Hi. I found an old post of sthen's to tech@ about NAT-T interop between isakmpd(8) and Cisco ASA. In summary, when isakmpd negotiates NAT-T with ASA, it doesn't send the proper encapsulation mode (as per RFC 3947). Original post is here: http://openbsd.7691.n7.nabble.com/isakmpd-NAT-T-interoperability-td173004.html
The original patch had isakmpd send the encap mode values as specified in the NAT-T draft (modes 61443/61444) which I found ASA 9.x code rejected (rightly or wrongly). Having isakmpd send the RFC values of 3/4 allows the tunnel to come up. I don't know enough to say what the correct behavior should be here, but as sthen points out, the current behavior is definitely wrong. http://packetmischief.ca/files/openbsd/patches/isakmpd-nat-t-encap-mode.diff .joel
