.1.2 13678: *May 26 13:45:59.545: IPSEC(crypto_ipsec_process_proposal): transform proposal not supported for identity:
May 26 16:39:31 192.168.1.2 13679:     {ah-md5-hmac esp-des esp-md5-hmac }
May 26 16:39:31 192.168.1.2 13680: *May 26 13:45:59.545: ISAKMP:(1013): IPSec policy invalidated proposal with error 256
May 26 16:39:31 192.168.1.2 13681: *May 26 13:45:59.545: IPSEC(crypto_ipsec_process_proposal): transform proposal not supported for identity:
May 26 16:39:31 192.168.1.2 13682:     {esp-null esp-sha-hmac }
May 26 16:39:31 192.168.1.2 13683: *May 26 13:45:59.545: ISAKMP:(1013): IPSec policy invalidated proposal with error 256
May 26 16:39:31 192.168.1.2 13684: *May 26 13:45:59.545: IPSEC(crypto_ipsec_process_proposal): transform proposal not supported for identity:
May 26 16:39:31 192.168.1.2 13685:     {esp-null esp-md5-hmac }
May 26 16:39:31 192.168.1.2 13686: *May 26 13:45:59.545: ISAKMP:(1013): IPSec policy invalidated proposal with error 256
May 26 16:39:31 192.168.1.2 13687: *May 26 13:45:59.545: IPSEC(crypto_ipsec_process_proposal): transform proposal not supported for identity:
May 26 16:39:32 192.168.1.2 13691:     {ah-md5-hmac }
May 26 16:39:32 192.168.1.2 13692: *May 26 13:45:59.545: ISAKMP:(1013): IPSec policy invalidated proposal with error 256
May 26 16:39:32 192.168.1.2 13693: *May 26 13:45:59.545: ISAKMP:(1013): phase 2 SA policy not acceptable! (local 192.168.1.2 remote 192.168.1.222)
May 26 16:39:32 192.168.1.2 13694: *May 26 13:45:59.549: ISAKMP:(1013):deleting node 676744708 error TRUE reason "QM rejected"

виндовый IPSec настраивал как написано тут http://www.ixbt.com/comm/wrls-ovislink-wmu-9000vpn_2.shtml только вместо SHA1 я ставил MD5.

Вот конфиг циски
vpdn-group 2
! Default L2TP VPDN group
accept-dialin
  protocol l2tp
  virtual-template 2

crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key test address 192.168.1.222
!
!
crypto ipsec transform-set teebot1 esp-3des esp-md5-hmac
!
crypto map teebot 1 ipsec-isakmp
set peer 192.168.1.222
set security-association lifetime seconds 190
set transform-set teebot1
match address ipsec

interface Virtual-Template2
ip unnumbered FastEthernet0/0.10
ip virtual-reassembly
ip route-cache policy
ppp authentication ms-chap-v2 ms-chap callin
crypto map teebot

ip access-list extended ipsec
permit ip host 192.168.1.2 192.168.1.0 0.0.0.255
permit ip 192.168.1.0 0.0.0.255 host 192.168.1.2

Даже не знаю что еще добавить. Из лога видно что проблема в трасформ мапе, но я уже перепробовал все что мог ошибка не исчезает.