Поднял я isakmpd на OpenBSD, конфиг вот такой:
---
[General]
Default-phase-1-lifetime=3600,60:86400
Default-phase-2-lifetime=1200,60:86400
Policy-File=/etc/isakmpd/isakmpd.policy
[Phase 1]
Default=ISAKMP-clients
[Phase 2]
Passive-Connections=IPsec-clients
[ISAKMP-clients]
Phase=1
Transport=udp
Configuration=Open-main-mode
Authentication=blah-blah-blah
[IPsec-clients]
Phase=2
Configuration=Open-quick-mode
Local-ID=my-host
Remote-ID=remote-net
[my-host]
ID-type=IPV4_ADDR_SUBNET
Network=0.0.0.0
Netmask=0.0.0.0
[remote-net]
ID-type=IPV4_ADDR
Address=0.0.0.0
[Open-main-mode]
DOI=IPSEC
EXCHANGE_TYPE=ID_PROT
Transforms=3DES-SHA
[Open-quick-mode]
DOI=IPSEC
EXCHANGE_TYPE=QUICK_MODE
Suites=QM-ESP-AES-SHA-PFS-SUITE
---
Потом взял программу ipsec.exe от Marcus Mueller и скормил ей вот такой конфиг:

---
conn tunnel
left=%any
right=1.2.3.4
rightsubnet=192.168.0.0/255.255.255.0
presharedkey=blah-blah-blah
network=ras
auto=start
pfs=yes
---

После чего, звоню провайдеру, и запускаю ipsec.exe, но isakmpd ругается вот так:

---
Oct 19 15:48:35 shield isakmpd[2264]: check_policy: negotiated SA failed policy check
Oct 19 15:48:35 shield isakmpd[2264]: message_negotiate_sa: no compatible proposal found
Oct 19 15:48:35 shield isakmpd[2264]: dropped message from x.x.x.x port 500 due to notification type NO_PROPOSAL_CHOSEN
Oct 19 15:48:35 shield isakmpd[2264]: responder_recv_HASH_SA_NONCE: KEY_EXCH payload without a group desc. attribute
Oct 19 15:48:35 shield isakmpd[2264]: dropped message from x.x.x.x port 500 due to notification type NO_PROPOSAL_CHOSEN
Oct 19 15:48:35 shield isakmpd[2264]: responder_recv_HASH_SA_NONCE: KEY_EXCH payload without a group desc. attribute
Oct 19 15:48:35 shield isakmpd[2264]: dropped message from x.x.x.x port 500 due to notification type NO_PROPOSAL_CHOSEN
Oct 19 15:48:35 shield isakmpd[2264]: responder_recv_HASH_SA_NONCE: KEY_EXCH payload without a group desc. attribute
Oct 19 15:48:35 shield isakmpd[2264]: dropped message from x.x.x.x port 500 due to notification type NO_PROPOSAL_CHOSEN
Oct 19 15:48:35 shield isakmpd[2264]: responder_recv_HASH_SA_NONCE: KEY_EXCH payload without a group desc. attribute
Oct 19 15:48:35 shield isakmpd[2264]: dropped message from x.x.x.x port 500 due to notification type NO_PROPOSAL_CHOSEN
Oct 19 15:48:35 shield isakmpd[2264]: responder_recv_HASH_SA_NONCE: KEY_EXCH payload without a group desc. attribute
Oct 19 15:48:35 shield isakmpd[2264]: dropped message from x.x.x.x port 500 due to notification type NO_PROPOSAL_CHOSEN
Oct 19 15:48:35 shield isakmpd[2264]: group_get: group ID (0) out of range
---
и во внутреннюю сеть не пушшает. Что я не так сделал ?