Добрый день!
может помочь кто нибудь в таком простом вопросе, это оборудование вижу впервые.
все настроил согласно инструкции к действию с cisco.com. но работать vpn отказывается, не могу понять где копать. подскажите пожалуста.

конфигурация cisco 851: (офис)
!version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname chel
!
boot-start-marker
boot-end-marker
!
no logging on
!
aaa new-model
!
!
aaa authentication login clientauth local
aaa authorization network groupathor local
!
aaa session-id common
!
resource policy
!
clock timezone Russia 5
ip subnet-zero
no ip dhcp use vrf connected
no ip dhcp conflict logging
ip dhcp excluded-address 192.168.1.254
!
ip dhcp pool office
   import all
   network 192.168.1.0 255.255.255.0
   domain-name chel
   dns-server 83.167.6.1 83.167.0.5
   default-router 192.168.1.254
!
!
ip cef
no ip domain lookup
ip domain name chel
ip name-server 83.167.6.1
ip name-server 83.167.0.5
!
!
crypto pki trustpoint TP-self-signed-1271205606
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1271205606
revocation-check none
rsakeypair TP-self-signed-1271205606
!
!
crypto pki certificate chain TP-self-signed-1271205606
certificate self-signed 01
  3082024C 308201B5 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
    ...
  2ECD4B94 EE0B3D64 66AAAFE1 B46BABE6 60021EB3 F444325C FBA981C3 9D6654CF
  E28C748C CCB861D2 3CC4BF83 16ED110F
  quit

username ххх privilege 15 secret 5 ххх
!
!
crypto keyring yugs
  pre-shared-key address 0.0.0.0 0.0.0.0 key vrs1
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp profile L2L
   description LAN-to-LAN for yug router(s) connection
   keyring yugs
   match identity address 0.0.0.0
!
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
!
crypto dynamic-map dynmap 5
set transform-set myset
crypto dynamic-map dynmap 10
set transform-set myset
set isakmp-profile L2L
!
!
crypto map mymap 10 ipsec-isakmp dynamic dynmap
!
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
description $ETH-LAN$
ip dhcp relay information option subscriber-id 0.0.0.0
ip address [внеш ip офиса] 255.255.255.128
ip nat outside
ip virtual-reassembly
no ip mroute-cache
duplex auto
speed auto
crypto map mymap
!
interface Vlan1
ip address 192.168.1.254 255.255.255.0
ip nat inside
ip virtual-reassembly
!
ip classless
ip route 0.0.0.0 0.0.0.0 [ip гатевея от провайдера]
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip nat inside source list 1 interface FastEthernet4 overload
!
access-list 1 permit 192.168.1.0 0.0.0.255
!
control-plane
!
!
line con 0
no modem enable
line aux 0
line vty 0 4
privilege level 15
transport input telnet ssh
!
scheduler max-task-time 5000
ntp clock-period 17179858
ntp server 195.54.1.64
end

конфигурация филиала cisco 857 с серым ip выдаваемым динамически провайдером

!version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname yug
!
boot-start-marker
boot-end-marker
!
no logging on
!
no aaa new-model
!
!
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp key vrs1 address [внеш ip офиса]
!
!
crypto ipsec transform-set myset esp-3des esp-sha-hmac
!
crypto map mymap 10 ipsec-isakmp
set peer [внеш ip офиса]
set transform-set myset
match address 100
!
!
crypto pki trustpoint TP-self-signed-1674869857
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1674869857
revocation-check none
rsakeypair TP-self-signed-1674869857
!
!
crypto pki certificate chain TP-self-signed-1674869857
certificate self-signed 01
  3082023F 308201A8 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
    ...
  AD22F6D0 E47D8710 7822EAAF 290F64BD 7D776FF2 A5B54A68 8CFA737D 99864760 3D7E94
      quit
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.2.254
ip dhcp excluded-address 192.168.2.100
ip dhcp excluded-address 192.168.2.10
!
ip dhcp pool plant
   network 192.168.2.0 255.255.255.0
   default-router 192.168.2.254
   dns-server 195.54.2.1 212.57.145.253
!
!
ip cef
no ip domain lookup
ip name-server 195.54.2.1
ip name-server 212.57.145.253
!
!
!
username admin privilege 15 secret 5 ххх
archive
log config
  hidekeys
!
!
!
!
!
interface ATM0
no ip address
no atm auto-configuration
no atm ilmi-keepalive
no atm address-registration
no atm ilmi-enable
dsl operating-mode auto
hold-queue 224 in
!
interface ATM0.1 point-to-point
no snmp trap link-status
pvc 8/35
  pppoe-client dial-pool-number 1
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
ip address 192.168.2.254 255.255.255.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
!
interface Dialer1
ip address negotiated
ip mtu 1492
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
no cdp enable
ppp authentication pap callin
ppp pap sent-username ххх password 0 ххх
crypto map mymap
!
ip route 0.0.0.0 0.0.0.0 Dialer1
ip route 192.168.1.0 255.255.255.0 [внеш ip офиса]
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 600 life 86400 requests 10000
ip nat inside source list 1 interface Dialer1 overload
!
access-list 1 permit 192.168.2.0 0.0.0.255
access-list 100 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
!
control-plane
!
!
line con 0
no modem enable
line aux 0
line vty 0 4
privilege level 15
login local
transport input telnet ssh
!
scheduler max-task-time 5000
end