>Посмотри, одинаковые ли dh_group указаны в конфиге ракуна и на ДЛинке.
>П.С. А чтоб показать что ты указал не так, надо показать что ты указал.Спасибо я нашол ошибку, но нашол другую:
racoon.conf
path include "/usr/local/etc/racoon" ;
path pre_shared_key "/usr/local/etc/racoon/psk.txt" ;
#path certificate "/usr/local/etc/cert" ; (сертификаты я не использую может в этом проблема)
log notify;
padding
{
maximum_length 20; # maximum padding length.
randomize off; # enable randomize length.
strict_check off; # enable strict check.
exclusive_tail off; # extract last one octet.
}
listen
{
#isakmp ::1 [7000];
isakmp XX.XX.XX.XX [500];
#admin [7002]; # administrative's port by kmpstat.
#strict_address; # required all addresses must be bound.
}
timer
{
# These value can be changed per remote node.
counter 5; # maximum trying count to send.
interval 20 sec; # maximum interval to resend.
persend 1; # the number of packets per a send.
# timer for waiting to complete each phase.
phase1 30 sec;
phase2 15 sec;
}
remote anonymous
{
#exchange_mode main,aggressive;
exchange_mode aggressive,main;
doi ipsec_doi;
situation identity_only;
#my_identifier address;
my_identifier user_fqdn "user@domain.ru";
peers_identifier user_fqdn "user@domain.ru";
#certificate_type x509 "mycert" "mypriv";
nonce_size 16;
lifetime time 10800 sec; # sec,min,hour
initial_contact on;
support_mip6 on;
proposal_check obey; # obey, strict or claim
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key ;
dh_group 2 ;
}
}
sainfo anonymous
{
pfs_group 2;
lifetime time 10800 sec;
encryption_algorithm 3des ;
authentication_algorithm hmac_md5;
compression_algorithm deflate ;
}
racoon.log:
2006-06-07 11:58:38: INFO: respond new phase 1 negotiation: X.X.X.X [500]<=>Y.Y.Y.Y[500]
2006-06-07 11:58:38: INFO: begin Identity Protection mode.
2006-06-07 11:58:38: WARNING: SPI size isn't zero, but IKE proposal.
2006-06-07 11:58:43: NOTIFY: the packet is retransmitted by Y.Y.Y.Y[500].
2006-06-07 11:58:43: WARNING: No ID match.
2006-06-07 11:58:43: INFO: ISAKMP-SA established X.X.X.X[500]-Y.Y.Y.Y[500] spi:2a07a38bb36e7b02:a742018c1518290e
2006-06-07 11:58:49: NOTIFY: the packet is retransmitted by Y.Y.Y.Y[500].
2006-06-07 11:58:54: NOTIFY: the packet is retransmitted by Y.Y.Y.Y[500].
2006-06-07 11:59:04: NOTIFY: the packet is retransmitted by Y.Y.Y.Y[500].
2006-06-07 11:59:35: ERROR: ignore information because the message is too short
настройки D-Link (DI-804HV):
IKE: ike1 - group2 - 3DES - SHA1 - 10800sec
IPSEC: ipsec1 - group2 - ESP - 3DES - MD5 - 10800sec
D-Link log:
Saturday July 22, 2006 13:20:35 Send IKE M1(INIT) : Y.Y.Y.Y --> X.X.X.X
Saturday July 22, 2006 13:20:35 Receive IKE M2(RESP) : X.X.X.X --> Y.Y.Y.Y
Saturday July 22, 2006 13:20:35 Try to match with ENC:3DES AUTH:PSK HASH:SHA1 Group:Group2
Saturday July 22, 2006 13:20:35 Send IKE M3(KEYINIT) : Y.Y.Y.Y --> X.X.X.X
Saturday July 22, 2006 13:20:35 Receive IKE M4(KEYRESP) : X.X.X.X --> Y.Y.Y.Y
Saturday July 22, 2006 13:20:36 Send IKE M5(IDINIT) : Y.Y.Y.Y --> X.X.X.X
Saturday July 22, 2006 13:20:36 Receive IKE M6(IDRESP) : X.X.X.X --> Y.Y.Y.Y
Saturday July 22, 2006 13:20:41 IKED re-TX : IDINIT
Saturday July 22, 2006 13:20:41 Receive IKE M6(IDRESP) : X.X.X.X --> Y.Y.Y.Y
Saturday July 22, 2006 13:20:46 IKED re-TX : IDINIT
Saturday July 22, 2006 13:20:46 Receive IKE M6(IDRESP) : X.X.X.X --> Y.Y.Y.Y
Saturday July 22, 2006 13:21:27 Send IKE (INFO) : delete Y.Y.Y.Y --> X.X.X.X phase 1
Saturday July 22, 2006 13:21:27 IKE phase1 (ISAKMP SA) remove : Y.Y.Y.Y <-> X.X.X.X
Вариант для распечатки
OpenNET: Виртуальная конференция (Public)
(??) on 05-Июн-06, 15:38 
