Velocity Reviews - problems with cisco <-> netscreen

It appears that my cisco 806 is trying to forward the packets out my
public interface without encrypting them and sending them to the peer.
I can route packets from my 192.168.22.0 network where the netscreen
is, they make it over to the 192.168.23.0 network, but the responses
never make it back.

Anyone care to help me out on this?

Here is the router config.

Using 4991 out of 131072 bytes
!
version 12.3
no parser cache
no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname cisco-rtr
!
boot-start-marker
boot-end-marker
!
logging cns-events debugging

!
clock timezone Central -6
clock summer-time CDT recurring 1 Sun Apr 3:00 last Sun Oct 3:00
aaa new-model
!
!
aaa authentication ppp default local
aaa authorization network default if-authenticated
aaa session-id common
ip subnet-zero
no ip source-route
ip domain name int.fl240.com
ip name-server 192.168.23.26
ip dhcp excluded-address 192.168.23.200 192.168.23.201
ip dhcp excluded-address 192.168.23.1 192.168.23.39
!
no ip bootp server
ip inspect name myfw cuseeme audit-trail on timeout 3600
ip inspect name myfw ftp timeout 3600
ip inspect name myfw http java-list 3 audit-trail on timeout 3600
ip inspect name myfw rcmd timeout 3600
ip inspect name myfw realaudio timeout 3600
ip inspect name myfw smtp timeout 3600
ip inspect name myfw tftp timeout 30
ip inspect name myfw udp timeout 15
ip inspect name myfw tcp timeout 3600
ip inspect name myfw h323 timeout 3600
vpdn enable
vpdn ip udp ignore checksum
!
vpdn-group 1
! Default L2TP VPDN group
! Default PPTP VPDN group
accept-dialin
protocol any
virtual-template 1
!
!
!
!
class-map match-all VONAGE
match access-group 101
!
!
policy-map ALL
class VONAGE
bandwidth 256
class class-default
fair-queue
!
!
!
crypto isakmp policy 5
hash md5
authentication pre-share
group 2
lifetime 28800
crypto isakmp key netscreen address netscreen
!
!
crypto ipsec transform-set aptset esp-3des esp-sha-hmac
crypto ipsec transform-set ns-interop esp-des esp-md5-hmac
!
crypto map aptmap 2 ipsec-isakmp
set peer 192.168.22.200
set transform-set aptset
match address 111
!
crypto map netscreen-net 10 ipsec-isakmp
set peer netscreen
set transform-set ns-interop
match address 130
!
!
!
interface Ethernet0
ip address 192.168.23.1 255.255.255.0
ip nat inside
ip policy route-map proxy-redirect
no cdp enable
hold-queue 32 in
!
interface Ethernet1
ip address address 255.255.255.0
ip access-group 111 in
no ip unreachables
ip nat outside
ip inspect myfw out
no cdp enable
crypto map netscreen-net
service-policy output ALL
!
interface Virtual-Template1
ip unnumbered Ethernet1
ip mroute-cache
peer default ip address pool pptp
ppp encrypt mppe 40
ppp authentication ms-chap
!
ip local pool pptp 192.168.23.200 192.168.23.201
ip nat inside source list 102 interface Ethernet1 overload
ip classless
ip route 0.0.0.0 0.0.0.0 Ethernet1 permanent
no ip http server
no ip http secure-server
!
logging facility local5
logging 192.168.23.27
access-list 1 permit 192.168.23.0 0.0.0.255
access-list 1 permit any
access-list 3 permit any
access-list 23 permit 192.168.23.0 0.0.0.255
access-list 101 permit udp host 192.168.23.40 any
access-list 101 permit udp any host 192.168.23.40
access-list 102 permit ip 192.168.23.0 0.0.0.255 any
access-list 104 permit ip address 0.0.0.255 any
access-list 104 permit udp address 0.0.0.255 any eq isakmp
access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any traceroute
access-list 111 permit icmp any any unreachable
access-list 111 permit udp any eq bootps any eq bootpc
access-list 111 permit udp any eq bootps any eq bootps
access-list 111 permit udp any eq domain any
access-list 111 permit esp any any
access-list 111 permit udp any any eq isakmp
access-list 111 permit udp any any eq 10000
access-list 111 permit tcp any any eq 1723
access-list 111 permit gre any any
access-list 111 permit tcp any any eq 22
access-list 111 permit ip 192.168.22.0 0.0.0.255 192.168.23.0 0.0.0.255
log
access-list 111 permit ip 192.168.23.0 0.0.0.255 192.168.22.0 0.0.0.255
log
access-list 120 deny tcp any any neq www
access-list 120 deny tcp host 192.168.23.26 any
access-list 120 permit tcp any any
access-list 130 permit ip 192.168.22.0 0.0.0.255 192.168.23.0 0.0.0.255
log
access-list 130 permit ip 192.168.23.0 0.0.0.255 192.168.22.0 0.0.0.255
log
no cdp run
route-map proxy-redirect permit 10
match ip address 120
set ip next-hop 192.168.23.26
!
banner motd ^C
go away or I will track you down and sue you and you will go to jail

