WatchGuard <---> OpenSwan

Эмм... а можно или самому или сюда debug сессии openswan?

[root@new-vpn ipsec.d]# ipsec auto --verbose --up conn 002 "conn" #11659: initiating Main Mode 104 "conn" #11659: STATE_MAIN_I1: initiate 003 "conn" #11659: ignoring unknown Vendor ID payload [a69ccd8c1c5d9b69b640851880a907e6] 003 "conn" #11659: ignoring unknown Vendor ID payload [da8e937880010000] 002 "conn" #11659: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 106 "conn" #11659: STATE_MAIN_I2: sent MI2, expecting MR2 002 "conn" #11659: I did not send a certificate because I do not have one. 002 "conn" #11659: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 108 "conn" #11659: STATE_MAIN_I3: sent MI3, expecting MR3 002 "conn" #11659: Main mode peer ID is ID_IPV4_ADDR: '12.155.113.114' 002 "conn" #11659: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4 004 "conn" #11659: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_sha group=modp1024} 002 "conn" #11660: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#11659} 117 "conn" #11660: STATE_QUICK_I1: initiate 010 "conn" #11660: STATE_QUICK_I1: retransmission; will wait 20s for response 010 "conn" #11660: STATE_QUICK_I1: retransmission; will wait 40s for response 031 "conn" #11660: max number of retransmissions (2) reached STATE_QUICK_I1. No acceptable response to our first Quick Mode message: perhaps peer likes no proposal 000 "conn" #11660: starting keying attempt 2 of an unlimited number, but releasing whack В security сильно много всего валится что именно надо.

Можете повторить, изменив форматирование и включив более глубокую отладку pluto?

Тут согласно interop.html из OpenSWAN описание настройки SWAN + WatchGuard с PSK:
http://lists.freeswan.org/pipermail/users/2002-July/012595.html

Там же сказано:
Watchguard Firebox

* Automatic keying works with WatchGuard 5.0+ only.
* Seen to interoperate with WatchGuard 1000, II, III; firmware v. 5,
6..
* For manual keying, Watchguard's Policy Manager expects SPI numbers
and encryption and authentication keys in decimal (not hex).