Здравствуйте!

Не получается установить соединение Site-to-Site между Cisco 2900 (C2900-UNIVERSALK9-M), Version 15.4(3)M6a, RELEASE SOFTWARE (fc1) и, Microsoft Forefront TMG 2010 (Version: 7.0.9193.500). TMG находится за NAT C2951 (Version 15.0(1r)M13, RELEASE SOFTWARE (fc1)).

Схема соединения:

(10.72.0.0/16) С2900 (х.х.37.29) ---Internet--- (x.x.199.5) С2951 NAT (192.168.11.1) --- (192.168.11.3) TMG2010 (172.16.0.0/24)

Первая фаза соединения завершается нормально:
355510: Jan 25 09:21:42.063 YEKT: ISAKMP:(6300):Old State = IKE_P1_COMPLETE  New State = IKE_P1_COMPLETE

CR02#sh cry is sa
IPv4 Crypto ISAKMP SA
dst             src        state          conn-id status
x.x.37.29    x.x.199.5    QM_IDLE           6300 ACTIVE

А вот вторая фаза - не устанавливается. Причем пытается, но не выходит с разным результатом через раз! Лог:

==== 1 попытка!
355511: Jan 25 09:21:42.119 YEKT: ISAKMP (6300): received packet from x.x.199.5 dport 4500 sport 4500 Global (R) QM_IDLE
355512: Jan 25 09:21:42.119 YEKT: ISAKMP: set new node 1 to QM_IDLE
355513: Jan 25 09:21:42.119 YEKT: ISAKMP:(6300): processing HASH payload. message ID = 1
355514: Jan 25 09:21:42.119 YEKT: ISAKMP:(6300): processing SA payload. message ID = 1
355515: Jan 25 09:21:42.119 YEKT: ISAKMP:(6300):Checking IPSec proposal 1
355516: Jan 25 09:21:42.119 YEKT: ISAKMP: transform 1, ESP_3DES
355517: Jan 25 09:21:42.119 YEKT: ISAKMP:   attributes in transform:
355518: Jan 25 09:21:42.119 YEKT: ISAKMP:      encaps is 3 (Tunnel-UDP)
355519: Jan 25 09:21:42.119 YEKT: ISAKMP:      authenticator is HMAC-SHA
355520: Jan 25 09:21:42.119 YEKT: ISAKMP:      group is 2
355521: Jan 25 09:21:42.119 YEKT: ISAKMP:      SA life type in seconds
355522: Jan 25 09:21:42.119 YEKT: ISAKMP:      SA life duration (VPI) of  0x0 0x0 0x70 0x80
355523: Jan 25 09:21:42.119 YEKT: ISAKMP:      SA life type in kilobytes
355524: Jan 25 09:21:42.119 YEKT: ISAKMP:      SA life duration (VPI) of  0x0 0x46 0x50 0x0
355525: Jan 25 09:21:42.119 YEKT: ISAKMP:(6300):atts are acceptable.

==== 1 попытка. Ошибка одна!
355526: Jan 25 09:21:42.119 YEKT: IPSEC(ipsec_process_proposal): proxy identities not supported
355527: Jan 25 09:21:42.119 YEKT: ISAKMP:(6300): IPSec policy invalidated proposal with error 32
355528: Jan 25 09:21:42.123 YEKT: ISAKMP:(6300): phase 2 SA policy not acceptable! (local х.х.37.29 remote х.х.199.5)
355529: Jan 25 09:21:42.123 YEKT: ISAKMP: set new node -54067319 to QM_IDLE
355530: Jan 25 09:21:42.123 YEKT: ISAKMP:(6300):Sending NOTIFY PROPOSAL_NOT_CHOSEN protocol 3 spi 568588472, message ID = 4240899977
355531: Jan 25 09:21:42.123 YEKT: ISAKMP:(6300): sending packet to х.х.199.5my_port 4500 peer_port 4500 (R) QM_IDLE
355532: Jan 25 09:21:42.123 YEKT: ISAKMP:(6300):Sending an IKE IPv4 Packet.
355533: Jan 25 09:21:42.123 YEKT: ISAKMP:(6300):purging node -54067319
355534: Jan 25 09:21:42.123 YEKT: ISAKMP:(6300):deleting node 1 error TRUE reason "QM rejected"
355535: Jan 25 09:21:42.123 YEKT: ISAKMP:(6300):Node 1, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
355536: Jan 25 09:21:42.123 YEKT: ISAKMP:(6300):Old State = IKE_QM_READY  New State = IKE_QM_READY