Enter Password:

^C
!
line con 0
exec-timeout 120 0
stopbits 1
line vty 0 4
access-class 1 in
exec-timeout 0 0
password 7
transport input ssh
!
scheduler max-task-time 5000
end

here is an output from debug ipsec sa
cisco-rtr#debug crypto ipsec
Crypto IPSEC debugging is on
cisco-rtr#terminal monitor
cisco-rtr#clear crypto sa peer netscreen
cisco-rtr#
12:18:44: IPSEC(delete_sa): deleting SA,
(sa) sa_dest= cisco, sa_prot= 50,
sa_spi= 0x54464F6D(1413893997),
sa_trans= esp-des esp-md5-hmac , sa_conn_id= 2004
12:18:44: IPSEC(add_sa): have new SAs -- expire existing in 30 sec.,
(sa) sa_dest= netscreen, sa_prot= 50,
sa_spi= 0x4C131F1C(1276321564),
sa_trans= esp-des esp-md5-hmac , sa_conn_id= 2005,
(identity) local= cisco, remote= netscreen,
local_proxy= 192.168.23.0/255.255.255.0/0/0 (type=4),
remote_proxy= 192.168.22.0/255.255.255.0/0/0 (type=4)
12:18:44: IPSEC(delete_sa): deleting SA,
(sa) sa_dest= netscreen, sa_prot= 50,
sa_spi= 0x4C131F1C(1276321564),
sa_trans= esp-des esp-md5-hmac , sa_conn_id= 2005
12:18:44: ISAKMP: Unlocking IPSEC struct 0x813F3908 from
delete_siblings, count 0
12:18:44: ISAKMP: received ke message (3/1)
12:18:44: ISAKMP: set new node -844168567 to QM_IDLE
12:18:44: ISAKMP (0:1): sending packet to netscreen my_port 500
peer_port 500 (I) QM_IDLE
12:18:44: ISAKMP (0:1): purging node -844168567
12:18:44: ISAKMP (0:1): Input = IKE_MESG_FROM_IPSEC, IKE_PHASE2_DEL
12:18:44: ISAKMP (0:1): Old State = IKE_P1_COMPLETE New State =
IKE_P1_COMPLETE

