It would help to know what the message from the Contivity is. Most likely it is an error response to the Cisco, saying it can't negotiate the SA.
First, turn off the "keep alive" on the Cisco, if they still have it. It's been a while for me butCisco used to send a keep alive parameter or message that is not an IPSec standard. Only Cisco understands it. For Tunnels with Contivity, Check Point and probably others this needs to be turned off.
Second, different VPN brands handle the bad negotiation responses differently resulting in somewhat meaningless debug and log messages. Try to check the Contivity logs / debug to see why it is not happy.
Third, double check your encryption and hash algorithms. Just because you enable DES, 3DES and AES on one side and 3DES on the other, both with MD5, does not mean the systems will talk long enough to find common ground. Try setting both sides to only one option so it is the first and only SA they try.
Fouth, triple check your SA and session timers. Problems with session timers typically show up only after the tunnel has been up for a while. It suddenly drops for a while and may get re-established later. Bad SA times may result in failed negotiations and are the single most frequent issue I ran into during Interop testing of several vpn brands.
Good luck.
