DFL-1500
Firmware Version: NetOS Ver2.115 (WALL) #b

DFL-700
Firmware version: 1.35.00-PRE001

DFL-200
Firmware: 1.33.00-SU1

Согласно FAQ настроил Ipsec между DFL-1500 и DFL-700
параметры Ipsec на стороне DFL-1500
Name - Sh
Local Address:
Subnet Adress
Ip 172.16.1.0
Subnet Mask 255.255.252.0
Remote Address:
Subnet Address:
Ip 192.168.0.0
Mask: 255.255.255.0

Negotiation Mode - Main
Encapsulation Mode - Tunnel
Outgoing Interface - WAN1
Peer Ip Address - Static IP - 81.222.44.**
My Identifier - Ip address
Peer`s Identifier - Ip address
ESP algorithm - Encrypt and Autenticate DES, MD5
PreSharedKey 852963
Transport Layer Protocol - ANY
Enable Replay Detection - NO
PHASE 1
Negotiation Mode - MAIN
Pre-Shared key 852963
Encryption Algorithm - Encrypt and Autenticate (DES,MD5)
SA Life Time - 28800 sec
Key Group - DH2
PHASE 2
Encapsulation - Tunnnel
Active Protocol - ESP
Encryption Algorithm - Encrypt and Autenticate (DES,MD5)
SA Life Time - 28800 sec
PFS - DH1


Параметры на стороне DFL-700
Name Sh
Local Net: 192.168.0.0/24
Autentification - PSK
PSK - 852963
Lan-to-Lan tunnel
Remote Net: 172.16.1.0-172.16.2.254
Remote Gateway: 81.222.44.**
Route - Automatically add a route for the remote networks
Limit MTU - 1424
IKE Mode - Main mode IKE
IKE DH-group - 2 modp 1024 bit
Enable PFS
PFS Dh-group - 1 modp 768 bit
Nat Traversal - disabled
KeepAlives - No Keepalives

IKE Proposal list
DES MD5 0kb 28800sec
- MD5 0 28800

IPsec proposal list
DES MD5 0kb 28800sec
- MD5 0 28800


(Точно такие же настройки пробовал вбивать для теста и на DFL-200)

После пробного пинга и попытки установить туннель, в логах DFL-1500 пишется следующее, и туннель не устанавливается:

29 2007-10-17 15:30:16 INFO Respond new phase 1 negotiation: 81.222.44.1*:500<=>81.222.44.2*:500
30 2007-10-17 15:30:16 INFO Begin Identity Protection mode.
31 2007-10-17 15:30:16 INFO received Vendor ID: DPD
32 2007-10-17 15:30:16 INFO received Vendor ID: draft-ietf-ipsec-nat-t-ike-00
33 2007-10-17 15:30:16 INFO received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
34 2007-10-17 15:30:16 INFO received Vendor ID: draft-ietf-ipsec-nat-t-ike-02
35 2007-10-17 15:30:16 INFO received Vendor ID: draft-ietf-ipsec-nat-t-ike-03
36 2007-10-17 15:30:16 WARNING Ignore INITIAL-CONTACT notification, because it is only accepted after...
37 2007-10-17 15:30:16 INFO ISAKMP-SA established 81.222.44.1*:500-81.222.44.2*:500
38 2007-10-17 15:30:17 INFO Respond new phase 2 negotiation: 81.222.44.4*:0<=>81.222.44.2*:0
39 2007-10-17 15:30:17 ERROR Failed to get sainfo.
40 2007-10-17 15:30:17 ERROR Failed to get sainfo.
41 2007-10-17 15:30:17 ERROR Failed to pre-process Packet.
42 2007-10-17 15:30:17 INFO Respond new phase 2 negotiation: 81.222.44.1*:0<=>81.222.44.2*:0
43 2007-10-17 15:30:17 ERROR Failed to get sainfo.
44 2007-10-17 15:30:17 ERROR Failed to get sainfo.
45 2007-10-17 15:30:17 ERROR Failed to pre-process Packet.
46 2007-10-17 15:30:18 INFO Respond new phase 2 negotiation: 81.222.44.1*:0<=>81.222.44.2*:0
47 2007-10-17 15:30:18 ERROR Failed to get sainfo.
48 2007-10-17 15:30:18 ERROR Failed to get sainfo.
49 2007-10-17 15:30:18 ERROR Failed to pre-process Packet.
50 2007-10-17 15:30:20 INFO Respond new phase 2 negotiation: 81.222.44.1*:0<=>81.222.44.2*:0
51 2007-10-17 15:30:20 ERROR Failed to get sainfo.
52 2007-10-17 15:30:20 ERROR Failed to get sainfo.
53 2007-10-17 15:30:20 ERROR Failed to pre-process Packet.
54 2007-10-17 15:30:24 INFO Respond new phase 2 negotiation: 81.222.44.1*:0<=>81.222.44.2*:0
55 2007-10-17 15:30:24 ERROR Failed to get sainfo.
56 2007-10-17 15:30:24 ERROR Failed to get sainfo.
57 2007-10-17 15:30:24 ERROR Failed to pre-process Packet.
58 2007-10-17 15:30:32 INFO Respond new phase 2 negotiation: 81.222.44.1*:0<=>81.222.44.2*:0
59 2007-10-17 15:30:32 ERROR Failed to get sainfo.
60 2007-10-17 15:30:32 ERROR Failed to get sainfo.
61 2007-10-17 15:30:32 ERROR Failed to pre-process Packet.
62 2007-10-17 15:30:48 INFO Respond new phase 2 negotiation: 81.222.44.1*:0<=>81.222.44.2*:0
63 2007-10-17 15:30:48 ERROR Failed to get sainfo.
64 2007-10-17 15:30:48 ERROR Failed to get sainfo.
65 2007-10-17 15:30:48 ERROR Failed to pre-process Packet.
66 2007-10-17 15:31:18 INFO Respond new phase 2 negotiation: 81.222.44.1*:0<=>81.222.44.2*:0
67 2007-10-17 15:31:18 ERROR Failed to get sainfo.
68 2007-10-17 15:31:18 ERROR Failed to get sainfo.
69 2007-10-17 15:31:18 ERROR Failed to pre-process Packet.
70 2007-10-17 15:31:48 INFO Respond new phase 2 negotiation: 81.222.44.1*:0<=>81.222.44.2*:0
71 2007-10-17 15:31:48 ERROR Failed to get sainfo.
72 2007-10-17 15:31:48 ERROR Failed to get sainfo.
73 2007-10-17 15:31:48 ERROR Failed to pre-process Packet.
74 2007-10-17 15:32:18 INFO Respond new phase 2 negotiation: 81.222.44.1*:0<=>81.222.44.2*:0
75 2007-10-17 15:32:18 ERROR Failed to get sainfo.
76 2007-10-17 15:32:18 ERROR Failed to get sainfo.
77 2007-10-17 15:32:18 ERROR Failed to pre-process Packet.
78 2007-10-17 15:32:48 INFO Respond new phase 2 negotiation: 81.222.44.1*:0<=>81.222.44.2*:0
79 2007-10-17 15:32:48 ERROR Failed to get sainfo.
80 2007-10-17 15:32:48 ERROR Failed to get sainfo.
81 2007-10-17 15:32:48 ERROR Failed to pre-process Packet.

После этого вновь идет первая фаза, и ситуация повторяется.
Т.е. ни DFL-700 ни DFL-200 не могут установить IPsec туннель с DFL-1500
физически данные устройства находятся в подсети одного провайдера (отличаются только последние цифры айпи адреса).

Уважаемый support, подскажите, как можно решить данную проблему..

Поиском нашел точно такую же проблему на данному форуме, но ответа там также не было.
viewtopic.php?t=13001

Up

Я так понимаю проблема в DFL-1500.
Уважаемый Support можете ли вы что-то сказать по этому поводу?

up

up

удаленная сеть на DFL-700 задаёться с битовой маской, в Вашем случае:
172.16.0.0/22

Поправил, но ситуация та же самая.
Не удается установить вторую фазу.
В целях эксперимента пробовал перебить все настройки VPN туннеля заново - результат тот же самый.