==== 2 попытка!
355537: Jan 25 09:21:44.395 YEKT: ISAKMP (6300): received packet from х.х.199.5 dport 4500 sport 4500 Global (R) QM_IDLE
355538: Jan 25 09:21:44.395 YEKT: ISAKMP: set new node 2 to QM_IDLE
355539: Jan 25 09:21:44.395 YEKT: ISAKMP:(6300): processing HASH payload. message ID = 2
355540: Jan 25 09:21:44.395 YEKT: ISAKMP:(6300): processing SA payload. message ID = 2
355541: Jan 25 09:21:44.395 YEKT: ISAKMP:(6300):Checking IPSec proposal 1
355542: Jan 25 09:21:44.395 YEKT: ISAKMP: transform 1, ESP_3DES
355543: Jan 25 09:21:44.395 YEKT: ISAKMP:   attributes in transform:
355544: Jan 25 09:21:44.395 YEKT: ISAKMP:      encaps is 3 (Tunnel-UDP)
355545: Jan 25 09:21:44.395 YEKT: ISAKMP:      authenticator is HMAC-SHA
355546: Jan 25 09:21:44.395 YEKT: ISAKMP:      group is 2
355547: Jan 25 09:21:44.395 YEKT: ISAKMP:      SA life type in seconds
355548: Jan 25 09:21:44.395 YEKT: ISAKMP:      SA life duration (VPI) of  0x0 0x0 0x70 0x80
355549: Jan 25 09:21:44.395 YEKT: ISAKMP:      SA life type in kilobytes
355550: Jan 25 09:21:44.395 YEKT: ISAKMP:      SA life duration (VPI) of  0x0 0x46 0x50 0x0
355551: Jan 25 09:21:44.395 YEKT: ISAKMP:(6300):atts are acceptable.
355552: Jan 25 09:21:44.419 YEKT: ISAKMP:(6300): processing KE payload. message ID = 2
355553: Jan 25 09:21:44.443 YEKT: ISAKMP:(6300): processing NONCE payload. message ID = 2
355554: Jan 25 09:21:44.443 YEKT: ISAKMP:(6300): processing ID payload. message ID = 2
355555: Jan 25 09:21:44.443 YEKT: ISAKMP:(6300): processing ID payload. message ID = 2
355556: Jan 25 09:21:44.443 YEKT: ISAKMP:(6300):QM Responder gets spi
355557: Jan 25 09:21:44.443 YEKT: ISAKMP:(6300):Node 2, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH
355558: Jan 25 09:21:44.443 YEKT: ISAKMP:(6300):Old State = IKE_QM_READY  New State = IKE_QM_SPI_STARVE
355559: Jan 25 09:21:44.447 YEKT: ISAKMP:(6300):Node 2, Input = IKE_MESG_INTERNAL, IKE_GOT_SPI
355560: Jan 25 09:21:44.447 YEKT: ISAKMP:(6300):Old State = IKE_QM_SPI_STARVE  New State = IKE_QM_IPSEC_INSTALL_AWAIT
355561: Jan 25 09:21:44.447 YEKT: IPSEC(crypto_ipsec_sa_find_ident_head): reconnecting with the same proxies and peer х.х.199.5
355562: Jan 25 09:21:44.447 YEKT: IPSEC(create_sa): sa created,
  (sa) sa_dest= х.х.37.29, sa_proto= 50,
    sa_spi= 0x67F55285(1744130693),
    sa_trans= esp-3des esp-sha-hmac , sa_conn_id= 5125
    sa_lifetime(k/sec)= (4608000/3600),
  (identity) local= х.х.37.29:0, remote= х.х.199.5:0,
    local_proxy= 10.72.0.0/255.255.0.0/256/0,
    remote_proxy= 172.16.0.0/255.255.0.0/256/0
355563: Jan 25 09:21:44.447 YEKT: IPSEC(create_sa): sa created,
  (sa) sa_dest= х.х.199.5, sa_proto= 50,
    sa_spi= 0xAB691798(2875791256),
    sa_trans= esp-3des esp-sha-hmac , sa_conn_id= 5126
    sa_lifetime(k/sec)= (4608000/3600),
  (identity) local= х.х.37.29:0, remote= х.х.199.5:0,
    local_proxy= 10.72.0.0/255.255.0.0/256/0,
    remote_proxy= 172.16.0.0/255.255.0.0/256/0
355564: Jan 25 09:21:44.447 YEKT: ISAKMP:(6300):Received IPSec Install callback... proceeding with the negotiation
355565: Jan 25 09:21:44.447 YEKT: ISAKMP:(6300):Successfully installed IPSEC SA (SPI:0x67F55285) on Port-channel1.82
355566: Jan 25 09:21:44.455 YEKT: ISAKMP:(6300): sending packet to х.х.199.5 my_port 4500 peer_port 4500 (R) QM_IDLE
355567: Jan 25 09:21:44.455 YEKT: ISAKMP:(6300):Sending an IKE IPv4 Packet.
355568: Jan 25 09:21:44.455 YEKT: ISAKMP:(6300):Node 2, Input = IKE_MESG_FROM_IPSEC, IPSEC_INSTALL_DONE
355569: Jan 25 09:21:44.455 YEKT: ISAKMP:(6300):Old State = IKE_QM_IPSEC_INSTALL_AWAIT  New State = IKE_QM_R_QM2

