racoon only matches against the first IP subjectAltName?
I haven’t examined the source yet to make sure that I’m right, but imperical evidence leads me to believe that racoon is only recognizing the first IP field in an x509v3 subjectAltName extension. That is, for the following certificate:
X509v3 Subject Alternative Name:
DNS:arthur.example.org, IP Address:192.168.35.24, IP Address:10.14.82.152
It appears that only the 192.168.x.x address will be accepted as a valid ID by racoon. Requests with an ID of 10.14.82.152 will be discarded with the error message: ID mismatched with subjectAltName. So far I’ve only tested this with anonymous remote nodes.
tech stuff. 
Were you able to verify this? Did you find a work around? I’m in the same position.
Ben
2009-05-13 at 15:57
I think I remember that to work around this I changed my_identifier to asn1dn in order to forgo the IP check — which is a shame since correlating the IP is useful and I wish the check worked.
verb
2009-05-13 at 16:37
I ended up using 1 SSL Cert per IP and running multiple instances of racoon, each with their own ‘listen { }’ directive to bind to the IP of the Cert.
Not ideal, but working.
Ben
2009-05-14 at 14:50