(racoon 907) Racoon through NAT

Hello all,

I apologize in advance if this has been asked and answered already, but 
I've been searching for a while and haven't found anything that has 
convinced me that this is or is not possible, and all the how-to 
articles I see discussing NAT and racoon assume that NAT and racoon are 
on the same machine (which is not my case).



I have a FreeBSD box with a private IP address (192.168.1.101) behind a 
firewall/router with a public IP address, and NAT to allow the FreeBSD 
box to communicate with the world.

My office network has a NetScreen firewall/VPN (with a public IP 
address) and a private 10.x.x.x network behind it.

So, my proposed setup looks like this:

[ FreeBSD ]  <--(private)--> [ Router ] <--(Internet)--> [ Firewall/VPN 
] <--(private--> [ office net ]

I've successfully configured a connection from the FreeBSD box to the 
VPN without the router in between, but I'm having some trouble making it 
work with thr router (over NAT).

My router ("Router" above) supports IPSEC Passthrough, and it is enabled.

I configure gif and spd with the following script:

   #!/bin/sh

   local_pri=192.168.1.101
   local_pub=a.b.c.d

   remote_pri=10.25.1.1
   remote_pub=w.x.y.z

   ifconfig gif0 create tunnel ${local_pub} ${remote_pub}
   ifconfig gif0 inet ${local_pri} ${remote_pri} netmask 255.255.255.0

   setkey -FP
   setkey -F

   setkey -c <<EOF
   spdadd ${local_pri}/24 ${remote_pri}/24 any -P out ipsec 
esp/tunnel/${local_pub}-${remote_pub}/require;
   spdadd ${remote_pri}/24  ${local_pri}/24 any -P in ipsec 
esp/tunnel/${remote_pub}-${local_pub}/require;
   EOF

(I also tried it with local_pub=${local_pri}, but that also failed).



Here's my racoon.conf (this is unchanged from the setup that works -- 
without NAT).:

   remote anonymous
   {
        exchange_mode aggressive;
        doi ipsec_doi;
        situation identity_only;

        my_identifier user_fqdn "[email protected]";

        nonce_size 16;
        lifetime time 1 min;    # sec,min,hour
        initial_contact on;
        support_mip6 on;
        proposal_check obey;    # obey, strict or claim

        proposal {
                encryption_algorithm 3des;
                hash_algorithm sha1;
                authentication_method pre_shared_key ;
                dh_group 2;
        }
   }

   sainfo anonymous
   {
           pfs_group 2;
           lifetime time 36000 sec;
           encryption_algorithm 3des;
           authentication_algorithm hmac_sha1;
           compression_algorithm deflate;
   }


Is what I'm proposing not possible with racoon?

Thanks in advance,

--Chris