(racoon 738) payload 129 (gss id)

I am trying to set up IPSec on my Mac OS X 10.3.5 machine using Kerberos
authentication (ActiveDirectory as KDC). I'm connecting from my Windows XP
SP2 machine as a test. The Windows box is set to try IPSec and failover to
IP (AKA Request Mode).

Running racoon (20001216) in the foreground with log=debug, the negotiation
fails when XP sends the second packet, which contains KE(4), NONCE(10), and
GSS ID(129). The actual error is...

ERROR: isakmp_ident.c:1038:ident_r2recv(): ignore the packet, received
unexpecting payload type 129.

After some research, I found
<http://msdn.microsoft.com/library/default.asp?url=/library/en-us/randz/prot
ocol/gss-api_token_payload.asp> which describes this payload in the private
range.

Is there some configuration option for racoon to make it ignore this payload
rather than the entire packet? Not knowing enough about the optional GSSi(2)
and GSSr(2) tokens the page talks about, I don't know if they're necessary
for the operation.

Have other folks successfully negotiated a Kerberos auth based IPSec
connection between a racoon client and Windows XP? Perhaps I am missing some
other settings as well.

I have everything commented out after the timer section in racoon.conf, and
remote/anonymous.conf looks like...

remote anonymous
{
    exchange_mode main;
    my_identifier fqdn "mymachine.myfqdomain";
    proposal_check obey;
    lifetime time 10 min;
    proposal
    {
        encryption_algorithm 3des;
        hash_algorithm sha1;
        authentication_method gssapi_krb;
        dh_group 2;
        gssapi_id "mymachine@MYFQDOMAIN";
    }
}

sainfo anonymous
{
    pfs_group 1;
    lifetime time 30 sec;
    encryption_algorithm aes, 3des;
    authentication_algorithm hmac_sha1;
    compression_algorithm deflate;
}

Many thanks in advance,
Nathan Herring
MacBU SDE/Dev