Приветствую! Есть cisco2811  c2800nm-advipservicesk9-mz.124-25b.bin

Настраиваю тунель, до товарища, находясь за NAT

crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
lifetime 28800
crypto isakmp key masterkey"z" address 212.212.212.212
crypto isakmp keepalive 100 3
!
!
crypto ipsec transform-set z_vpn esp-3des esp-sha-hmac
!
crypto map dzetta_vpn 10 ipsec-isakmp
set peer 212.212.212.212
set security-association lifetime seconds 28800
set transform-set z_vpn
set pfs group2
match address vpn_z
!

interface FastEthernet0/0
crypto map dzetta_vpn

Нат, route делаю как мне нужно...

начинаю пинговать, происходит поднятие тунеля

....
Oct  1 00:45:51.828 MSD: ISAKMP:(0:0:N/A:0):Checking ISAKMP transform 1 against priority 10 policy
Oct  1 00:45:51.828 MSD: ISAKMP:      encryption 3DES-CBC
Oct  1 00:45:51.828 MSD: ISAKMP:      hash SHA
Oct  1 00:45:51.828 MSD: ISAKMP:      default group 2
Oct  1 00:45:51.828 MSD: ISAKMP:      auth pre-share
Oct  1 00:45:51.828 MSD: ISAKMP:      life type in seconds
Oct  1 00:45:51.828 MSD: ISAKMP:      life duration (basic) of 28800
Oct  1 00:45:51.828 MSD: ISAKMP:(0:0:N/A:0):atts are acceptable. Next payload is 0
Oct  1 00:45:51.832 MSD: CryptoEngine0: generating alg parameter for connid 1
Oct  1 00:45:51.868 MSD: CRYPTO_ENGINE: Dh phase 1 status: 0
Oct  1 00:45:51.868 MSD: CRYPTO_ENGINE: Dh phase 1 status: OK
Oct  1 00:45:51.868 MSD: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Oct  1 00:45:51.868 MSD: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM2  New State = IKE_I_MM2

Oct  1 00:45:51.868 MSD: ISAKMP:(0:1:SW:1): sending packet to 212.212.212.212 my_port 500 peer_port 500 (I) MM_SA_SETUP
Oct  1 00:45:51.868 MSD: ISAKMP:(0:1:SW:1):Input = IK.E_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Oct  1 00:45:51.868 MSD: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM2  New State = IKE_I_MM3

Oct  1 00:45:52.244 MSD: ISAKMP (0:134217729): received packet from 212.212.212.212 dport 500 sport 500 Global (I) MM_SA_SETUP
Oct  1 00:45:52.244 MSD: ISAKMP:(0:1:SW:1):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH
Oct  1 00:45:52.244 MSD: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM3  New State = IKE_I_MM4

Oct  1 00:45:52.244 MSD: ISAKMP:(0:1:SW:1): processing KE payload. message ID = 0
Oct  1 00:45:52.244 MSD: CryptoEngine0: generating alg parameter for connid 0
Oct  1 00:45:52.292 MSD: ISAKMP:(0:1:SW:1): processing NONCE payload. message ID = 0
Oct  1 00:45:52.292 MSD: ISAKMP:(0:1:SW:1):found peer pre-shared key matching 212.212.212.212
Oct  1 00:45:52.292 MSD: CryptoEngine0: create ISAKMP SKEYID for conn id 1
Oct  1 00:45:52.292 MSD: ISAKMP:(0:1:SW:1):SKEYID state generated
Oct  1 00:45:52.292 MSD: ISAKMP:(0:1:SW:1): processing vendor id payload
Oct  1 00:45:52.292 MSD: ISAKMP:(0:1:SW:1): vendor ID is DPD
Oct  1 00:45:52.292 MSD: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_MAIN_MODE
Oct  1 00:45:52.292 MSD: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM4  New State = IKE_I_MM4

Oct  1 00:45:52.296 MSD: ISAKMP:(0:1:SW:1):Send initial contact
Oct  1 00:45:52.296 MSD: ISAKMP:(0:1:SW:1):SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
Oct  1 00:45:52.296 MSD: ISAKMP (0:134217729): ID payload
        next-payload : 8
        type         : 1
        address      : 192.168.1.1
        protocol     : 17
        port         : 500
        length       : 12
Oct  1 00:50:06.464 MSD: ISAKMP:(0:1:SW:1):Total payload length: 12
Oct  1 00:50:06.464 MSD: CryptoEngine0: generate hmac context. for conn id 1
Oct  1 00:50:06.464 MSD: ISAKMP:(0:1:SW:1): sending packet to 212.212.212.212 my_port 500 peer_port 500 (I) MM_KEY_EXCH
Oct  1 00:50:06.464 MSD: ISAKMP:(0:1:SW:1):Input = IKE_MESG_INTERNAL, IKE_PROCESS_COMPLETE
Oct  1 00:50:06.464 MSD: ISAKMP:(0:1:SW:1):Old State = IKE_I_MM4  New State = IKE_I_MM5
Oct  1 00:50:35.972 MSD: ISAKMP: received ke message (1/1)
Oct  1 00:50:35.972 MSD: ISAKMP: set new node 0 to QM_IDLE
Oct  1 00:50:35.972 MSD: ISAKMP:(0:1:SW:1):SA is still budding. Attached new ipsec request to it. (local 192.168.64.252, remote 212.176.25.252)
Oct  1 00:50:36.464 MSD: ISAKMP:(0:1:SW:1): retransmitting phase 1 MM_KEY_EXCH...
Oct  1 00:50:36.464 MSD: ISAKMP (0:134217729): incrementing error counter on sa, attempt 3 of 5: retransmit phase 1
... и опять и снова..

насколько я понял, не проходит авторизация, т.к. SA is doing pre-shared key authentication using id type ID_IPV4_ADDR
авторизируясь, в качестве ID_IPV4_ADDR посылается локальный айпи 192.168.1.1, что видно из ID payload... а надо-бы указать внешний... как это сделать? помогите советом!

заранее спасибо!