Есть задача связаться с двумя хостами через VPN, с одной стороны linux и racoon с другой cisco

linux = 1.1.1.1
cisco = 2.2.2.2
host1 за циской = 192.168.0.1
host2 за циской = 192.168.1.1

конфы:

#!/sbin/setkey -f
                                                                                                                                                                                  
flush;
spdflush;                                                                                                                                                                          
spdadd 1.1.1.1 192.168.0.1 any -P out ipsec esp/tunnel/1.1.1.1-2.2.2.2/require;
spdadd 192.168.0.1 1.1.1.1 any -P in  ipsec esp/tunnel/2.2.2.2-1.1.1.1/require;
spdadd 1.1.1.1 192.168.1.1 any -P out ipsec esp/tunnel/1.1.1.1-2.2.2.2/require;
spdadd 192.168.1.1 1.1.1.1 any -P in  ipsec esp/tunnel/2.2.2.2-1.1.1.1/require;

racoon.conf

path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";
path include "/etc/racoon";
log notify;
                                                                                                                                                                                  
padding {                                                                                                                                                                          
            maximum_length 20;
            randomize off;
            strict_check off;
            exclusive_tail off;
}                                                                                                                                                                                  
                                                                                                                                                                                  
listen {                                                                                                                                                                          
        isakmp 1.1.1.1 [500];
}

remote 2.2.2.2 {
        exchange_mode mail,aggressive;
        doi ipsec_doi;
        situation identity_only;
                                                                                                                                                                                  
        my_identifier address 1.1.1.1;
                                                                                                                                                                                  
        nonce_size 16;
                                                                                                                                                                                  
        initial_contact on;
        proposal_check strict;
        proposal {
                lifetime time 3600 sec;
                encryption_algorithm 3des;
                hash_algorithm sha1;
                authentication_method pre_shared_key;
                dh_group 2;
        }
}                                                                                                                                                                                  
                                                                                                                                                                                  
sainfo address 1.1.1.1 any address 192.168.0.1 any {                                                                                                                    
        lifetime time 3600 sec;
        encryption_algorithm 3des;
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate;
}                                                                                                                                                                                  
                                                                                                                                                                                  
sainfo address 1.1.1.1 any address 192.168.1.1 any {                                                                                                                      
        lifetime time 3600 sec;
        encryption_algorithm 3des;
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate;
}

после запуска racoon пингую хост 1922.168.0.1 - пингуется, в логах пишет, что тунель поднят, но второй хост не пингуется без сообщений в логах
перезапускаю racoon и начинаю пингать 192.168.1.1 - пингуется, в логах опять-таки все нормально, но теперь первый хост не пингуется
как решить ?