Can't get past "pending Phase 2" on OpenSWAN <-> ISA Server IPSec VPN

Solution 1:

I've came across this situation in recent days.

It was due to two issues.

1. Firewall
2. Kernal IP forwarding disabled
3. Preshared-key mismatch

For firewall, it turns out port 500 and 4500 were blocked. By running ipsec verify, you can see whether 500 or 4500 blocked.

In /etc/sysctl.conf,

change net.ipv4.ip_forward to 1

append

net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv4.conf.default.send_redirects = 0
net.ipv4.conf.lo.accept_redirects = 0
net.ipv4.conf.lo.send_redirects = 0
net.ipv4.conf.em1.accept_redirects = 0
net.ipv4.conf.em1.send_redirects = 0

The em1 is the network interface, yours maybe eth0 or eth1

Finally, in my case, the preshared key in /etc/ipsec.d/ipsec.secrets were mistakenly enclosed with double quote ", which result in preshared key mismatch.

Hope it helps somebody.