Здравствуйте гуру!
Заранее всех благодарю за помощь!
Крик души: ХЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЕЛП!!!!!
Ситуция:

Клиент (ХР, roadwarrior с дин. ИП) ------- ФВ/НАТ ---------- ВПН (Trustix 3.0.5/Linux lion-gw 2.6.19.7-1tr-TuxFire /OpenSWAN 2.4.5-2tr)

Авторизация решится с помощью сертификатов (OpenSSL http://www.natecarlson.com/linux/ipsec-x509.php#clientopenswan). На клиенте установлен сертификат СА и pkcs12 сертификат клиента.

При попытке подключения в логах такие вот ошибки, клиент не подключится.

Apr 10 11:41:05 lion-gw ipsec__plutorun: Starting Pluto subsystem...
Apr 10 11:41:05 lion-gw pluto[17898]: Starting Pluto (Openswan Version 2.4.5 X.509-1.5.4 PLUTO_SENDS_VENDORID PLUTO_USES_KEYRR; Vendor ID OEnMCu\177xOp@c)
Apr 10 11:41:05 lion-gw pluto[17898]: Setting NAT-Traversal port-4500 floating to on
Apr 10 11:41:05 lion-gw pluto[17898]:    port floating activation criteria nat_t=1/port_fload=1
Apr 10 11:41:05 lion-gw pluto[17898]:   including NAT-Traversal patch (Version 0.6c)
Apr 10 11:41:05 lion-gw pluto[17898]: 1 bad entries in virtual_private - none loaded
Apr 10 11:41:05 lion-gw pluto[17898]: ike_alg_register_enc(): Activating OAKLEY_AES_CBC: Ok (ret=0)
Apr 10 11:41:05 lion-gw pluto[17898]: starting up 1 cryptographic helpers
Apr 10 11:41:05 lion-gw pluto[17898]: started helper pid=17899 (fd:6)
Apr 10 11:41:05 lion-gw pluto[17898]: Using Linux 2.6 IPsec interface code on 2.6.19.7-1tr-TuxFire
Apr 10 11:41:05 lion-gw pluto[17898]: Changing to directory '/etc/ipsec.d/cacerts'
Apr 10 11:41:05 lion-gw pluto[17898]:   loaded CA cert file 'cacert.pem' (1464 bytes)
Apr 10 11:41:05 lion-gw pluto[17898]: Changing to directory '/etc/ipsec.d/aacerts'
Apr 10 11:41:05 lion-gw pluto[17898]: Changing to directory '/etc/ipsec.d/ocspcerts'
Apr 10 11:41:05 lion-gw pluto[17898]: Changing to directory '/etc/ipsec.d/crls'
Apr 10 11:41:05 lion-gw pluto[17898]:   loaded crl file 'crl.pem' (568 bytes)
Apr 10 11:41:05 lion-gw pluto[17898]: listening for IKE messages
Apr 10 11:41:05 lion-gw pluto[17898]: adding interface eth1/eth1 217.172.151.26:500
Apr 10 11:41:05 lion-gw pluto[17898]: adding interface eth1/eth1 217.172.151.26:4500
Apr 10 11:41:05 lion-gw pluto[17898]: adding interface eth0:1/eth0:1 217.172.149.158:500
Apr 10 11:41:06 lion-gw pluto[17898]: adding interface eth0:1/eth0:1 217.172.149.158:4500
Apr 10 11:41:06 lion-gw pluto[17898]: adding interface eth0/eth0 10.0.0.55:500
Apr 10 11:41:06 lion-gw pluto[17898]: adding interface eth0/eth0 10.0.0.55:4500
Apr 10 11:41:06 lion-gw pluto[17898]: adding interface lo/lo 127.0.0.1:500
Apr 10 11:41:06 lion-gw pluto[17898]: adding interface lo/lo 127.0.0.1:4500
Apr 10 11:41:06 lion-gw pluto[17898]: loading secrets from "/etc/ipsec.secrets"
Apr 10 11:41:06 lion-gw pluto[17898]:   loaded private key file '/etc/ipsec.d/private/gw.lion.key' (1743 bytes)
Apr 10 11:41:13 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
Apr 10 11:41:13 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Vendor ID payload [FRAGMENTATION]
Apr 10 11:41:13 lion-gw pluto[17898]: packet from 213.160.183.147:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106
Apr 10 11:41:13 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Vendor ID payload [Vid-Initial-Contact]
Apr 10 11:41:13 lion-gw pluto[17898]: packet from 213.160.183.147:500: initial Main Mode message received on 217.172.151.26:500 but no connection has been authorized
Apr 10 11:41:14 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
Apr 10 11:41:14 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Vendor ID payload [FRAGMENTATION]
Apr 10 11:41:14 lion-gw pluto[17898]: packet from 213.160.183.147:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106
Apr 10 11:41:14 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Vendor ID payload [Vid-Initial-Contact]
