I never succeeded to initiate VPN from Windows XP SP2 with X509 and NAT-T A negociation packet from windows is IP fragmented, and the fragment never reaches the firewall. I have not found the solution. I am interested for any help......