I dont know if this helps... I just captured this data.
01:16:52.081340 AF IPv4 (2), length 1166: (tos 0x0, ttl 63, id 11796, offset
0, flags [none], proto UDP (17), length 1162)
67.33.160.231.500 > 63.148.132.32.500: [udp sum ok] isakmp 1.0 msgid
cookie ->: phase 1 I agg:
(sa: doi=ipsec situation=identity
(p: #1 protoid=isakmp transform=18
(t: #1 id=ike (type=enc value=aes)(type=keylen
value=0100)(type=hash value=md5)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))
(t: #2 id=ike (type=enc value=aes)(type=keylen
value=0100)(type=hash value=sha1)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))
(t: #3 id=ike (type=enc value=aes)(type=keylen
value=00c0)(type=hash value=md5)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))
(t: #4 id=ike (type=enc value=aes)(type=keylen
value=00c0)(type=hash value=sha1)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))
(t: #5 id=ike (type=enc value=aes)(type=keylen
value=0080)(type=hash value=md5)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))
(t: #6 id=ike (type=enc value=aes)(type=keylen
value=0080)(type=hash value=sha1)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))
(t: #7 id=ike (type=enc value=blowfish)(type=keylen
value=0100)(type=hash value=md5)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))
(t: #8 id=ike (type=enc value=blowfish)(type=keylen
value=0100)(type=hash value=sha1)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))
(t: #9 id=ike (type=enc value=blowfish)(type=keylen
value=00c0)(type=hash value=md5)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))
(t: #10 id=ike (type=enc value=blowfish)(type=keylen
value=00c0)(type=hash value=sha1)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))
(t: #11 id=ike (type=enc value=blowfish)(type=keylen
value=0080)(type=hash value=md5)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))
(t: #12 id=ike (type=enc value=blowfish)(type=keylen
value=0080)(type=hash value=sha1)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))
(t: #13 id=ike (type=enc value=3des)(type=hash
value=md5)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))
(t: #14 id=ike (type=enc value=3des)(type=hash
value=sha1)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))
(t: #15 id=ike (type=enc value=cast)(type=hash
value=md5)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))
(t: #16 id=ike (type=enc value=cast)(type=hash
value=sha1)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))
(t: #17 id=ike (type=enc value=1des)(type=hash
value=md5)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))
(t: #18 id=ike (type=enc value=1des)(type=hash
value=sha1)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))))
(ke: key len=128)
(nonce: n len=20
data=(968f9d3f1209a2553410...0000001412f5f28c457168a9702d9fe274cc0100))
(id: idtype=keyid protoid=0 port=0 len=10)
(vid: len=8)
(vid: len=16)
(vid: len=16)
(vid: len=16)
(vid: len=16)
(vid: len=16)
(vid: len=16)
(vid: len=16)
(vid: len=20)
(vid: len=16)
(vid: len=16)
01:16:52.495410 AF IPv4 (2), length 480: (tos 0x0, ttl 110, id 65481, offset
0, flags [none], proto UDP (17), length 476)
63.148.132.32.500 > 67.33.160.231.500: [udp sum ok] isakmp 1.0 msgid
cookie ->: phase 1 R agg:
(sa: doi=ipsec situation=identity
(p: #1 protoid=isakmp transform=1
(t: #13 id=ike (type=enc value=3des)(type=hash
value=md5)(type=group desc value=modp1024)(type=auth
value=fde9)(type=lifetype value=sec)(type=lifeduration len=4
value=00015180))))
(ke: key len=128)
(nonce: n len=20
data=(2fe179c057702c28a28b...000000141f07f70eaa6514d3b0fa96542a500407))
(id: idtype=IPv4 protoid=udp port=0 len=4 63.148.132.32)
(hash: len=16)
(vid: len=16)
(vid: len=8)
(vid: len=16)
(vid: len=16)
(#130)
(#130)
(vid: len=20)
(vid: len=16)
(vid: len=16)
01:16:52.522169 AF IPv4 (2), length 128: (tos 0x0, ttl 63, id 12052, offset
0, flags [none], proto UDP (17), length 124)