==== 2 попытка. Ошибка другая!
355570: Jan 25 09:21:54.455 YEKT: ISAKMP:(6300): retransmitting phase 2 QM_IDLE       2 ...
355571: Jan 25 09:21:54.455 YEKT: ISAKMP (6300): incrementing error counter on node, attempt 1 of 5: retransmit phase 2
355572: Jan 25 09:21:54.455 YEKT: ISAKMP:(6300): retransmitting phase 2 2 QM_IDLE
355573: Jan 25 09:21:54.455 YEKT: ISAKMP:(6300): sending packet to х.х.199.5 my_port 4500 peer_port 4500 (R) QM_IDLE
355574: Jan 25 09:21:54.455 YEKT: ISAKMP:(6300):Sending an IKE IPv4 Packet.
355575: Jan 25 09:22:04.455 YEKT: ISAKMP:(6300): retransmitting phase 2 QM_IDLE       2 ...
355576: Jan 25 09:22:04.455 YEKT: ISAKMP (6300): incrementing error counter on node, attempt 2 of 5: retransmit phase 2
355577: Jan 25 09:22:04.455 YEKT: ISAKMP:(6300): retransmitting phase 2 2 QM_IDLE
355578: Jan 25 09:22:04.455 YEKT: ISAKMP:(6300): sending packet to х.х.199.5 my_port 4500 peer_port 4500 (R) QM_IDLE
355579: Jan 25 09:22:04.455 YEKT: ISAKMP:(6300):Sending an IKE IPv4 Packet.
355581: Jan 25 09:22:09.703 YEKT: IPSEC(ipsec_process_proposal): proxy identities not supported
355582: Jan 25 09:22:14.455 YEKT: ISAKMP:(6300): retransmitting phase 2 QM_IDLE       2 ...
355583: Jan 25 09:22:14.455 YEKT: ISAKMP (6300): incrementing error counter on node, attempt 3 of 5: retransmit phase 2
355584: Jan 25 09:22:14.455 YEKT: ISAKMP:(6300): retransmitting phase 2 2 QM_IDLE
355585: Jan 25 09:22:14.455 YEKT: ISAKMP:(6300): sending packet to х.х.199.5 my_port 4500 peer_port 4500 (R) QM_IDLE
355586: Jan 25 09:22:14.455 YEKT: ISAKMP:(6300):Sending an IKE IPv4 Packet.
355587: Jan 25 09:22:24.455 YEKT: ISAKMP:(6300): retransmitting phase 2 QM_IDLE       2 ...
355588: Jan 25 09:22:24.455 YEKT: ISAKMP (6300): incrementing error counter on node, attempt 4 of 5: retransmit phase 2
355589: Jan 25 09:22:24.455 YEKT: ISAKMP:(6300): retransmitting phase 2 2 QM_IDLE