Покажите снова все настройки и логи.

Параметры на стороне DFL-700
Name Sh
Local Net: 172.16.6.0/24
Autentification - PSK
PSK - 852963
Lan-to-Lan tunnel
Remote Net: 172.16.0.0/22
Remote Gateway: 81.222.41.**
Route - Automatically add a route for the remote networks
Limit MTU - 1424
IKE Mode - Main mode IKE
IKE DH-group - 2 modp 1024 bit
Enable PFS
PFS Dh-group - NONE
Nat Traversal - disabled
KeepAlives - No Keepalives

IKE Proposal list
DES MD5 0kb 28800sec
- MD5 0 28800

IPsec proposal list
DES MD5 0kb 28800sec
- MD5 0 28800

-----------------------------------------------------------------------
параметры Ipsec на стороне DFL-1500
Name - Sh
Local Address:
Subnet Adress
Ip 172.16.0.0
Subnet Mask 255.255.252.0
Remote Address:
Subnet Address:
Ip 172.16.6.0
Mask: 255.255.255.0

Negotiation Mode - Main
Encapsulation Mode - Tunnel
Outgoing Interface - WAN1
Peer Ip Address - Static IP - 81.222.66.**
My Identifier - Ip address
Peer`s Identifier - Ip address
ESP algorithm - Encrypt and Autenticate DES, MD5
PreSharedKey 852963
Transport Layer Protocol - ANY
Enable Replay Detection - NO
PHASE 1
Negotiation Mode - MAIN
Pre-Shared key 852963
Encryption Algorithm - Encrypt and Autenticate (DES,MD5)
SA Life Time - 28800 sec
Key Group - DH2
PHASE 2
Encapsulation - Tunnnel
Active Protocol - ESP
Encryption Algorithm - Encrypt and Autenticate (DES,MD5)
SA Life Time - 28800 sec
PFS - NONE
---------------------------------------------------------------------
логи на dfl-1500
13 2007-11-06 09:57:09 INFO Respond new phase 1 negotiation: 81.222.41.*:500<=>81.222.66.*:500
14 2007-11-06 09:57:09 INFO Begin Identity Protection mode.
15 2007-11-06 09:57:09 INFO received Vendor ID: DPD
16 2007-11-06 09:57:10 WARNING Ignore INITIAL-CONTACT notification, because it is only accepted after...
17 2007-11-06 09:57:10 INFO ISAKMP-SA established 81.222.41.*:500-81.222.66.*:500
18 2007-11-06 09:57:10 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
19 2007-11-06 09:57:10 ERROR Failed to get sainfo.
20 2007-11-06 09:57:10 ERROR Failed to get sainfo.
21 2007-11-06 09:57:10 ERROR Failed to pre-process Packet.
22 2007-11-06 09:57:10 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
23 2007-11-06 09:57:10 ERROR Failed to get sainfo.
24 2007-11-06 09:57:10 ERROR Failed to get sainfo.
25 2007-11-06 09:57:10 ERROR Failed to pre-process Packet.
26 2007-11-06 09:57:11 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
27 2007-11-06 09:57:11 ERROR Failed to get sainfo.
28 2007-11-06 09:57:11 ERROR Failed to get sainfo.
29 2007-11-06 09:57:11 ERROR Failed to pre-process Packet.
30 2007-11-06 09:57:13 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
31 2007-11-06 09:57:13 ERROR Failed to get sainfo.
32 2007-11-06 09:57:13 ERROR Failed to get sainfo.
33 2007-11-06 09:57:13 ERROR Failed to pre-process Packet.
34 2007-11-06 09:57:17 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
35 2007-11-06 09:57:17 ERROR Failed to get sainfo.
36 2007-11-06 09:57:17 ERROR Failed to get sainfo.
37 2007-11-06 09:57:17 ERROR Failed to pre-process Packet.
38 2007-11-06 09:57:25 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
39 2007-11-06 09:57:25 ERROR Failed to get sainfo.
40 2007-11-06 09:57:25 ERROR Failed to get sainfo.
41 2007-11-06 09:57:25 ERROR Failed to pre-process Packet.
42 2007-11-06 09:57:41 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
43 2007-11-06 09:57:41 ERROR Failed to get sainfo.
44 2007-11-06 09:57:41 ERROR Failed to get sainfo.
45 2007-11-06 09:57:41 ERROR Failed to pre-process Packet.
46 2007-11-06 09:57:57 INFO Purging ISAKMP-SA bc9b1e41ca3ee72a:a247173d86d1eebc.
47 2007-11-06 09:57:57 INFO purged ISAKMP-SA bc9b1e41ca3ee72a:a247173d86d1eebc.
48 2007-11-06 09:57:58 INFO ISAKMP-SA deleted 81.222.41.*:500-81.222.66.*:500
49 2007-11-06 09:58:11 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
50 2007-11-06 09:58:11 ERROR Failed to get sainfo.
51 2007-11-06 09:58:11 ERROR Failed to get sainfo.
52 2007-11-06 09:58:11 ERROR Failed to pre-process Packet.
53 2007-11-06 09:58:41 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
54 2007-11-06 09:58:41 ERROR Failed to get sainfo.
55 2007-11-06 09:58:41 ERROR Failed to get sainfo.
56 2007-11-06 09:58:41 ERROR Failed to pre-process Packet.
57 2007-11-06 09:59:11 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66*:0
58 2007-11-06 09:59:11 ERROR Failed to get sainfo.
59 2007-11-06 09:59:11 ERROR Failed to get sainfo.
60 2007-11-06 09:59:11 ERROR Failed to pre-process Packet.
61 2007-11-06 09:59:41 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
62 2007-11-06 09:59:41 ERROR Failed to get sainfo.
63 2007-11-06 09:59:41 ERROR Failed to get sainfo.
64 2007-11-06 09:59:41 ERROR Failed to pre-process Packet.