67.33.160.231.4500 > 63.148.132.32.4500: [udp sum ok] NONESP-encap:
isakmp 1.0 msgid cookie ->: phase 1 I agg[E]: [encrypted hash]
01:16:52.522209 AF IPv4 (2), length 112: (tos 0x0, ttl 63, id 12308, offset
0, flags [none], proto UDP (17), length 108)
67.33.160.231.4500 > 63.148.132.32.4500: [udp sum ok] NONESP-encap:
isakmp 1.0 msgid cookie ->: phase 2/others I inf[E]: [encrypted hash]
01:16:52.567879 AF IPv4 (2), length 136: (tos 0x0, ttl 110, id 42889, offset
0, flags [none], proto UDP (17), length 132)
63.148.132.32.4500 > 67.33.160.231.4500: [udp sum ok] NONESP-encap:
isakmp 1.0 msgid cookie ->: phase 2/others R #6[E]: [encrypted hash]
01:16:52.568405 AF IPv4 (2), length 120: (tos 0x0, ttl 63, id 12564, offset
0, flags [none], proto UDP (17), length 116)
67.33.160.231.4500 > 63.148.132.32.4500: [udp sum ok] NONESP-encap:
isakmp 1.0 msgid cookie ->: phase 2/others I #6[E]: [encrypted hash]
01:16:52.933515 AF IPv4 (2), length 96: (tos 0x0, ttl 110, id 42299, offset
0, flags [none], proto UDP (17), length 92)
63.148.132.32.4500 > 67.33.160.231.4500: [udp sum ok] NONESP-encap:
isakmp 1.0 msgid cookie ->: phase 2/others R #6[E]: [encrypted hash]
01:16:52.934049 AF IPv4 (2), length 96: (tos 0x0, ttl 63, id 12820, offset
0, flags [none], proto UDP (17), length 92)
67.33.160.231.4500 > 63.148.132.32.4500: [udp sum ok] NONESP-encap:
isakmp 1.0 msgid cookie ->: phase 2/others I #6[E]: [encrypted hash]
01:16:52.934216 AF IPv4 (2), length 208: (tos 0x0, ttl 63, id 13076, offset
0, flags [none], proto UDP (17), length 204)
67.33.160.231.4500 > 63.148.132.32.4500: [udp sum ok] NONESP-encap:
isakmp 1.0 msgid cookie ->: phase 2/others I #6[E]: [encrypted hash]
01:16:52.983505 AF IPv4 (2), length 856: (tos 0x0, ttl 110, id 63651, offset
0, flags [none], proto UDP (17), length 852)
63.148.132.32.4500 > 67.33.160.231.4500: [udp sum ok] NONESP-encap:
isakmp 1.0 msgid cookie ->: phase 2/others R #6[E]: [encrypted hash]
01:17:00.975924 AF IPv4 (2), length 856: (tos 0x0, ttl 110, id 53390, offset
0, flags [none], proto UDP (17), length 852)
63.148.132.32.4500 > 67.33.160.231.4500: [udp sum ok] NONESP-encap:
isakmp 1.0 msgid cookie ->: phase 2/others R #6[E]: [encrypted hash]
01:17:07.524193 AF IPv4 (2), length 120: (tos 0x0, ttl 63, id 13332, offset
0, flags [none], proto UDP (17), length 116)
67.33.160.231.4500 > 63.148.132.32.4500: [udp sum ok] NONESP-encap:
isakmp 1.0 msgid cookie ->: phase 2/others I inf[E]: [encrypted hash]
01:17:07.524231 AF IPv4 (2), length 33: (tos 0x0, ttl 63, id 13588, offset
0, flags [none], proto UDP (17), length 29)
67.33.160.231.4500 > 63.148.132.32.4500: [udp sum ok]
isakmp-nat-keep-alive
01:17:08.976024 AF IPv4 (2), length 856: (tos 0x0, ttl 110, id 57495, offset
0, flags [none], proto UDP (17), length 852)
63.148.132.32.4500 > 67.33.160.231.4500: [udp sum ok] NONESP-encap:
isakmp 1.0 msgid cookie ->: phase 2/others R #6[E]: [encrypted hash]
01:17:16.976918 AF IPv4 (2), length 856: (tos 0x0, ttl 110, id 35255, offset
0, flags [none], proto UDP (17), length 852)
63.148.132.32.4500 > 67.33.160.231.4500: [udp sum ok] NONESP-encap:
isakmp 1.0 msgid cookie ->: phase 2/others R #6[E]: [encrypted hash]
01:17:22.525199 AF IPv4 (2), length 33: (tos 0x0, ttl 63, id 13844, offset
0, flags [none], proto UDP (17), length 29)
67.33.160.231.4500 > 63.148.132.32.4500: [udp sum ok]
isakmp-nat-keep-alive
01:17:22.525352 AF IPv4 (2), length 120: (tos 0x0, ttl 63, id 14100, offset
0, flags [none], proto UDP (17), length 116)
67.33.160.231.4500 > 63.148.132.32.4500: [udp sum ok] NONESP-encap:
isakmp 1.0 msgid cookie ->: phase 2/others I inf[E]: [encrypted hash]
01:17:24.983594 AF IPv4 (2), length 112: (tos 0x0, ttl 110, id 46083, offset
0, flags [none], proto UDP (17), length 108)
63.148.132.32.4500 > 67.33.160.231.4500: [udp sum ok] NONESP-encap:
isakmp 1.0 msgid cookie ->: phase 2/others R inf[E]: [encrypted hash]
