The Debian ipsec-tools package doesn’t work properly with the Debian 2.4.21 kernel (you can’t specify “ipsec” as policy, it only recognises “discard” and “none”). Herbert Xu helped me out and I’ve rebuild the packages against the 2.4.21 kernel sources, and now it seems to work ok. I’ve made the packages available here.