to get l2tp working there are a lot of patches.
some of these patches are around NAT environments, where t1n1wall can be behind NAT, and the mobile device can also be behind NAT. When this is detected, these patches figure out the real and NAT'd address and try to do the right thing. However, it looks like for mobile ipsec, when racoon tries to create a dynamic policy, it is using the wrong address to create the policy.
From some basic testing today, I can see that the policy it is adding is to encrypt traffic from the client IP to the t1n1wall IP, and not from the client IP to the t1n1wall LAN subnet, I have modified one of the patches to remove this behavior, and made a new build (b64) for testing
This needs to be tested in 4 environments
1) t1n1wall is behind NAT, and client isn't
2) t1n1wall and client are behind their own NATs
3) client is behind NAT and t1n1wall isn't
4) no NAT between client and server
L2TP should be tested as above and IPSEC tunnels should be tested as working.
Andrew