355590: Jan 25 09:22:24.455 YEKT: ISAKMP:(6300): sending packet to х.х.199.5 my_port 4500 peer_port 4500 (R) QM_IDLE
355591: Jan 25 09:22:24.455 YEKT: ISAKMP:(6300):Sending an IKE IPv4 Packet.
355592: Jan 25 09:22:32.123 YEKT: ISAKMP:(6300):purging node 1
355593: Jan 25 09:22:34.455 YEKT: ISAKMP:(6300): retransmitting phase 2 QM_IDLE       2 ...
355594: Jan 25 09:22:34.455 YEKT: ISAKMP (6300): incrementing error counter on node, attempt 5 of 5: retransmit phase 2
355595: Jan 25 09:22:34.455 YEKT: ISAKMP:(6300): retransmitting phase 2 2 QM_IDLE
355596: Jan 25 09:22:34.455 YEKT: ISAKMP:(6300): sending packet to х.х.199.5 my_port 4500 peer_port 4500 (R) QM_IDLE
355597: Jan 25 09:22:34.455 YEKT: ISAKMP:(6300):Sending an IKE IPv4 Packet.
355598: Jan 25 09:22:39.703 YEKT: IPSEC(ipsec_process_proposal): proxy identities not supported
355599: Jan 25 09:22:44.455 YEKT: ISAKMP:(6300): retransmitting phase 2 QM_IDLE       2 ...
355600: Jan 25 09:22:44.455 YEKT: ISAKMP:(6300):deleting node 2 error TRUE reason "Phase 2 err count exceeded"
355601: Jan 25 09:22:44.455 YEKT: ISAKMP:(6300):peer does not do paranoid keepalives.
355602: Jan 25 09:22:44.455 YEKT: ISAKMP:(6300):Enqueued KEY_MGR_DELETE_SAS for IPSEC SA (SPI:0xAB691798)
355603: Jan 25 09:22:44.455 YEKT: ISAKMP:(6300): QM node retransmission timeout, deleting all the IKE and IPSec SA
355604: Jan 25 09:22:44.455 YEKT: IPSEC: delete incomplete sa: 0x40020890
355605: Jan 25 09:22:44.455 YEKT: IPSEC(key_engine_delete_sas): delete SA with spi 0xAB691798 proto 50 for х.х.199.5
355606: Jan 25 09:22:44.455 YEKT: IPSEC(update_current_outbound_sa): updated peer х.х.199.5 current outbound sa to SPI 0
355607: Jan 25 09:22:44.455 YEKT: IPSEC(send_delete_notify_kmi): not sending KEY_ENGINE_DELETE_SAS

Вернее ошибка всегда одна = IPSEC(ipsec_process_proposal): proxy identities not supported = но возникает на разных стадиях почему-то...

Прошу помочь с решением данной проблемы. Жду вопросов/предложений. Очень надо...

Заранее благодарю!