OpenBSD + IPNAT + VPN - HELP!....

Hi everyone....

I am trying to setup VPN connection from Windows (Nortel Client) through
OpenBSD (NAT/IPF) to Nortel.

It seems that I get the ISAKMP to negotiate just fine but
when it comes to the tunnel it is a differnt story:

This is my setup:

| WIN Client |-----------|Open BSD |-----------| Nortel |


xl0 - external
xl1 - internal
x.x.x.x - Nortel
y.y.y.y - ip on xl0
z.z.z.z - ip on host with the client
k.k.k.k - ip on xl1 - gateway
ipf.rules
=========
# for esp protocol - I have not specify the protocol since I allow all
from this specific host
pass in quick on xl0 from x.x.x.x/32 to y.y.y.y/32
pass out quick on xl0 from y.y.y.y/32 to x.x.x.x/32
pass in quick on xl1 from any to x.x.x.x/32
pass out quick on xl1 from x.x.x.x/32 to any

#---------------------      UDP ISAKMP KEY
OTIATION    ----------------------
pass in quick on xl1 proto udp from z.z.z.z port = 500 to x.x.x.x/32 port =
500 keep state

ipnat.rules
===========
bimap xl0 y.y.y.y/32 -> x.x.x.x/32

External Interface TCPDUMP
07:43:27.549341 x.x.x.x.500 > y.y.y.y.500: isakmp v1.0 exchange INFO
cookie: 706c21ba7b23ffee->bc913c8656d13c01 msgid: 00000000 len: 40
07:43:27.550407 y.y.y.y.500 > x.x.x.x.500: isakmp v1.0 exchange AGGRESSIVE
cookie: 706c21ba7b23ffee->0000000000000000 msgid: 00000000 len: 324
07:43:27.705309 x.x.x.x.500 > y.y.y.y.500: isakmp v1.0 exchange INFO
cookie: 706c21ba7b23ffee->285de1c413970480 msgid: 00000000 len: 40
07:43:27.738159 y.y.y.y.500 > x.x.x.x.500: isakmp v1.0 exchange AGGRESSIVE
cookie: 706c21ba7b23ffee->0000000000000000 msgid: 00000000 len: 284
07:43:28.193897 x.x.x.x.500 > y.y.y.y.500: isakmp v1.0 exchange AGGRESSIVE
cookie: 706c21ba7b23ffee->aa6518a779fa28b9 msgid: 00000000 len: 232
07:43:28.229533 y.y.y.y.500 > x.x.x.x.500: isakmp v1.0 exchange AGGRESSIVE
encrypted
cookie: 706c21ba7b23ffee->aa6518a779fa28b9 msgid: 00000000 len: 52
07:43:28.452708 x.x.x.x.500 > y.y.y.y.500: isakmp v1.0 exchange unknown
encrypted
cookie: 706c21ba7b23ffee->aa6518a779fa28b9 msgid: bf12bff5 len: 124
07:43:28.453900 y.y.y.y.500 > x.x.x.x.500: isakmp v1.0 exchange unknown
encrypted
cookie: 706c21ba7b23ffee->aa6518a779fa28b9 msgid: bf12bff5 len: 76
07:43:28.583195 x.x.x.x.500 > y.y.y.y.500: isakmp v1.0 exchange QUICK_MODE
encrypted
cookie: 706c21ba7b23ffee->aa6518a779fa28b9 msgid: b4331353 len: 580
07:43:28.648425 y.y.y.y.500 > x.x.x.x.500: isakmp v1.0 exchange QUICK_MODE
encrypted
cookie: 706c21ba7b23ffee->aa6518a779fa28b9 msgid: b4331353 len: 292
07:43:28.756717 x.x.x.x.500 > y.y.y.y.500: isakmp v1.0 exchange QUICK_MODE
encrypted
cookie: 706c21ba7b23ffee->aa6518a779fa28b9 msgid: b4331353 len: 52


