Пытаюсь поднять L2TP+IPSEC тунель до офиса от клиента на ESR1000. Делаю все по книжке..

remote-access l2tp remote-ac
authentication mode local
local-address ip-address 10.10.10.1
remote-address address-range 10.10.10.100-10.10.10.200
outside-address ip-address 1.1.1.254
dns-servers object-group l2tp_dns
security-zone vpn
ipsec authentication method pre-shared-key
ipsec authentication pre-shared-key ascii-text encrypted ***********************
username user1
password ascii-text encrypted **********************
enable
exit
enable
exit
В лог сыпится вот это:
2018-06-25T12:40:51+03:00 Connection established to 1.1.1.125, 1701. Local: 7709, Remote: 7 (ref=0/0). LNS session is 'default'
2018-06-25T12:40:51+03:00 Call established with 1.1.1.125, Local: 24122, Remote: 1, Serial: 0
2018-06-25T12:40:53+03:00 EAP: unauthenticated peer name "user1"
2018-06-25T12:40:53+03:00 EAP: too many Requests sent
2018-06-25T12:40:53+03:00 control_finish: Connection closed to 1.1.1.125, serial 0 ()
2018-06-25T12:40:53+03:00 control_finish: Connection closed to 1.1.1.125, port 1701 (), Local: 7709, Remote: 7
У клиента на винде в параметрах PPP галки напротив многоканальных подключений нет.
Что может быть?