далее все повторяется

Покажите логи на стороне DFL-700, рекомендую перегрузить оба устройства, потому-что судя по всему на DFL-900 или на dfl-700 остались старые SA, где были ещё не верные SA.

перезагрузка по питанию не дает результатов.
вот только меня смущает вот эта строчка в логах на dfl-700
<5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=1416 srcport=4413 destport=6392 ack=1 psh=1
порт 4413 не связан ли он с IPSEC в данном случае?



логи на стороне dfl-1500

179 2007-11-06 10:56:23 INFO Respond new phase 1 negotiation: 81.222.41.*:500<=>81.222.66.*:500
180 2007-11-06 10:56:23 INFO Begin Identity Protection mode.
181 2007-11-06 10:56:23 INFO received Vendor ID: DPD
182 2007-11-06 10:56:24 WARNING Ignore INITIAL-CONTACT notification, because it is only accepted after...
183 2007-11-06 10:56:24 INFO ISAKMP-SA established 81.222.41.*:500-81.222.66.*:500
184 2007-11-06 10:56:24 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
185 2007-11-06 10:56:24 ERROR Failed to get sainfo.
186 2007-11-06 10:56:24 ERROR Failed to get sainfo.
187 2007-11-06 10:56:24 ERROR Failed to pre-process Packet.
188 2007-11-06 10:56:24 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
189 2007-11-06 10:56:24 ERROR Failed to get sainfo.
190 2007-11-06 10:56:24 ERROR Failed to get sainfo.
191 2007-11-06 10:56:24 ERROR Failed to pre-process Packet.
192 2007-11-06 10:56:25 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
193 2007-11-06 10:56:25 ERROR Failed to get sainfo.
194 2007-11-06 10:56:25 ERROR Failed to get sainfo.
195 2007-11-06 10:56:25 ERROR Failed to pre-process Packet.
196 2007-11-06 10:56:27 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
197 2007-11-06 10:56:27 ERROR Failed to get sainfo.
198 2007-11-06 10:56:27 ERROR Failed to get sainfo.
199 2007-11-06 10:56:27 ERROR Failed to pre-process Packet.
200 2007-11-06 10:56:31 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
201 2007-11-06 10:56:31 ERROR Failed to get sainfo.
202 2007-11-06 10:56:31 ERROR Failed to get sainfo.
203 2007-11-06 10:56:31 ERROR Failed to pre-process Packet.
204 2007-11-06 10:56:39 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
205 2007-11-06 10:56:39 ERROR Failed to get sainfo.
206 2007-11-06 10:56:39 ERROR Failed to get sainfo.
207 2007-11-06 10:56:39 ERROR Failed to pre-process Packet.
208 2007-11-06 10:56:55 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
209 2007-11-06 10:56:55 ERROR Failed to get sainfo.
210 2007-11-06 10:56:55 ERROR Failed to get sainfo.
211 2007-11-06 10:56:55 ERROR Failed to pre-process Packet.
212 2007-11-06 10:57:25 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
213 2007-11-06 10:57:25 ERROR Failed to get sainfo.
214 2007-11-06 10:57:25 ERROR Failed to get sainfo.
215 2007-11-06 10:57:25 ERROR Failed to pre-process Packet.
216 2007-11-06 10:57:55 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
217 2007-11-06 10:57:55 ERROR Failed to get sainfo.
218 2007-11-06 10:57:55 ERROR Failed to get sainfo.
219 2007-11-06 10:57:55 ERROR Failed to pre-process Packet.
220 2007-11-06 10:58:25 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
221 2007-11-06 10:58:25 ERROR Failed to get sainfo.
222 2007-11-06 10:58:25 ERROR Failed to get sainfo.
223 2007-11-06 10:58:25 ERROR Failed to pre-process Packet.
224 2007-11-06 10:58:55 INFO Respond new phase 2 negotiation: 81.222.41.*:0<=>81.222.66.*:0
225 2007-11-06 10:58:55 ERROR Failed to get sainfo.
226 2007-11-06 10:58:55 ERROR Failed to get sainfo.
227 2007-11-06 10:58:55 ERROR Failed to pre-process Packet.
-----------------------------


