isakmpd: ESP + AH tunnel in OpenBSD

Hi,

I try to setup IPSec with ESP + tunnel AH between host-to-host in
OpenBSD,
but fail to do so. Two hosts are PC openbsd1 to openbsd15.
openbsd1: 192.3.20.238
openbsd15: 192.3.40.55

When I ping from openbsd1 to openbsd15 and there is no reply from
openbsd1;
packet from openbsd1 to openbsd15 sniffed from ethereal is
[IP | AH | IP | ESP | data ]

When I ping from openbsd15 to openbsd1, there is reply from openbsd1 as
shown
by Ethereal software, but ping command doesn't print any reply packet.
Ethereal sniff:
From openbsd15: [IP | ESP | data ]
From openbsd1: [IP | AH | IP | ESP | data ]

Can I have ESP + tunnel AH in host-to-host setup??

My Configuration files are following;
[In openbsd1, isakmpd.policy file:]
KeyNote-Version: 2
Comment: This policy accepts ESP SAs from a remote that uses the right
password
$OpenBSD: policy,v 1.4 2000/01/26 15:20:40 niklas Exp $
$EOM: policy,v 1.5 2000/01/26 14:03:07 niklas Exp $
Authorizer: "POLICY"
Licensees: "passphrase:mekmitasdigoat"
Conditions: app_domain == "IPsec policy" -> "true";

[In openbsd1, isakmpd.conf file:]
# $OpenBSD: singlehost-west.conf,v 1.8 2000/05/03 13:37:33 niklas Exp $
# $EOM: singlehost-west.conf,v 1.8 2000/05/03 13:25:25 niklas Exp $

# A configuration sample for the isakmpd ISAKMP/Oakley (aka IKE)
daemon.

[Phase 1]
192.3.40.55 = ISAKMP-peer-open15

[Phase 2]
Connections= IPsec-open15


[ISAKMP-peer-open15]
Phase= 1
Transport= udp
Address= 192.3.40.55
Configuration= Default-main-mode
Authentication= mekmitasdigoat

[IPsec-open15]
Phase= 2
ISAKMP-peer= ISAKMP-peer-open15
Configuration= Default-quick-mode
Local-ID= Net-open1
Remote-ID= Net-open15


[Net-open1]
ID-type= IPV4_ADDR_SUBNET
Network= 192.3.20.238
Netmask= 255.255.255.255

[Net-open15]
ID-type= IPV4_ADDR_SUBNET
Network= 192.3.40.55
Netmask= 255.255.255.255


[Default-main-mode]
DOI= IPSEC
EXCHANGE_TYPE= ID_PROT
Transforms= 3DES-MD5

[3DES-SHA]
ENCRYPTION_ALGORITHM= 3DES_CBC
HASH_ALGORITHM= SHA
AUTHENTICATION_METHOD= PRE_SHARED
GROUP_DESCRIPTION= MODP_1024
Life= LIFE_3600_SECS

[3DES-MD5]
ENCRYPTION_ALGORITHM= 3DES_CBC
HASH_ALGORITHM= MD5
AUTHENTICATION_METHOD= PRE_SHARED
GROUP_DESCRIPTION= MODP_1024
Life= LIFE_3600_SECS

[Default-quick-mode]
DOI= IPSEC
EXCHANGE_TYPE= QUICK_MODE
#Suites= QM-ESP-3DES-SHA-SUITE
#Suites= QM-ESP-3DES-MD5-SUITE
#Suites= QM-AH-MD5-ESP-DES-SUITE
Suites= QM-ESP-3DES-MD5-AH-MD5-SUITE

# Quick mode protection suites
##############################
# 3DES
# [QM-AH-MD5-ESP-3DES-MD5-SUITE]
[QM-ESP-3DES-MD5-AH-MD5-SUITE]
Protocols= QM-ESP-3DES-MD5,QM-AH-MD5


# Quick mode protocols
#############################
# 3DES
[QM-ESP-3DES-MD5]
PROTOCOL_ID= IPSEC_ESP
Transforms= QM-ESP-3DES-MD5-XF

# AH
[QM-AH-MD5]
PROTOCOL_ID= IPSEC_AH
Transforms= QM-AH-MD5-XF

# Quick mode transforms
#############################
# 3DES
[QM-ESP-3DES-MD5-XF]
TRANSFORM_ID= 3DES
ENCAPSULATION_MODE= TRANSPORT
AUTHENTICATION_ALGORITHM= HMAC_MD5
GROUP_DESCRIPTION= MODP_1024
Life= LIFE_3600_SECS

