Help! HELP!! RedHat IPSEC <-> NAT router <-> SonicWall VPN

The configuration is as follows:

(1) Local computer 192.168.254.X running on local network, running Red Hat
Enterprise Linux.
(2) NAT router connected to cable-modem outbound. Local address
192.168.254.254, public address 66.111.111.111 (say...)
(3) SonicWall router public on Internet 66.222.222.222 (say...) connected to
target network.
(4) Target machine is 192.160.30.X on target network.

Relevant entries in /etc/sysconfig/network-scripts config-file are:
IKE_METHOD=PSK
DST=66.222.222.222 (public address of SonicWall)
DSTNET=192.168.30.0/24
SRCNET=192.168.254.0/24
(correct shared-key string is elsewhere)

An "ip route to" statement in /etc/sysconfig/network-scripts/ifup-ipsec had
to be nopped-out to avoid runtime errors ("network is not accessible").

What happens with Racoon is: ipSec-tools 0.2.3)

"1 times of 244 bytes will be sent to..." (?!) 192.168.254.X (?!)
... plogdump of 244-byte message
"92 bytes message received from 66.222.222.222[500]"
"ignore message because message has no hash payload"
(above message repeated 3 times)
... and it quits.

At /one/ time in the past I received "hash incorrect" messages. I have not
gotten them lately and, of course, I do not know what I did differently.
But, at some time in the past, there was some hash-info coming in.

The configuration-file entry is:
remote 66.222.222.222 {
exchange_mode aggressive, main;
my_identifier address;
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 2;
} }


User at end-point site claims that no negotiation-failed messages have been
received on his end; but he's an affirmed Windows-head anyway. :-/ I find
it hard to believe because 92 bytes of information are certainly coming
from someone somewhere.

I am DESPERATE for help!

--- (E-Mail Removed)

Sundial Services wrote:
> [blah blah blah...]
> I am DESPERATE for help!

And so far not getting any, I've been trying to debug the problem myself.
And getting somewhere. Here's what I found so far...

(1) Probably the most helpful web-site so far has been at OnLamp.Com,
"Cryptography: Debugging IPSEC."
http://www.onlamp.com/pub/a/bsd/2003...SD_Basics.html

(2) I found out how to run Racoon in debugging mode and found that all it
told me was that there was a failure in the phase-1 negotiation: "message
discarded because no hash payload." In other words, that there was a
problem but not what or why.

(3) At the web-site's suggestion I discovered "ethereal," which was on my
system but I didn't know it. Having learned that the phase-1 key
negotiation takes place on UDP Port 500, I sniffed the connection and was
able to =look= at the message that was being sent in reply. (Which Racoon
did not do! Maybe their developers never encounter errors?)

(4) The message says: "No proposal chosen." It even includes plain TEXT to
that effect! If only I had seen that before!

.... to be continued ...