GSSAPI and racoon

[Victor Sudakov]

Victor Sudakov wrote:
> 
> Is anyone running GSSAPI+IKE (racoon)?

I'm still struggling with racoon in GSSAPI mode. racoon says

2017-03-08 13:01:59: [192.168.3.38] ERROR: failed to get valid proposal.
2017-03-08 13:01:59: [192.168.3.38] ERROR: failed to pre-process ph1 packet (side: 1, status 1).
2017-03-08 13:01:59: [192.168.3.38] ERROR: phase1 negotiation failed.

I would be very grateful if someone with IPSec experience could look
at my configs and logs. What am I missing? 

Not to clutter the list, I'm giving short URLs:

racoon.conf: http://termbin.com/lk2w
racoon debug log: http://termbin.com/0lol
keytab: http://termbin.com/4yj9

The remote host configuration is identical, only it's called "ipsec1",
not "ipsec2".

BTW, does the "gss_id" parameter in the proposal section mean my id or
remote's id? I interpret is as my id.

PS If I comment out the GSSAPI stuff and enable the PSK stuff,
everything works all right, so my SPDs at least are correct.

-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
AS43859