INTERNAL INTERFACE TCPDUMP
07:43:27.463431 z.z.z.z.500 > x.x.x.x.500: isakmp v1.0 exchange AGGRESSIVE
cookie: 706c21ba7b23ffee->0000000000000000 msgid: 00000000 len: 316
07:43:27.549484 x.x.x.x.500 > z.z.z.z.500: isakmp v1.0 exchange INFO
cookie: 706c21ba7b23ffee->bc913c8656d13c01 msgid: 00000000 len: 40
07:43:27.550272 z.z.z.z.500 > x.x.x.x.500: isakmp v1.0 exchange AGGRESSIVE
cookie: 706c21ba7b23ffee->0000000000000000 msgid: 00000000 len: 324
07:43:27.705446 x.x.x.x.500 > z.z.z.z.500: isakmp v1.0 exchange INFO
cookie: 706c21ba7b23ffee->285de1c413970480 msgid: 00000000 len: 40
07:43:27.738025 z.z.z.z.500 > x.x.x.x.500: isakmp v1.0 exchange AGGRESSIVE
cookie: 706c21ba7b23ffee->0000000000000000 msgid: 00000000 len: 284
07:43:28.194061 x.x.x.x.500 > z.z.z.z.500: isakmp v1.0 exchange AGGRESSIVE
cookie: 706c21ba7b23ffee->aa6518a779fa28b9 msgid: 00000000 len: 232
07:43:28.229392 z.z.z.z.500 > x.x.x.x.500: isakmp v1.0 exchange AGGRESSIVE
encrypted
cookie: 706c21ba7b23ffee->aa6518a779fa28b9 msgid: 00000000 len: 52
07:43:28.452855 x.x.x.x.500 > z.z.z.z.500: isakmp v1.0 exchange unknown
encrypted
cookie: 706c21ba7b23ffee->aa6518a779fa28b9 msgid: bf12bff5 len: 124
07:43:28.453769 z.z.z.z.500 > x.x.x.x.500: isakmp v1.0 exchange unknown
encrypted
cookie: 706c21ba7b23ffee->aa6518a779fa28b9 msgid: bf12bff5 len: 76
07:43:28.583338 x.x.x.x.500 > z.z.z.z.500: isakmp v1.0 exchange QUICK_MODE
encrypted
cookie: 706c21ba7b23ffee->aa6518a779fa28b9 msgid: b4331353 len: 580
07:43:28.648283 z.z.z.z.500 > x.x.x.x.500: isakmp v1.0 exchange QUICK_MODE
encrypted
cookie: 706c21ba7b23ffee->aa6518a779fa28b9 msgid: b4331353 len: 292
07:43:28.756855 x.x.x.x.500 > z.z.z.z.500: isakmp v1.0 exchange QUICK_MODE
encrypted
cookie: 706c21ba7b23ffee->aa6518a779fa28b9 msgid: b4331353 len: 52

07:43:28.759525 esp z.z.z.z > x.x.x.x spi 0x00202AD8 seq 1 len 84
07:43:28.759747 k.k.k.k > z.z.z.z: icmp: host x.x.x.x unreachable
07:43:29.716258 esp z.z.z.z > x.x.x.x spi 0x00202AD8 seq 2 len 60
07:43:29.716470 k.k.k.k > z.z.z.z: icmp: host x.x.x.x unreachable
07:43:30.390774 esp z.z.z.z > x.x.x.x spi 0x00202AD8 seq 3 len 116
07:43:30.391030 k.k.k.k > z.z.z.z: icmp: host x.x.x.x unreachable
07:43:30.391077 esp z.z.z.z > x.x.x.x spi 0x00202AD8 seq 4 len 124
07:43:30.391097 esp z.z.z.z > x.x.x.x spi 0x00202AD8 seq 5 len 116
07:43:30.391283 k.k.k.k > z.z.z.z: icmp: host x.x.x.x unreachable
07:43:30.391457 k.k.k.k > z.z.z.z: icmp: host x.x.x.x unreachable