Vpn cannot coonect: vpn type = Cisco IPsec

Question

Howdy,
I cannot connect to my vpn server at work receiving this error message "The VPN server did not respond. Verify the server address and try reconnecting."
I have verified, using the packet sniffer wireshark, that the first isakmp packet goes out to my work server and a correctly formatted isakmp reply (with a single selected proposal/transform SA payload) returns in reply. Then my racoon retransmits as if it never heard the reply.
I tried turning off the osx appliacation firewall, but get the same result... a correct isakmp reply does return from the server, but my racoon seems to never hear it and it just retransmits message-1.
What are the possible cluprits that could throw out my isakmp reply packet before racoon hears it?
The /var/log/system.log file holds these relevant entries:
Aug 19 09:44:28 narwal racoon[467]: Connecting.
Aug 19 09:44:28 narwal racoon[467]: IKE Packet: transmit success. (Initiator, Aggressive-Mode message 1).
Aug 19 09:44:38 narwal configd[15]: SCNCController: Disconnecting. (Connection tried to negotiate for, 0 seconds).
Aug 19 09:44:38 narwal racoon[467]: Disconnecting. (Connection tried to negotiate for, 9.966375 seconds).
I also manually configured and started racoon turning up the debug level very high and find no new info that way. racoon simply does not get the reply packet that I can see in wireshark.
Any help appreciated.

Answer 1

Additional info:
While attempting to connect, I run a `netstat` command and see that even the OS seems to not hear the reply from the server:
udp4 0 0 localhost.ipsec-msft .
udp4 0 0 localhost.isakmp .
udp4 0 0 192.168.2.105.ipsec-ms .
udp4 0 0 192.168.2.105.isakmp .
Sooooo... reiterating the question:
What potential culprits on the packet path might be throwing out this reply packet even before the OS udp layer? I think I have eliminated the snow-leapord application firewall as the culprit by turning it off and getting the same result.
And just to prove that wireshark really is seeing the return packet, I am posting the (trimmed) tshark -V output here too:
narwal:~ rcharletOld$ tshark -V
Capturing on en1
Frame 1 (747 bytes on wire, 747 bytes captured)
<snip>
Internet Protocol, Src: 192.168.2.105 (192.168.2.105), Dst: 72.5.229.5 (72.5.229.5)
<snip>
User Datagram Protocol, Src Port: isakmp (500), Dst Port: isakmp (500)
Source port: isakmp (500)
Destination port: isakmp (500)
Length: 713
Checksum: 0xdd63 [correct]
[Good Checksum: True]
[Bad Checksum: False]
Internet Security Association and Key Management Protocol
Initiator cookie: E1C811BDD9DF8F6D
Responder cookie: 0000000000000000
Next payload: Security Association (1)
Version: 1.0
Exchange type: Aggressive (4)
<snip>
Security Association payload
Next payload: Key Exchange (4)
Payload length: 292
Domain of interpretation: IPSEC (1)
Situation: IDENTITY (1)
Proposal payload # 1
<snip>
Transform payload # 1
Next payload: Transform (3)
Payload length: 36
Transform number: 1
Transform ID: KEY_IKE (1)
Life-Type (11): Seconds (1)
Life-Duration (12): Duration-Value (3600)
Encryption-Algorithm (1): AES-CBC (7)
Key-Length (14): Key-Length (256)
Authentication-Method (3): XAUTHInitPreShared (65001)
Hash-Algorithm (2): SHA (2)
Group-Description (4): Alternate 1024-bit MODP group (2)
<snip>
Transform payload # 8
Next payload: NONE (0)
Payload length: 32
Transform number: 8
Transform ID: KEY_IKE (1)
Life-Type (11): Seconds (1)
Life-Duration (12): Duration-Value (3600)
Encryption-Algorithm (1): DES-CBC (1)
Authentication-Method (3): XAUTHInitPreShared (65001)
Hash-Algorithm (2): MD5 (1)
Group-Description (4): Alternate 1024-bit MODP group (2)
<snip>
Frame 2 (450 bytes on wire, 450 bytes captured)
<snip>
Internet Protocol, Src: 72.5.229.5 (72.5.229.5), Dst: 192.168.2.105 (192.168.2.105)
<snip>
Header checksum: 0x753d [correct]
<snip>
User Datagram Protocol, Src Port: isakmp (500), Dst Port: isakmp (500)
<snip>
Checksum: 0x535a [correct]
<snip>
Internet Security Association and Key Management Protocol
Initiator cookie: E1C811BDD9DF8F6D
Responder cookie: AF5EABF6C58CB367
Next payload: Security Association (1)
Version: 1.0
Exchange type: Aggressive (4)
Flags: 0x00
.... ...0 = Not encrypted
.... ..0. = No commit
.... .0.. = No authentication
Message ID: 0x00000000
Length: 408
Security Association payload
Next payload: Key Exchange (4)
Payload length: 56
Domain of interpretation: IPSEC (1)
Situation: IDENTITY (1)
Proposal payload # 1
Next payload: NONE (0)
Payload length: 44
Proposal number: 1
Protocol ID: ISAKMP (1)
SPI Size: 0
Proposal transforms: 1
Transform payload # 3
Next payload: NONE (0)
Payload length: 36
Transform number: 3
Transform ID: KEY_IKE (1)
Encryption-Algorithm (1): AES-CBC (7)
Key-Length (14): Key-Length (256)
Hash-Algorithm (2): MD5 (1)
Group-Description (4): Alternate 1024-bit MODP group (2)
Authentication-Method (3): XAUTHInitPreShared (65001)
Life-Type (11): Seconds (1)
Life-Duration (12): Duration-Value (3600)
Key Exchange payload
<snip>
Nonce payload
<snip>
Identification payload
Next payload: Hash (8)
Payload length: 12
ID type: 1
ID type: IPV4_ADDR (1)
Protocol ID: UDP (17)
Port: Unused
Identification data: 72.5.229.5
<snip>