Ok, that's indeed impressive. Nevertheless it looks like I have to cook a new kernel due to this message:

racoon - IKE keying daemon will not be started as /proc/net/pfkey is not
available or a suitable 2.6 (or 2.4 with IPSEC backport)
kernel with af_key.[k]o module is not installed.

I use a standard Debian kernel:
Linux sip3 2.6.14.2 #5 Mon Nov 21 16:18:18 CET 2005 i686 GNU/Linux

AFAIK the IPSec _can_ be compiled into the kernel but it may be that it isn't. I want to use rented machines for this and it will be hard work to give all those machines a new kernel. Hoped it would match all 2.6 kernel but this perhaps is not true.

Nevertheless it is very very interesting here so please don't give up! I'm filling my brain with all of your postings.

Rolf