Apr 10 11:41:14 lion-gw pluto[17898]: packet from 213.160.183.147:500: initial Main Mode message received on 217.172.151.26:500 but no connection has been authorized
Apr 10 11:41:16 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
Apr 10 11:41:16 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Vendor ID payload [FRAGMENTATION]
Apr 10 11:41:16 lion-gw pluto[17898]: packet from 213.160.183.147:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106
Apr 10 11:41:16 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Vendor ID payload [Vid-Initial-Contact]
Apr 10 11:41:16 lion-gw pluto[17898]: packet from 213.160.183.147:500: initial Main Mode message received on 217.172.151.26:500 but no connection has been authorized
Apr 10 11:41:17 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Delete SA payload: not encrypted
Apr 10 11:41:17 lion-gw pluto[17898]: packet from 213.160.183.147:500: received and ignored informational message
Apr 10 11:47:53 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
Apr 10 11:47:53 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Vendor ID payload [FRAGMENTATION]
Apr 10 11:47:53 lion-gw pluto[17898]: packet from 213.160.183.147:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106
Apr 10 11:47:53 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Vendor ID payload [Vid-Initial-Contact]
Apr 10 11:47:53 lion-gw pluto[17898]: packet from 213.160.183.147:500: initial Main Mode message received on 217.172.151.26:500 but no connection has been authorized
Apr 10 11:47:54 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
Apr 10 11:47:54 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Vendor ID payload [FRAGMENTATION]
Apr 10 11:47:54 lion-gw pluto[17898]: packet from 213.160.183.147:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106
Apr 10 11:47:54 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Vendor ID payload [Vid-Initial-Contact]
Apr 10 11:47:54 lion-gw pluto[17898]: packet from 213.160.183.147:500: initial Main Mode message received on 217.172.151.26:500 but no connection has been authorized
Apr 10 11:47:56 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Vendor ID payload [MS NT5 ISAKMPOAKLEY 00000004]
Apr 10 11:47:56 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Vendor ID payload [FRAGMENTATION]
Apr 10 11:47:56 lion-gw pluto[17898]: packet from 213.160.183.147:500: received Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n] method set to=106
Apr 10 11:47:56 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Vendor ID payload [Vid-Initial-Contact]
Apr 10 11:47:56 lion-gw pluto[17898]: packet from 213.160.183.147:500: initial Main Mode message received on 217.172.151.26:500 but no connection has been authorized
Apr 10 11:47:58 lion-gw pluto[17898]: packet from 213.160.183.147:500: ignoring Delete SA payload: not encrypted
Apr 10 11:47:58 lion-gw pluto[17898]: packet from 213.160.183.147:500: received and ignored informational message
=====================================

# /etc/ipsec.conf - Openswan IPsec configuration file
# RCSID $Id: ipsec.conf.in,v 1.15.2.2 2005/11/14 20:10:27 paul Exp $

# This file:  /usr/share/doc/openswan/ipsec.conf-sample
#
# Manual:     ipsec.conf.5

version 2.0     # conforms to second version of ipsec.conf specification

# basic configuration
config setup
        interfaces="ipsec0=eth1"
        overridemtu=1410
        # plutodebug / klipsdebug = "all", "none" or a combation from below:
        # "raw crypt parsing emitting control klips pfkey natt x509 private"
        # eg:
        # plutodebug="control parsing"
        #
        # Only enable klipsdebug=all if you are a developer
        #
        # NAT-TRAVERSAL support, see README.NAT-Traversal
         nat_traversal=yes
         virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%4:172.16.0.0/12

