народ подскажите плиз по пунктам что куда нужно воткнуть
чтобы заработал тунель между DFL-900 - DFL-200.
на форуме встречал что много у кого эта схема уже работает.
Заранее всем благодарен.

а что именно не получается ?

настроить IPSec в dfl-200
настроить IPsec в dfl-900
Главное, чтобы все параметры туннеля обоих устройств, включая методы шифрования и хеширования были одинковые.

DFL-900 WAN1(88.22.8.120):
IKE Rule Name: sklad
-------------------------------------------------
Condition
-------------------------------------------------
Local Address Type: subnet
IP Address: 192.168.100.0
PrefixLen / Subnet Mask: 255.255.255.0
Remote Address Type: subnet
IP Address: 192.168.1.0
PrefixLen / Subnet Mask: 255.255.255.0
-------------------------------------------------
Action
-------------------------------------------------
Negotiation Mode: Main
Encapsulation Mode: Tunel
Outgoing Interface: WAN1
Peer's IP Address: 88.22.8.121 (dfl-200)
My Identifier: IP Adress: Auto_Assigned
Peer's Identifier: IP Adress: Auto_Assigned
ESP Algorithm: Encrypt and Authenticate (DES, MD5)
Pre-Shared Key : 123456789
-------------------------------------------------
Advanced:
-------------------------------------------------
Transport Layer Protocol: TCP
-------------------------------------------------
Action
-------------------------------------------------
Enable Replay Detection: NO
-------------------------------------------------
Phase 1
Negotiation Mode: Main
Pre-Shared Key: 123456789
Encryption Algorithm: Encrypt and Authenticate (DES, MD5)
SA Life Time: 28800 sec
Key Group: DH2
-------------------------------------------------
Phase 2
Encapsulation: Tunne
Active Protocol: ESP
Encryption Algorithm: Encrypt and Authenticate (DES, MD5)
SA Life Time: 28800 sec
Perfect Forward Secrecy(PFS): DH1
-------------------------------------------------

Edit/Modify IPSec Security Associations
Item Status Condition Action
# Active Name Local LAN Remote LAN Mechanism My IP Peer's IP
1 Y sklad 192.168.100.0/24 192.168.1.0/24 Tunnel - ESP ( DES MD5 ) 81.2.8.120 81.2.8.121

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
DFL-200 WAN1 (88.22.8.121)

IPsec Tunnels
Name Local Net Remote Net Remote Gateway
sklad 192.168.1.0/24 192.168.100.0/24 81.2.8.120 [Edit]

Edit IPsec tunnel sklad:
Name: sklad
Local Net: 192.168.1.0/24

Authentication:

PSK - Pre-Shared Key
PSK: 123456789
Retype PSK: 123456789


Tunnel type:

LAN-to-LAN tunnel
Remote Net: 192.168.100.0/24
Remote Gateway: 88.22.8.120 (DFL-900)
The gateway can be a numerical IP address, DNS name, or range of IP addresses for roaming / NATed gateways.

Route: Automatically add a route for the remote network.
Proxy ARP: Publish remote network on all interfaces via Proxy ARP.
IKE XAuth client: Pass username and password to peer via IKE XAuth, if the remote gateway requires it.
XAuth Username: -
XAuth Password: -

ADVANCED:

Edit advanced settings of IPsec tunnel sklad:
Limit MTU: 1424

IKE Mode: Main mode IKE
IKE DH Group: 2 - modp 1024-bit

PFS: Enable Perfect Forward Secrecy
PFS DH Group: 2 - modp 1024-bit

On if supported and needed (NAT detected between gateways)


Keepalives: No keepalives.



