Cisco Concentrator 3005 alongside pfSense - vpn remote clients cannot connect

[bfulford7]

Ok just learning this pfSense setup. I am migrating from a cisco router with a concentrator 3005 to a pfSense box with the same concentrator. I am using the concentrator for site to site VPNs as well as a VPN gateway with LDAP authentication to our network for workers and it works great - just trying to replace the old router with IOS firewall. Current setup before pfSense:
ISP WAN ROUTER –-> switch ---> Cisco router xxx.xxx.xxx.252 (replacing this with pfSense box)
                                      |---> Cisco 3005  xxx.xxx.xxx.250

When I hotswap in the pfSense box, the VPN client software is not able to negotiate the security policies anymore. Here is a log sample.
Any ideas? Help?

29    22:05:10.528  03/16/09  Sev=Info/4 CM/0x6310000E
Established Phase 1 SA.  1 Crypto Active IKE SA, 1 User Authenticated IKE SA in the system

30    22:05:10.540  03/16/09  Sev=Info/5 IKE/0x6300005E
Client sending a firewall request to concentrator

31    22:05:10.540  03/16/09  Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(HASH, ATTR) to xxx.xxx.xxx.250

32    22:05:12.859  03/16/09  Sev=Info/6 IKE/0x63000055
Sent a keepalive on the IPSec SA

33    22:05:15.901  03/16/09  Sev=Info/4 IKE/0x63000021
Retransmitting last packet!

34    22:05:15.901  03/16/09  Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(Retransmission) to  xxx.xxx.xxx.250

35    22:05:20.971  03/16/09  Sev=Info/4 IKE/0x63000021
Retransmitting last packet!

36    22:05:20.971  03/16/09  Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(Retransmission) to  xxx.xxx.xxx.250

37    22:05:23.001  03/16/09  Sev=Info/6 IKE/0x63000055
Sent a keepalive on the IPSec SA

38    22:05:26.041  03/16/09  Sev=Info/4 IKE/0x63000021
Retransmitting last packet!

39    22:05:26.041  03/16/09  Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK TRANS *(Retransmission) to  xxx.xxx.xxx.250

40    22:05:31.110  03/16/09  Sev=Info/4 IKE/0x6300002D
Phase-2 retransmission count exceeded: MsgID=D080F5DE

41    22:05:31.110  03/16/09  Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, NOTIFY:DPD_REQUEST) to  xxx.xxx.xxx.250

42    22:05:31.110  03/16/09  Sev=Info/6 IKE/0x6300003D
Sending DPD request to  xxx.xxx.xxx.250, our seq# = 3241830546

43    22:05:31.110  03/16/09  Sev=Info/4 IKE/0x63000017
Marking IKE SA for deletion  (I_Cookie=DFAA17D352151C9D R_Cookie=4401410B500D9A64) reason = DEL_REASON_IKE_NEG_FAILED

44    22:05:31.110  03/16/09  Sev=Info/4 IKE/0x63000013
SENDING >>> ISAKMP OAK INFO *(HASH, DWR) to  xxx.xxx.xxx.250

45    22:05:34.152  03/16/09  Sev=Info/4 IKE/0x6300004B
Discarding IKE SA negotiation (I_Cookie=DFAA17D352151C9D R_Cookie=4401410B500D9A64) reason = DEL_REASON_IKE_NEG_FAILED

46    22:05:34.152  03/16/09  Sev=Info/4 CM/0x6310000F
Phase 1 SA deleted before Mode Config is completed cause by "DEL_REASON_IKE_NEG_FAILED".  0 Crypto Active IKE SA, 0 User Authenticated IKE SA in the system

47    22:05:34.152  03/16/09  Sev=Info/5 CM/0x63100025
Initializing CVPNDrv

48    22:05:34.156  03/16/09  Sev=Info/6 CM/0x63100046
Set tunnel established flag in registry to 0.

49    22:05:34.156  03/16/09  Sev=Info/4 IKE/0x63000001
IKE received signal to terminate VPN connection

[bfulford7]

Looks like this could be a DHCP problem from the concentrator to pfSense.

Here is a DHCP log entry with latest log first:

Mar 17 08:19:34 dhcpd: send_packet: Permission denied
Mar 17 08:19:34 dhcpd: DHCPOFFER on 192.168.10.231 to 00:03:a0:89:86:1d (DSI9200) via 192.168.10.0
Mar 17 08:19:34 dhcpd: DHCPDISCOVER from 00:03:a0:89:86:1d (DSI9200) via 192.168.10.0

So it looks like the concentrator's internal IP address is being seen as 10.0 instead of 10.26… wonder if a DHCP relay is needed??