I was setting up a VPN gateway using a RHEL5 server the other day only to find that a majority of the features that you really need to have a functional Site-to-Site VPN gateway aren't included in the version of the ipsec-tools included with RHEL5. One of the biggest features that I found lacking that I just couldn't do without was
split_network under the mode_cfg configuration section. Per the racoon man-page, the split_network feature allows for setting:
The network configuration to send, in cidr notation (e.g. 192.168.1.0/24). If include is speci-fied, the tunnel should be only used to encrypt the indicated destinations ; otherwise, if local_lan is used, everything will pass through the tunnel but those destinations.
The solution to all of this? Upgrade to ipsec-tools 0.7.1. I snagged a SRPM for FedoraCore9 (which ships with 0.7.1) and recompiled the RPM on my VPN gateway itself just to make sure I was using the same openssl libs, etc.