>покажи конфиги на кошаке и фрях. На кошаке какие конфиги не знаю... Там все правильно настроено, правда другим админом, точно такими же настройками работал прежний шлюз (прежний шлюз сломался :) и тем более там была фряха 4Х )
# $KAME: racoon.conf.in,v 1.18 2001/08/16 06:33:40 itojun Exp $
path include "/usr/local/etc/racoon";
path pre_shared_key "/usr/local/etc/racoon/psk.txt";
path certificate "/etc/ssh";
log debug2;
padding
{
maximum_length 20; # maximum padding length.
randomize off; # enable randomize length.
strict_check off; # enable strict check.
exclusive_tail off; # extract last one octet.
}
# if no listen directive is specified, racoon will listen on all
# available interface addresses.
listen
{ #isakmp ::1 [7000];
#isakmp 202.249.11.124 [500];
#admin [7002]; # administrative port for racoonctl.
#strict_address; # requires that all addresses must be bound.
isakmp 213.170.75.82 [500];
}
# Specify various default timers.
timer
{
# These value can be changed per remote node.
counter 5; # maximum trying count to send.
interval 20 sec; # maximum interval to resend.
persend 1; # the number of packets per send.
# maximum time to wait for completing each phase.
phase1 15 sec;
phase2 30 sec;
}
remote anonymous
{
exchange_mode main,aggressive;
doi ipsec_doi;
situation identity_only;
#my_identifier asn1dn;
my_identifier address;
#certificate_type x509 "my.cert.pem" "my.key.pem";
nonce_size 16;
initial_contact on;
lifetime time 3600 sec;
proposal_check obey; # obey, strict, or claim
proposal {
encryption_algorithm des;
hash_algorithm sha1;
authentication_method pre_shared_key; # rsasig
dh_group 2;
}
}
sainfo anonymous
{
pfs_group 2;
lifetime time 3600 sec;
encryption_algorithm des;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
}
