The 3Com superstack firewall/router is often found in corporate environments.
It supports manually keyed IPsec SAs, and can be told to change their end-points dynamically. It is a pain to interop with, but this page is about working through one.
The major problem is that it is friendly to port-500 packets, passing them through, and routing the ESP packets back. The problem is that it closes the port-500 hole. The DPD requests that are then received by the unit from the far end are then interpreted as IKE packets for it, and it gets confused and logs an error.
Since the 3Com does nothing that your basic LRP router could do, I don't know why anyone buys one.
