IPSec timeout: "ERROR Hybrid auth negotiated but peer did not succeed Xauth

Question

I'm using the Cisco IPSec VPN client on the iPad to connect a Linux server running racoon.
Initially the connection works fine but after a while it stalls completely due to a timeout.
Linux box logs:
13:18:00 Linux racoon: ERROR: Hybrid auth negotiated but peer did not succeed Xauth exchange
13:18:00 Linux racoon: ERROR: Attempt to start phase 2 whereas Xauth failed
13:18:03 Linux racoon: ERROR: Hybrid auth negotiated but peer did not succeed Xauth exchange
13:18:03 Linux racoon: ERROR: Attempt to start phase 2 whereas Xauth failed
iPad logs:
13:17:55 Pad racoon 719 <Info>: 719 INFO: initiate new phase 2 negotiation: 192.168.1.100[0]<=>x.x.x.x[0]
13:17:55 Pad racoon 719 <Info>: 719 INFO: NAT detected -> UDP encapsulation (ENC_MODE 1->3).
13:18:25 Pad racoon 719 <Info>: 719 ERROR: x.x.x.x give up to get IPsec-SA due to time up to wait.
Server-side racoon config:
remote anonymous
passive on;
exchange_mode aggressive,main;
my_identifier fqdn "xxxxxxxxx.xxx";
generate_policy on;
nat_traversal on;
mode_cfg on;
xauth_login "ipsecvpn";
script "p1updown" phase1_up;
script "p1updown" phase1_down;
#dpd_delay 20;
#dpd_retry 5;
#dpd_maxfail 5;
#dpd_algorithm dpdblackholedetect;
initial_contact on;
lifetime time 24 hour;
proposal_check strict;
proposal {
encryption_algorithm aes 256;
hash_algorithm sha1;
dh_group 2;
authentication_method xauthpskserver;
# authentication_method presharedkey;
mode_cfg
# auth_source pam;
auth_source system;
auth_throttle 3;
auth_source system;
save_passwd on;
conf_source local;
accounting system;
network4 10.8.1.2;
netmask4 255.255.255.0;
pool_size 255;
dns4 10.8.1.1;
# default_domain "xxxxxxxxx.xxx";
# split_network include 10.8.0.0/16;
# split_dns "xxxxxxxxx.xxx";
pfs_group 2;
sainfo anonymous
lifetime time 12 hour;
# lifetime byte 50 MB;
encryption_algorithm aes, blowfish;
authentication_algorithm hmac_sha1 ;
compression_algorithm deflate ;
pfs_group 2;
# EOF
iPad fw: 3.2.1 (same problem also with 3.2.2)
Any ideas?

Answer 1

Re-keying issue? I dunno. The manual mentions Phase 1, and your log points to Phase 2, but maybe it's worth a shot.
"Re-keying of Phase 1: Not currently supported. Recommend that re-keying times on
the server be set to approximately one hour."
Incidentally, how do you get logs off of the iPad?