логи на стороне dfl-700

относящиеся к IPSEC


[2007-11-06 07:46:12] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=20 srcport=4413 destport=6422 rst=1 ack=1

[2007-11-06 07:46:12] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=59 srcport=4413 destport=6422 ack=1 psh=1

[2007-11-06 07:46:12] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=68 srcport=4413 destport=6422 ack=1 psh=1



[2007-11-06 07:46:03] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=236 srcport=4413 destport=7810 ack=1 psh=1


[2007-11-06 07:45:54] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=236 srcport=4413 destport=7810 ack=1 psh=1

[2007-11-06 07:45:49] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=236 srcport=4413 destport=7810 ack=1 psh=1

[2007-11-06 07:45:46] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=236 srcport=4413 destport=7810 ack=1 psh=1

[2007-11-06 07:45:45] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=236 srcport=4413 destport=7810 ack=1 psh=1

[2007-11-06 07:45:45] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=34 srcport=4413 destport=7810 ack=1 psh=1

[2007-11-06 07:45:45] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=34 srcport=4413 destport=7810 ack=1 psh=1

[2007-11-06 07:45:45] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=34 srcport=4413 destport=7810 ack=1 psh=1

[2007-11-06 07:45:45] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=34 srcport=4413 destport=7810 ack=1 psh=1

[2007-11-06 07:45:44] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=180 srcport=4413 destport=7810 ack=1 psh=1



[2007-11-06 07:45:28] <5>EFW: CONN: rule=IPsecBeforeRules conn=open connipproto=UDP connrecvif=WAN connsrcip=81.222.41.* connsrcport=500 conndestif=core conndestip=81.222.66.* conndestport=500


[2007-11-06 07:45:10] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=20 srcport=4413 destport=2208 rst=1 ack=1

[2007-11-06 07:45:10] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=59 srcport=4413 destport=2208 ack=1 psh=1

[2007-11-06 07:45:10] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=68 srcport=4413 destport=2208 ack=1 psh=1

[2007-11-06 07:44:38] <5>EFW: CONN: rule=IPsecBeforeRules conn=close connipproto=UDP connrecvif=WAN connsrcip=81.222.41.* connsrcport=500 conndestif=core conndestip=81.222.66.* conndestport=500 origsent=412 termsent=0

