(racoon 909) Ipsec between Linux and Cisco

Hi,

I'm trying to set up an IPSec tunnel between a Linux machine and a Cisco
router. Phase 1 was OK but in Phase 2 after the negotiation started I
got errors which say "failed to get sainfo". What could have caused
these errors ? The messages I got are like this:

2005-02-18 12:40:41: INFO: isakmp.c:891:isakmp_ph1begin_r(): respond new
phase 1 negotiation: 10.1.14.3[500]<=>10.1.23.3[500]
2005-02-18 12:40:41: INFO: isakmp.c:896:isakmp_ph1begin_r(): begin
Identity Protection mode.
2005-02-18 12:40:41: WARNING: isakmp_inf.c:1343:isakmp_check_notify():
ignore INITIAL-CONTACT notification, because it is only accepted after
phase1.
2005-02-18 12:40:41: INFO: isakmp.c:2431:log_ph1established(): ISAKMP-SA
established 10.1.14.3[500]-10.1.23.3[500]
spi:f28e3a6f1a787258:d18318a491907e41
2005-02-18 12:41:11: INFO: isakmp.c:891:isakmp_ph1begin_r(): respond new
phase 1 negotiation: 10.1.14.3[500]<=>10.1.23.3[500]
2005-02-18 12:41:11: INFO: isakmp.c:896:isakmp_ph1begin_r(): begin
Identity Protection mode.
2005-02-18 12:41:11: WARNING: isakmp_inf.c:1343:isakmp_check_notify():
ignore INITIAL-CONTACT notification, because it is only accepted after
phase1.
2005-02-18 12:41:11: INFO: isakmp.c:2431:log_ph1established(): ISAKMP-SA
established 10.1.14.3[500]-10.1.23.3[500]
spi:f28e3a6fbffed6c1:0a259615632edbb6
2005-02-18 12:41:11: INFO: isakmp.c:1046:isakmp_ph2begin_r(): respond
new phase 2 negotiation: 10.1.14.3[0]<=>10.1.23.3[0]
2005-02-18 12:41:11: ERROR: isakmp_quick.c:1811:get_sainfo_r(): failed
to get sainfo.
2005-02-18 12:41:11: ERROR: isakmp_quick.c:1045:quick_r1recv(): failed
to get sainfo.
2005-02-18 12:41:11: ERROR: isakmp.c:1060:isakmp_ph2begin_r(): failed to
pre-process packet.

The setup is as follows:

In Linux:

racoon.conf:

path pre_shared_key "/etc/psk.txt";


remote 10.1.23.3 {
		  exchange_mode main;
		  proposal {
			    encryption_algorithm des;
			    hash_algorithm sha1;
			    authentication_method pre_shared_key;
			    dh_group modp1024;
			   }
		  }

sainfo address 10.1.14.3/24 udp address 10.1.24.3/24 udp {
			pfs_group modp1024;
			encryption_algorithm des, 3des;
			authentication_algorithm hmac_md5, hmac_sha1;
			compression_algorithm deflate;
			}

Ipsec.conf:

#!/usr/sbin/setkey -f
#
#Flush SAD and SPD

flush;
spdflush;

spdadd 10.1.14.3/24 10.1.24.3/24 udp -P out ipsec
esp/tunnel/10.1.14.3-10.1.23.3/require;
spdadd 10.1.24.3/24 10.1.14.3/24 udp -P in ipsec
esp/tunnel/10.1.23.3-10.1.14.3/require;

In the Cisco router I just specified the same pre-shared key and the AH
and ESP algorithms.

Thank you for any suggestion.

Thuan