I should note that we are load balancing multiple ISP's using third party boxes. (They were implemented before astaro added the feature.) The 192.168.100.50 address below is my actual ASG address behind the load balancing box.
Here's my IPSec log when trying to connect:
2009:11:22-10:33:09 portal-1 pluto[4521]: packet from :500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
2009:11:22-10:33:09 portal-1 pluto[4521]: packet from :500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2009:11:22-10:33:09 portal-1 pluto[4521]: packet from :500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
2009:11:22-10:33:09 portal-1 pluto[4521]: packet from :500: ignoring Vendor ID payload [FRAGMENTATION 80000000]
2009:11:22-10:33:09 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] :4500 #3038: responding to Main Mode from unknown peer :4500
2009:11:22-10:33:09 portal-1 pluto[4521]: | NAT-T: new mapping :4500/500)
2009:11:22-10:33:09 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] #3038: NAT-Traversal: Result using RFC 3947: i am NATed
2009:11:22-10:33:09 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] #3038: Peer ID is ID_IPV4_ADDR: ''
2009:11:22-10:33:09 portal-1 pluto[4521]: | NAT-T: new mapping :500/4500)
2009:11:22-10:33:09 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] :4500 #3038: sent MR3, ISAKMP SA established
2009:11:22-10:33:09 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] :4500 #3038: ignoring informational payload, type IPSEC_INITIAL_CONTACT
2009:11:22-10:33:10 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] :4500 #3038: cannot respond to IPsec SA request because no connection is known for /32===192.168.100.50:4500:17/1701...:4500:17/%any
2009:11:22-10:33:10 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] :4500 #3038: sending encrypted notification INVALID_ID_INFORMATION to :4500
2009:11:22-10:33:21 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] :4500 #3038: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x8ec7cbfd (perhaps this is a duplicated packet)
2009:11:22-10:33:21 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] :4500 #3038: sending encrypted notification INVALID_MESSAGE_ID to :4500
2009:11:22-10:33:30 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] :4500 #3038: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x8ec7cbfd (perhaps this is a duplicated packet)
2009:11:22-10:33:30 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] :4500 #3038: sending encrypted notification INVALID_MESSAGE_ID to :4500 2009:11:22-10:33:09 portal-1 pluto[4521]: packet from :500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]
2009:11:22-10:33:09 portal-1 pluto[4521]: packet from :500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]
2009:11:22-10:33:09 portal-1 pluto[4521]: packet from :500: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-00]
2009:11:22-10:33:09 portal-1 pluto[4521]: packet from :500: ignoring Vendor ID payload [FRAGMENTATION 80000000]
2009:11:22-10:33:09 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] :4500 #3038: responding to Main Mode from unknown peer :4500
2009:11:22-10:33:09 portal-1 pluto[4521]: | NAT-T: new mapping :4500/500)
2009:11:22-10:33:09 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] #3038: NAT-Traversal: Result using RFC 3947: i am NATed
2009:11:22-10:33:09 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] #3038: Peer ID is ID_IPV4_ADDR: ''
2009:11:22-10:33:09 portal-1 pluto[4521]: | NAT-T: new mapping :500/4500)
2009:11:22-10:33:09 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] :4500 #3038: sent MR3, ISAKMP SA established
2009:11:22-10:33:09 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] :4500 #3038: ignoring informational payload, type IPSEC_INITIAL_CONTACT
2009:11:22-10:33:10 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] :4500 #3038: cannot respond to IPsec SA request because no connection is known for /32===192.168.100.50:4500:17/1701...:4500:17/%any
2009:11:22-10:33:10 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] :4500 #3038: sending encrypted notification INVALID_ID_INFORMATION to :4500
2009:11:22-10:33:21 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] :4500 #3038: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x8ec7cbfd (perhaps this is a duplicated packet)
2009:11:22-10:33:21 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] :4500 #3038: sending encrypted notification INVALID_MESSAGE_ID to :4500
2009:11:22-10:33:30 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] :4500 #3038: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0x8ec7cbfd (perhaps this is a duplicated packet)
2009:11:22-10:33:30 portal-1 pluto[4521]: "S_REF_BgCLdHxzid"[1] :4500 #3038: sending encrypted notification INVALID_MESSAGE_ID to :4500