(racoon 840) Road Warrior host-to-net in tunnel mode.

Hello ,
  Trying to make connection for
  host 192.168.88.191 -=tunnel=-192.168.88.30-to net 192.168.254.0/24-

  I think that this errors mean that kernel do not has  poilcy for this connection.
  But I use "generate_policy on;" ?!
  Is there is other way to auto setup policy for multiply road warrior for host2net connections for different subnet's
  Or way to preliminary setup policy based on X.509 CN or other characteristics of certfile ?
  racoon  0.3.3 + winxp sp2
  
Oct 22 17:20:15 template racoon: INFO: IPsec-SA established: ESP/Tunnel 192.168.88.30->192.168.88.191 spi=790471552(0x2f1da380)
Oct 22 17:20:16 template racoon: ERROR: such policy does not already exist: 192.168.88.191/32[0] 192.168.254.1/32[0] proto=any dir=in

remote anonymous {
    certificate_type x509 "ipsec-template.crt" "ipsec-template.decrypted.key";
    peers_certfile "ipsec-windows.crt";

        exchange_mode main,aggressive;

        doi  ipsec_doi;
        nonce_size 16;
        lifetime time 60 min;
        proposal_check obey;
        situation identity_only;
        initial_contact on;
        verify_identifier off;
        passive on;
        proposal {
                encryption_algorithm 3des;
                hash_algorithm sha1;
                authentication_method rsasig;
                dh_group modp1024;
        }
        generate_policy on;
}
#
sainfo anonymous
{
       pfs_group modp768;
        encryption_algorithm 3des;
        authentication_algorithm hmac_md5;
        compression_algorithm deflate;
}

 Igor                          mailto:[email protected]