IKE Proposal List Cipher Hash Life KB Life Sec
#1: AES-128 Allowed:128-256 SHA-1
#2: AES-128 Allowed:128-256 MD5
#3: 3DES SHA-1
#4: 3DES MD5
#5: DES SHA-1
#6: DES MD5

1)
IKE Mode: Main mode IKE
IKE DH Group: 2 - modp 1024-bit
PFS: Enable Perfect Forward Secrecy
PFS DH Group: 2 - modp 1024-bit

Encryption Algorithm: Encrypt and Authenticate (DES, MD5)
SA Life Time: 28800 sec
Key Group: DH2
SA Life Time: 28800 sec
Perfect Forward Secrecy(PFS): DH1

Несовпадения группы DiffiHellman, они должны быть одинаковыми.
2)
Вы не указали времна жизни для dfl-200
3)
Согласно RFC тривиальные, рекомендованные номера
IKE - 28800
IPSEC - 3600

Спасибо за помощь исправил.
в логах 900:
1 2006-10-31 20:27:55 INFO Respond new phase 1 negotiation: 81.2.8.120:500<=>81.2.8.121:500
2 2006-10-31 20:27:55 INFO Begin Identity Protection mode.
3 2006-10-31 20:27:55 INFO received Vendor ID: DPD
4 2006-10-31 20:27:55 INFO received Vendor ID: draft-ietf-ipsec-nat-t-ike-00
5 2006-10-31 20:27:55 INFO received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
6 2006-10-31 20:27:55 INFO received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
7 2006-10-31 20:27:56 INFO received Vendor ID: draft-ietf-ipsec-nat-t-ike-03
8 2006-10-31 20:27:56 WARNING Ignore INITIAL-CONTACT notification, because it is only accepted after... Ignore INITIAL-CONTACT notification, because it is only accepted after phase1.
9 2006-10-31 20:27:56 INFO ISAKMP-SA established 81.2.8.120:500-81.2.8.121:500
10 2006-10-31 20:27:56 INFO Respond new phase 2 negotiation: 81.2.8.120:0<=>81.2.8.121:0
11 2006-10-31 20:27:56 ERROR Failed to get sainfo.
12 2006-10-31 20:27:56 ERROR Failed to get sainfo.
13 2006-10-31 20:27:56 ERROR Failed to pre-process Packet.
14 2006-10-31 20:27:56 INFO Respond new phase 2 negotiation: 81.2.8.120:0<=>81.2.8.121:0
15 2006-10-31 20:27:57 ERROR Failed to get sainfo.
16 2006-10-31 20:27:57 ERROR Failed to get sainfo.
17 2006-10-31 20:27:57 ERROR Failed to pre-process Packet.
18 2006-10-31 20:27:57 INFO Respond new phase 2 negotiation: 81.2.8.120:0<=>81.2.8.121:0
19 2006-10-31 20:27:58 ERROR Failed to get sainfo.
20 2006-10-31 20:27:58 ERROR Failed to get sainfo.
21 2006-10-31 20:27:58 ERROR Failed to pre-process Packet.
22 2006-10-31 20:27:59 INFO Respond new phase 2 negotiation: 81.2.8.120:0<=>81.2.8.121:0
23 2006-10-31 20:28:00 ERROR Failed to get sainfo.
24 2006-10-31 20:28:00 ERROR Failed to get sainfo.
25 2006-10-31 20:28:00 ERROR Failed to pre-process Packet.
26 2006-10-31 20:28:03 INFO Respond new phase 2 negotiation: 81.2.8.120:0<=>81.2.8.121:0
27 2006-10-31 20:28:04 ERROR Failed to get sainfo.
28 2006-10-31 20:28:04 ERROR Failed to get sainfo.
29 2006-10-31 20:28:04 ERROR Failed to pre-process Packet.
30 2006-10-31 20:28:11 INFO Respond new phase 2 negotiation: 81.2.8.120:0<=>81.2.8.121:0
31 2006-10-31 20:28:12 ERROR Failed to get sainfo.
32 2006-10-31 20:28:12 ERROR Failed to get sainfo.
33 2006-10-31 20:28:12 ERROR Failed to pre-process Packet.
34 2006-10-31 20:28:27 INFO Respond new phase 2 negotiation: 81.2.8.120:0<=>81.2.8.121:0
35 2006-10-31 20:28:28 ERROR Failed to get sainfo.
36 2006-10-31 20:28:28 ERROR Failed to get sainfo.
37 2006-10-31 20:28:28 ERROR Failed to pre-process Packet.

