Apple has implemented the IETF NAT-T standard (RFC 3947) in Mac OS X Panther (10.3.6). Unfortunately, Apple decided to deviate from the NAT-T standard in a small but subtle way so that it is not compatible with any other IPsec implementation. Panther sends the non-standard vendor ID string "draft-ietf-ipsec-nat-t-ike" instead of "RFC 3947". Additionally, according to some reports Apple actually implemented draft version 8 of the NAT-T standard which was the latest draft before the standard was ratified. This draft version is not the final version and, in fact, draft 8 jumped the gun a bit because it uses invalid numbers which are already allocated by IANA. This means that at this stage the NAT-T support in Mac OS X Panther will probably not interoperate with other IPsec implementations unless they are specifically modified to support this Panther quirk (Apple's Mac OS X Server is probably one of these implementations; the Stinghorn L2TP/IPsec Gateway is another one). So at this stage Panther behind a NAT device connecting to an Openswan server probably does not work. I did not look into this yet because the NAT-T patch for KLIPS does not support PSKs and 26sec has problems supporting the Mac's floating UDP source port. But it might be worth investigating after all.