# AH Transform
[QM-AH-MD5-XF]
TRANSFORM_ID= MD5
ENCAPSULATION_MODE= TRANSPORT
AUTHENTICATION_ALGORITHM= HMAC_MD5
GROUP_DESCRIPTION= MODP_1024
Life= LIFE_3600_SECS

[LIFE_3600_SECS]
LIFE_TYPE= SECONDS
LIFE_DURATION= 3600,1800:7200




[In openbsd15, isakmpd.policy file:]
KeyNote-Version: 2
Comment: This policy accepts ESP SAs from a remote that uses the right
password
$OpenBSD: policy,v 1.4 2000/01/26 15:20:40 niklas Exp $
$EOM: policy,v 1.5 2000/01/26 14:03:07 niklas Exp $
Authorizer: "POLICY"
Licensees: "passphrase:mekmitasdigoat"
Conditions: app_domain == "IPsec policy" -> true;

[In openbsd15, isakmpd.conf file:]
# $OpenBSD: singlehost-west.conf,v 1.8 2000/05/03 13:37:33 niklas Exp $
# $EOM: singlehost-west.conf,v 1.8 2000/05/03 13:25:25 niklas Exp $

# A configuration sample for the isakmpd ISAKMP/Oakley (aka IKE)
daemon.

[Phase 1]
192.3.20.238= ISAKMP-open1

[Phase 2]
Connections= IPsec-svr-open1

[ISAKMP-open1]
Phase= 1
Transport= udp
Address= 192.3.20.238
Configuration= Default-main-mode
Authentication= mekmitasdigoat

[IPsec-svr-open1]
Phase= 2
ISAKMP-peer= ISAKMP-rtu2
Configuration= Default-quick-mode
Local-ID= Net-open15
Remote-ID= Net-open1

[Net-open15]
ID-type= IPV4_ADDR_SUBNET
Network= 192.3.40.55
Netmask= 255.255.255.255

[Net-open1]
ID-type= IPV4_ADDR_SUBNET
Network= 192.3.20.238
Netmask= 255.255.255.255

[Default-main-mode]
DOI= IPSEC
EXCHANGE_TYPE= ID_PROT
Transforms= 3DES-MD5

[Default-quick-mode]
DOI= IPSEC
EXCHANGE_TYPE= QUICK_MODE
Suites= QM-ESP-3DES-MD5-AH-MD5-SUITE


[3DES-MD5]
ENCRYPTION_ALGORITHM= 3DES_CBC
HASH_ALGORITHM= MD5
AUTHENTICATION_METHOD= PRE_SHARED
GROUP_DESCRIPTION= MODP_1024
Life= LIFE_3600_SECS

# Quick mode protection suites
##############################
# ESP
# ESP + AH
# Work 1
#[QM-AH-MD5-ESP-3DES-MD5-SUITE]
[QM-ESP-3DES-MD5-AH-MD5-SUITE]
Protocols= QM-ESP-3DES-MD5,QM-AH-MD5

# Quick mode protocols
#############################
# 3DES-SHA
[QM-ESP-3DES-MD5]
PROTOCOL_ID= IPSEC_ESP
Transforms= QM-ESP-3DES-MD5-XF

# AH
[QM-AH-MD5]
PROTOCOL_ID= IPSEC_AH
Transforms= QM-AH-MD5-XF

# Quick mode transforms
#############################
# 3DES
[QM-ESP-3DES-MD5-XF]
TRANSFORM_ID= 3DES
ENCAPSULATION_MODE= TUNNEL
AUTHENTICATION_ALGORITHM= HMAC_MD5
GROUP_DESCRIPTION= MODP_1024
Life= LIFE_3600_SECS


# AH Transform
[QM-AH-MD5-XF]
TRANSFORM_ID= MD5
ENCAPSULATION_MODE= TUNNEL
AUTHENTICATION_ALGORITHM= HMAC_MD5
GROUP_DESCRIPTION= MODP_1024
Life= LIFE_3600_SECS

[LIFE_3600_SECS]
LIFE_TYPE= SECONDS
LIFE_DURATION= 3600,1800:7200

.