# Add connections here

conn rw-test
        type=tunnel
        #leftrsasigkey=нrt
        #rightrsasigkey=нrt
        left=чfaultgw
        right=%any
        auto=none

conn чfault
        keyingtries=1
        compress=yes
        disablearrivalcheck=no
        authby=rsasig
        leftrsasigkey=нrt
        rightrsasigkey=нrt

conn roadwarrior-l2tp
        pfs=no
        leftprotoport=17/0
        rightprotoport=17/1701
        also=roadwarrior

conn roadwarrior-l2tp-updatedwin
        pfs=no
        leftprotoport=17/1701
        rightprotoport=17/1701
        also=roadwarrior

conn roadwarrior-all
        leftsubnet=0.0.0.0/0
        also=roadwarrior

conn roadwarrior
        type=tunnel
        auth=esp
        left=x.x.151.26
        leftsubnet=10.0.0.0/24
        leftcert=gw.lion.pem
        right=%any
        rightsubnet=vhost:%no,%priv
        rightcert=%any
        pfs=yes
        auto=start

# sample VPN connection
#conn sample
#               # Left security gateway, subnet behind it, nexthop toward right.
#               left=10.0.0.1
#               leftsubnet=172.16.0.0/24
#               leftnexthop=10.22.33.44
#               # Right security gateway, subnet behind it, nexthop toward left.
#               right=10.12.12.1
#               rightsubnet=192.168.0.0/24
#               rightnexthop=10.101.102.103
#               # To authorize this connection, but not actually start it,
#               # at startup, uncomment this.
#               #auto=start

#Disable Opportunistic Encryption
include /etc/ipsec.d/examples/no_oe.conf

=====================================
ifconfig:
eth0      Link encap:Ethernet  HWaddr 00:E0:4C:03:A7:90
          inet addr:10.0.0.55  Bcast:10.0.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:9167220 errors:0 dropped:0 overruns:0 frame:0
          TX packets:9578455 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2438773899 (2325.7 Mb)  TX bytes:1680683297 (1602.8 Mb)
          Interrupt:18 Base address:0x4c00

eth1      Link encap:Ethernet  HWaddr 00:17:31:91:FD:2D
          inet addr:x.x.151.26  Bcast:217.172.151.27  Mask:255.255.255.252
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:10553616 errors:0 dropped:0 overruns:0 frame:0
          TX packets:9999378 errors:0 dropped:0 overruns:0 carrier:0
          collisions:27409 txqueuelen:1000
          RX bytes:1365485331 (1302.2 Mb)  TX bytes:2467187465 (2352.8 Mb)
          Interrupt:19 Base address:0x6800

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:178083 errors:0 dropped:0 overruns:0 frame:0
          TX packets:178083 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:20858181 (19.8 Mb)  TX bytes:20858181 (19.8 Mb)

====================================
route:
212.65.244.134  10.0.0.57       255.255.255.255 UGH   0      0        0 eth0
194.149.124.60  10.0.0.57       255.255.255.255 UGH   0      0        0 eth0
195.70.150.41   10.0.0.57       255.255.255.255 UGH   0      0        0 eth0
217.172.151.24  0.0.0.0         255.255.255.252 U     0      0        0 eth1
217.172.149.152 0.0.0.0         255.255.255.248 U     0      0        0 eth0
217.172.149.152 0.0.0.0         255.255.255.248 U     0      0        0 eth0
10.0.0.0        0.0.0.0         255.255.255.0   U     0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eth1
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         217.172.151.25  0.0.0.0         UG    0      0        0 eth1

=====================================
iptables
   50 13928 ACCEPT     udp  --  eth1   *       0.0.0.0/0            217.172.151.26      udp dpt:500
    0     0 ACCEPT     esp  --  eth1   *       0.0.0.0/0            217.172.151.26
    0     0 ACCEPT     udp  --  eth1   *       0.0.0.0/0            217.172.151.26      udp dpt:4500