устройства перегрузите.
У Вас сохранилась информация о первых попытках создания соединения.

1 2006-10-31 21:00:11 INFO Respond new phase 1 negotiation: 81.2.8.120:500<=>81.2.8.121:500
2 2006-10-31 21:00:11 INFO Begin Identity Protection mode.
3 2006-10-31 21:00:11 INFO received Vendor ID: DPD
4 2006-10-31 21:00:11 INFO received Vendor ID: draft-ietf-ipsec-nat-t-ike-00
5 2006-10-31 21:00:11 INFO received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
6 2006-10-31 21:00:11 INFO received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
7 2006-10-31 21:00:11 INFO received Vendor ID: draft-ietf-ipsec-nat-t-ike-03
8 2006-10-31 21:00:12 WARNING Ignore INITIAL-CONTACT notification, because it is only accepted after... Ignore INITIAL-CONTACT notification, because it is only accepted after phase1.
9 2006-10-31 21:00:12 INFO ISAKMP-SA established 81.2.8.120:500-81.2.8.121:500
10 2006-10-31 21:00:12 INFO Respond new phase 2 negotiation: 81.2.8.120:0<=>81.2.8.121:0
11 2006-10-31 21:00:12 ERROR Failed to get sainfo.
12 2006-10-31 21:00:12 ERROR Failed to get sainfo.
13 2006-10-31 21:00:12 ERROR Failed to pre-process Packet.
14 2006-10-31 21:00:13 INFO Respond new phase 2 negotiation: 81.2.8.120:0<=>81.2.8.121:0
15 2006-10-31 21:00:13 ERROR Failed to get sainfo.
16 2006-10-31 21:00:13 ERROR Failed to get sainfo.
17 2006-10-31 21:00:13 ERROR Failed to pre-process Packet.
18 2006-10-31 21:00:14 INFO Respond new phase 2 negotiation: 81.2.8.120:0<=>81.2.8.121:0
19 2006-10-31 21:00:14 ERROR Failed to get sainfo.
20 2006-10-31 21:00:14 ERROR Failed to get sainfo.
21 2006-10-31 21:00:14 ERROR Failed to pre-process Packet.
22 2006-10-31 21:00:16 INFO Respond new phase 2 negotiation: 81.2.8.120:0<=>81.2.8.121:0
23 2006-10-31 21:00:16 ERROR Failed to get sainfo.
24 2006-10-31 21:00:16 ERROR Failed to get sainfo.
25 2006-10-31 21:00:16 ERROR Failed to pre-process Packet.
26 2006-10-31 21:00:20 INFO Respond new phase 2 negotiation: 81.2.8.120:0<=>81.2.8.121:0
27 2006-10-31 21:00:20 ERROR Failed to get sainfo.
28 2006-10-31 21:00:20 ERROR Failed to get sainfo.
29 2006-10-31 21:00:20 ERROR Failed to pre-process Packet.
30 2006-10-31 21:00:28 INFO Respond new phase 2 negotiation: 81.2.8.120:0<=>81.2.8.121:0
31 2006-10-31 21:00:28 ERROR Failed to get sainfo.
32 2006-10-31 21:00:28 ERROR Failed to get sainfo.
33 2006-10-31 21:00:28 ERROR Failed to pre-process Packet.
34 2006-10-31 21:00:44 INFO Respond new phase 2 negotiation: 81.2.8.120:0<=>81.2.8.121:0
35 2006-10-31 21:00:44 ERROR Failed to get sainfo.
36 2006-10-31 21:00:44 ERROR Failed to get sainfo.
37 2006-10-31 21:00:44 ERROR Failed to pre-process Packet.

Как бы то нибыло
Первая фаза установилась, а вторая не хочет
Выложите ещё раз настройки, лутше мылом, чтобы не флудить

Сделал на обоих девайсах resetconf.
Настроил всё заново - всё заработало.
всем спасибо за помощь.