[2007-11-06 07:44:30] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=36 srcport=4413 destport=9175 ack=1 psh=1

[2007-11-06 07:44:23] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=20 srcport=4413 destport=2814 rst=1 ack=1

[2007-11-06 07:44:23] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=59 srcport=4413 destport=2814 ack=1 psh=1

[2007-11-06 07:44:23] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=68 srcport=4413 destport=2814 ack=1 psh=1

[2007-11-06 07:44:22] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=36 srcport=4413 destport=9175 ack=1 psh=1



[2007-11-06 07:43:46] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=36 srcport=4413 destport=7489 ack=1 psh=1


[2007-11-06 07:43:38] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=36 srcport=4413 destport=7489 ack=1 psh=1


[2007-11-06 07:43:34] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=36 srcport=4413 destport=7489 ack=1 psh=1



[2007-11-06 07:43:32] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=36 srcport=4413 destport=7489 ack=1 psh=1

[2007-11-06 07:43:31] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=36 srcport=4413 destport=7489 ack=1 psh=1

[2007-11-06 07:43:31] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=36 srcport=4413 destport=7489 ack=1 psh=1


[2007-11-06 07:42:45] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=1480 srcport=4413 destport=6392 ack=1 psh=1



[2007-11-06 07:42:35] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=1480 srcport=4413 destport=6392 ack=1 psh=1



[2007-11-06 07:42:31] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=1480 srcport=4413 destport=6392 ack=1 psh=1


[2007-11-06 07:42:28] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=1480 srcport=4413 destport=6392 ack=1 psh=1

[2007-11-06 07:42:27] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=1480 srcport=4413 destport=6392 ack=1 psh=1

[2007-11-06 07:42:27] <6>EFW: IPSEC: prio=1 Phase-1 [initiator] between ipv4(udp:500,[0..3]=81.222.66.*) and ipv4(udp:500,[0..3]=81.222.41.*) done.

[2007-11-06 07:42:26] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=614 srcport=4413 destport=6392 ack=1 psh=1

[2007-11-06 07:42:26] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=1393 srcport=4413 destport=6392 ack=1 psh=1

[2007-11-06 07:42:26] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=300 srcport=4413 destport=6392 ack=1 psh=1

[2007-11-06 07:42:26] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=1480 srcport=4413 destport=6392 ack=1

[2007-11-06 07:42:26] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=1480 srcport=4413 destport=6392 ack=1

[2007-11-06 07:42:26] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=143 srcport=4413 destport=6392 ack=1 psh=1

[2007-11-06 07:42:26] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=1480 srcport=4413 destport=6392 ack=1

[2007-11-06 07:42:26] <5>EFW: DROP: prio=2 rule=dropall-final action=drop recvif=WAN srcip=81.222.41.* destip=81.222.66.* ipproto=TCP ipdatalen=1416 srcport=4413 destport=6392 ack=1 psh=1

[2007-11-06 07:42:26] <5>EFW: CONN: rule=IPsecBeforeRules conn=open connipproto=UDP connrecvif=WAN connsrcip=81.222.41.* connsrcport=500 conndestif=core conndestip=81.222.66.* conndestport=500

Нет 4413 никак не относится к IPsec.
Предоставьте полный доступ к устройствам на управление. Данные пришлите либо в ЛС либо на email.

Разобрался путем экспериментов.
Ситуация немного прояснилась.
Dlinki не хотят устанавливать VPN когда задана конфигурация сетей как я написал.
т.е. на DFL-700 внутренняя сеть 172.16.6.0/24
а на DFL-1500 172.16.0.0/22

Из положения вышел - путем создания трех туннелей,в место одного.
т.е. туннель с параметрами внутренних сетей
на DFL-700 внутренняя сеть 172.16.6.0/24
а на DFL-1500 172.16.1.0/24
устанавливается прекрасно., соответственно создал этот туннель и еще два, чтобы перекрыть всю подсеть

на DFL-700 внутренняя сеть 172.16.6.0/24
а на DFL-1500 172.16.2.0/24

и

на DFL-700 внутренняя сеть 172.16.6.0/24
а на DFL-1500 172.16.3.0/24