12:18:53: ISAKMP (0:1): received packet from netscreen dport 500 sport
500 Global (I) QM_IDLE
12:18:53: ISAKMP: set new node -928160302 to QM_IDLE
12:18:53: ISAKMP (0:1): processing HASH payload. message ID =
-928160302
12:18:53: ISAKMP (0:1): processing SA payload. message ID = -928160302
12:18:53: ISAKMP (0:1): Checking IPSec proposal 1
12:18:53: ISAKMP: transform 1, ESP_DES
12:18:53: ISAKMP: attributes in transform:
12:18:53: ISAKMP: SA life type in seconds
12:18:53: ISAKMP: SA life duration (VPI) of 0x0 0x0 0xE 0x10
12:18:53: ISAKMP: encaps is 1 (Tunnel)
12:18:53: ISAKMP: authenticator is HMAC-MD5
12:18:53: ISAKMP (0:1): atts are acceptable.
12:18:53: IPSEC(validate_proposal_request): proposal part #1,
(key eng. msg.) INBOUND local= cisco, remote= netscreen,
local_proxy= 192.168.23.0/255.255.255.0/0/0 (type=4),
remote_proxy= 192.168.22.0/255.255.255.0/0/0 (type=4),
protocol= ESP, transform= esp-des esp-md5-hmac (Tunnel),
lifedur= 0s and 0kb,
spi= 0x0(0), conn_id= 0, keysize= 0, flags= 0x2
12:18:53: IPSEC(kei_proxy): head = netscreen-net, map->ivrf = ,
kei->ivrf =
12:18:53: ISAKMP (0:1): processing NONCE payload. message ID =
-928160302
12:18:53: ISAKMP (0:1): processing ID payload. message ID = -928160302
12:18:53: ISAKMP (0:1): processing ID payload. message ID = -928160302
12:18:53: ISAKMP (0:1): asking for 1 spis from ipsec
12:18:53: ISAKMP (0:1): Node -928160302, Input = IKE_MESG_FROM_PEER,
IKE_QM_EXCH
12:18:53: ISAKMP (0:1): Old State = IKE_QM_READY New State =
IKE_QM_SPI_STARVE
12:18:53: IPSEC(key_engine): got a queue event...
12:18:53: IPSEC(spi_response): getting spi 1606767518 for SA
from cisco to netscreen for prot 3
12:18:53: ISAKMP: received ke message (2/1)
12:18:53: ISAKMP: Locking peer struct 0x813F3908, IPSEC refcount 1 for
for stuff_ke
12:18:53: ISAKMP (0:1): Creating IPSec SAs
12:18:53: inbound SA from netscreen to cisco (f/i) 0/ 0
(proxy 192.168.22.0 to 192.168.23.0)
12:18:53: has spi 0x5FC5539E and conn_id 2000 and flags 2
12:18:53: lifetime of 3600 seconds
12:18:53: has client flags 0x0
12:18:53: outbound SA from cisco to netscreen (f/i) 0/ 0 (proxy
192.168.23.0 to 192.168.22.0 )
12:18:53: has spi 1276321566 and conn_id 2001 and flags A
12:18:53: lifetime of 3600 seconds
12:18:53: has client flags 0x0
12:18:53: ISAKMP (0:1): sending packet to netscreen my_port 500
peer_port 500 (I) QM_IDLE
12:18:53: ISAKMP (0:1): Node -928160302, Input = IKE_MESG_FROM_IPSEC,
IKE_SPI_REPLY
12:18:53: ISAKMP (0:1): Old State = IKE_QM_SPI_STARVE New State =
IKE_QM_R_QM2
12:18:53: IPSEC(key_engine): got a queue event...
12:18:53: IPSEC(initialize_sas): ,
(key eng. msg.) INBOUND local= cisco, remote= netscreen,
local_proxy= 192.168.23.0/255.255.255.0/0/0 (type=4),
remote_proxy= 192.168.22.0/255.255.255.0/0/0 (type=4),
protocol= ESP, transform= esp-des esp-md5-hmac (Tunnel),
lifedur= 3600s and 0kb,
spi= 0x5FC5539E(1606767518), conn_id= 2000, keysize= 0, flags= 0x2
12:18:53: IPSEC(initialize_sas): ,
(key eng. msg.) OUTBOUND local= cisco, remote= netscreen,
local_proxy= 192.168.23.0/255.255.255.0/0/0 (type=4),
remote_proxy= 192.168.22.0/255.255.255.0/0/0 (type=4),
protocol= ESP, transform= esp-des esp-md5-hmac (Tunnel),
lifedur= 3600s and 0kb,
spi= 0x4C131F1E(1276321566), conn_id= 2001, keysize= 0, flags= 0xA
12:18:53: IPSEC(kei_proxy): head = netscreen-net, map->ivrf = ,
kei->ivrf =
12:18:53: IPSEC(crypto_ipsec_sa_find_ident_head): reconnecting with the
same proxies and netscreen
12:18:53: IPSEC(add mtree): src 192.168.23.0, dest 192.168.22.0,
dest_port 0

12:18:53: IPSEC(create_sa): sa created,
(sa) sa_dest= cisco, sa_prot= 50,
sa_spi= 0x5FC5539E(1606767518),
sa_trans= esp-des esp-md5-hmac , sa_conn_id= 2000
12:18:53: IPSEC(create_sa): sa created,
(sa) sa_dest= netscreen, sa_prot= 50,
sa_spi= 0x4C131F1E(1276321566),
sa_trans= esp-des esp-md5-hmac , sa_conn_id= 2001
12:18:53: ISAKMP (0:1): received packet from netscreen dport 500 sport
500 Global (I) QM_IDLE
12:18:53: ISAKMP (0:1): deleting node -928160302 error FALSE reason
"quick mode done (await)"
12:18:53: ISAKMP (0:1): Node -928160302, Input = IKE_MESG_FROM_PEER,
IKE_QM_EXCH
12:18:53: ISAKMP (0:1): Old State = IKE_QM_R_QM2 New State =
IKE_QM_PHASE2_COMPLETE
12:18:53: IPSEC(key_engine): got a queue event...
12:18:53: IPSEC(key_engine_enable_outbound): rec'd enable notify from
ISAKMP
12:18:53: IPSEC(key_engine_enable_outbound): enable SA with spi
1276321566/50 for netscreen
12:19:43: ISAKMP (0:1): purging node -928160302