Не поднимается IPSec соединение между Dlink DFL-1600 и Cisco 1841.

В настройках DFL:
IKE/IPSec Encryption Algorithms - 3DES, Integrity Algorithms
- MD5 .

Local Network: 10.5.0.0 255.255.0.0
Remote Network: 192.168.100.0 255.255.255.0
Remote Endpoint: 84.2.9.2
IPsec Tunnels > Encapsulation Mode - Tunnel
IKE Life Time - 86400 sec
IPsec Life Time - 28800 sec
IPsec Life Time - 4608000 kb/s
Authentication - Pre-Shared Key
IKE XAuth - off
Plaintext MTU - 1500
IKE Main - DH Group

Perfect Forward Secrecy - PFS, DH Group 2
Security Association - Net
NAT Traversal - On if supported and NATed


Cisco 1841:

crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
crypto isakmp key test address 82.1.1.5
!
crypto ipsec transform-set DFL-1600 esp-3des
!
crypto map DFL-1600 1 ipsec-isakmp
set peer 82.1.1.5
set security-association lifetime kilobytes 460800
set security-association lifetime seconds 28800
set transform-set DFL-1600
set pfs group2
match address TUNNEL
!
interface FastEthernet0/0
ip address 84.2.9.2 255.255.255.248
no ip redirects
no ip unreachables
no ip proxy-arp
ip virtual-reassembly
duplex auto
speed auto
crypto map DFL-1600
!
ip access-list extended TUNNEL
permit ip 192.168.100.0 0.0.0.255 10.5.0.0 0.0.255.255
deny ip any any

=============
В логах Dlink:

2007-03-15 11:24:27 Informational IPSEC Bad logmsg: [2007-03-15 11:24:27] <6>FW: IPSEC: prio=1 Phase-2 [initiator]
for ipv4(icmp:0,[0..3]=10.5.0.11) and ipv4(icmp:0,[0..3]=192.168.100.1) failed;
No proposal chosen.

2007-03-15 11:24:27 Warning IPSEC Bad logmsg: [2007-03-15 11:24:27] <4>FW: IPSEC: prio=3 Authenticated notify "No proposal chosen" from 84.2.9.2:500
for protocol ESP spi[0..4]=91 5d 8b f6

=============

IKE поднимается, а IPSec никак.
Конфигурация сделана один в один, где-что не совпадает не могу понять.

Заранее спасибо за ответы!

Скорее всего проблема в несогласовании crypto map на CISCO и у устройства.
Посмотрите конфигурацию для CISCO-1750

Исправленный конфиг Cisco:

crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key test address 82.1.1.5
crypto isakmp aggressive-mode disable
!
crypto ipsec transform-set DFL-1600 esp-3des esp-md5-hmac
!
crypto map DFL-1600 1 ipsec-isakmp
set peer 82.1.1.5
set security-association lifetime kilobytes 460800
set security-association lifetime seconds 28800
set transform-set DFL-1600
set pfs group2
match address TUNNEL
!
interface FastEthernet0/0
ip address 84.2.9.2 255.255.255.248
no ip redirects
no ip unreachables
no ip proxy-arp
ip virtual-reassembly
duplex auto
speed auto
crypto map DFL-1600
!
ip access-list extended TUNNEL
permit ip 192.168.100.0 0.0.0.255 10.5.0.0 0.0.255.255
deny ip any any

===============

IPSec так же не поднимается.

Советов по конфигурации cisco мы дать не в состоянии