Test with ipsec manual before going to auto Manually keyed connections do not require key negotiation between Pluto and the key daemon on the other end. There is considerable opportunity for even two correct, standard-conforming, implementations to disagree on details in a way that blocks interoperation. Of course, misinterpretations of the standards and implementation or configuration errors on either end can also foul things up. There is a list in another of our documents.
Agressive mode is slightly faster, but reveals more information to an eavesdropper.
Suggestions on what to do if the device you want to talk to has only DES are in our FAQ document. Some other implementations, however, turn PFS off by default. The first thing to check if packets seem to be vanishing is the firewall rules on the two gateway machines and any other machines along the path that you have access to. For details, see our document on firewalls . This can tickle assorted bugs in path MTU discovery mechanisms and cause a variety of annoying symptoms.