Probleme entre openswan et xp via nat

bonjour,

etudiant, je dois mettre en place un vpn entre un nomade xp et un réseau privé, via un nat.
ci-dessous, mon réseau d'étude, les logs et les fichiers de configuration.
quand le nat n'est pas activé, le vpn s'établit.
par contre, quand le nat est activé, plus de connexion et j'obtiens les erreurs suivantes :
(meme symptomes avec openswan 2.3.1)

cannot respond to ipsec sa request because no connection is known
invalid_id_information
quick mode i1 message is unacceptable because it uses a previously used message id
invalid_message_id

merci pour vos aides.

etienne.

experimentation network :

|192.168.30.0 lan
--------------
openswan 2.2.0 rh9 kernel 2.4.20-8
--------------
|192.168.20.10
|
|192.168.20.20
--------------
nat : prerouting -i eth0 -j dnat --to 192.168.20.10
(mandrake 9)
--------------
|200.10.10.10
|
|
|200.10.10.20
--------------
router linux
(mandrake 9)
--------------
|192.168.10.20
|
|192.168.10.30
--------------
roadwarrior xp sp2
--------------

jun 2 03:04:10 linuxrh9 ipsec__plutorun: starting pluto subsystem...
pluto[6207]: starting pluto (openswan version 2.2.0 X.509-1.5.4 pluto_uses_keyrr)
pluto[6207]: including nat-traversal patch (version 0.6c)
pluto[6207]: ike_alg_register_enc(): activating oakley_aes_cbc: ok (ret=0)
pluto[6207]: using klips ipsec interface code
pluto[6207]: changing to directory '/etc/ipsec.d/cacerts'
pluto[6207]: loaded ca cert file 'cacert.pem' (1107 bytes)
pluto[6207]: could not change to directory '/etc/ipsec.d/aacerts'
pluto[6207]: changing to directory '/etc/ipsec.d/ocspcerts'
pluto[6207]: changing to directory '/etc/ipsec.d/crls'
pluto[6207]: loaded crl file 'crl.pem' (459 bytes)
pluto[6207]: loaded host cert file '/etc/ipsec.d/certs/universite.pem' (3348 bytes)
pluto[6207]: added connection description "nomade"
pluto[6207]: listening for ike messages
pluto[6207]: adding interface ipsec0/eth0 192.168.20.10
pluto[6207]: adding interface ipsec0/eth0 192.168.20.10:4500
pluto[6207]: loading secrets from "/etc/ipsec.secrets"
pluto[6207]: loaded private key file '/etc/ipsec.d/private/universite.key' (964 bytes)
pluto[6207]: packet from 192.168.10.30:500: ignoring vendor id payload [ms nt5 isakmpoakley 00000004]
pluto[6207]: packet from 192.168.10.30:500: ignoring vendor id payload [fragmentation]
pluto[6207]: packet from 192.168.10.30:500: received vendor id payload [draft-ietf-ipsec-nat-t-ike-02_n]
pluto[6207]: packet from 192.168.10.30:500: ignoring vendor id payload [26244d38eddb61b3172a36e3d0cfb819]
pluto[6207]: "nomade"[1] 192.168.10.30 #1: responding to main mode from unknown peer 192.168.10.30
pluto[6207]: "nomade"[1] 192.168.10.30 #1: transition from state (null) to state state_main_r1
pluto[6207]: "nomade"[1] 192.168.10.30 #1: nat-traversal: result using draft-ietf-ipsec-nat-t-ike-02/03: i am nated
pluto[6207]: "nomade"[1] 192.168.10.30 #1: transition from state state_main_r1 to state state_main_r2
pluto[6207]: "nomade"[1] 192.168.10.30 #1: peer id is id_der_asn1_dn: 'c=fr, st=orsay, l=essonne, o=universite, cn=nomade220'
pluto[6207]: "nomade"[2] 192.168.10.30 #1: deleting connection "nomade" instance with peer 192.168.10.30 {isakmp=#0/ipsec=#0}
pluto[6207]: "nomade"[2] 192.168.10.30 #1: i am sending my cert
pluto[6207]: "nomade"[2] 192.168.10.30 #1: transition from state state_main_r2 to state state_main_r3
pluto[6207]: | nat-t: new mapping 192.168.10.30:500/4500)
pluto[6207]: "nomade"[2] 192.168.10.30:4500 #1: sent mr3, isakmp sa established
pluto[6207]: "nomade"[2] 192.168.10.30:4500 #1: cannot respond to ipsec sa request because no connection is known for 200.10.10.10/32===192.168.20.10:4500[c=fr, st=orsay, l=essonne, o=universite, cn=universite.fr]...192.168.10.30:4500[c=fr, st=orsay, l=essonne, o=universite, cn=nomade220]
pluto[6207]: "nomade"[2] 192.168.10.30:4500 #1: sending encrypted notification invalid_id_information to 192.168.10.30:4500
pluto[6207]: "nomade"[2] 192.168.10.30:4500 #1: quick mode i1 message is unacceptable because it uses a previously used message id 0x9f57aca8 (perhaps this is a duplicated packet)
pluto[6207]: "nomade"[2] 192.168.10.30:4500 #1: sending encrypted notification invalid_message_id to 192.168.10.30:4500
pluto[6207]: "nomade"[2] 192.168.10.30:4500 #1: quick mode i1 message is unacceptable because it uses a previously used message id 0x9f57aca8 (perhaps this is a duplicated packet)
pluto[6207]: "nomade"[2] 192.168.10.30:4500 #1: sending encrypted notification invalid_message_id to 192.168.10.30:4500
pluto[6207]: "nomade"[2] 192.168.10.30:4500 #1: quick mode i1 message is unacceptable because it uses a previously used message id 0x9f57aca8 (perhaps this is a duplicated packet)
pluto[6207]: "nomade"[2] 192.168.10.30:4500 #1: sending encrypted notification invalid_message_id to 192.168.10.30:4500
pluto[6207]: "nomade"[2] 192.168.10.30:4500 #1: received delete sa payload: deleting isakmp state #1
pluto[6207]: "nomade"[2] 192.168.10.30:4500: deleting connection "nomade" instance with peer 192.168.10.30 {isakmp=#0/ipsec=#0}
pluto[6207]: packet from 192.168.10.30:4500: received and ignored informational message
pluto[6207]: packet from 192.168.10.30:4500: informational exchange is for an unknown (expired?) sa
pluto[6207]: packet from 192.168.10.30:4500: informational exchange is for an unknown (expired?) sa

linux ipsec.con file :
config setup
interfaces="ipsec0=eth0"
klipsdebug=all
plutodebug=none
nat_traversal=yes
myid=@linuxrh9
uniqueids=no
virtual_private=%v4:192.168.10.0/24,%v4:192.168.20.0/24,%v4:192.168.30.0/24

conn %default
keyingtries=3
compress=yes
disablearrivalcheck=no
#authby=secret
authby=rsasig
leftrsasigkey=%cert
rightrsasigkey=%cert

conn nomade
right=%any
left=192.168.20.10
leftnexthop=192.168.20.20
#leftnexthop=200.10.10.10
leftcert=proxitel.pem
auto=add
pfs=no
rightid=%any
leftid=%any

#disable opportunistic encryption
include /etc/ipsec.d/examples/no_oe.conf

xp ipsec.conf file :
conn nomade
left=%any
right=200.10.10.10
rightca="c=fr, s=fontenay-les-briis, l=essonne, o=universite, cn=universite.fr"
network=auto
auto=start
pfs=no
compress=yes
veuillez s'il vous plait lasser des commentaire.merci