emBSD and VPN problems

For everyone (but Ken - who should be with his *6* kids!!),

I'm having a hard time getting the following setup running correctly (please
no flames on why at corporate - I don't run that one - geez!):

Corporate HQ:
	Linksys BEFVP41  <--Gateway/VPN (w/ Static IP)
	Internal Network:  192.168.1.*  (NAT-ed)

Remote Office:
	emBSD - net4501  <--Gateway/Firewall (w/ Static IP)
	Internal Network: 192.168.2.*  (NAT-ed)

We're using the SSH Sentinel software as the client connection...with no
luck.  We've even got to the point of turning off all firewalls with no
luck, here's my pf.conf file (that I think has all of the IPSec passthru
stuff turned on)...can anyone spot the error - I'm sure it's obvious, just
can see the trees for the forest.

Thanks,

dave

---------------------------------------------------
# cat pf.conf
# Define useful variables
ExtIF="sis0"              # External Interface
IntNet="192.168.2.0/24"       # Our internal network

NoRouteIPs="{ 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8,
0.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, 204.152.64.0/23, 224.0.0.0/3 }"
Services="{ www, https, ssh, isakmp }"

# Clean up fragmented and abnormal packets
scrub in all

# don't allow anyone to spoof non-routeable addresses
block in  quick on $ExtIF from $NoRouteIPs to any
block out quick on $ExtIF from any to $NoRouteIPs

# stop all IPv6 traffic
block in quick inet6 all
block out quick inet6 all

# pass everything on loopback (lo0)
pass in quick on lo0 all
pass out quick on lo0 all

# by default, block all incoming packets, except those explicitly
# allowed by further rules
block in on $ExtIF all

# allow others to use {services}
pass  in on $ExtIF inet proto tcp from any to any port $Services \
        flags S/SA modulate state

# Allow VPN Traffic
pass in quick proto esp from any to any


# and let out-going traffic out and maintain state on established
connections
# pass out all protocols, including TCP, UDP and ICMP, and create state,
# so that external DNS servers can reply to our own DNS requests (UDP).
block out on $ExtIF                 all
pass  out on $ExtIF inet proto tcp  all flags S/SA modulate state
pass  out on $ExtIF inet proto udp  all            keep state
pass  out on $ExtIF inet proto icmp all            keep state
#