Mind you though - i believe I remeber there were some issues that you had to be very carefull about on 2.4.5 because it was less than capable of supporting the lastest standards.

I would strongly recommend you upgrade to 2.6 and implement your IPsec as a IKEv2 setup. Works beautifully with all the clients, and the only major drawback is in enterprise size networks because Netgate has not implemented named IP pools to assign clients to with Radius returned class info. So all clients are treated the same because you cant separate them by IP unless you create static IP return rules pr. User from radius.