[melipla]

For reference here's a sample of my log entry:

Number: 1
Date: 6Nov2007
Time: 19:19:19
Interface: daemon
Origin: firewall
Type: Log
Action: Key Install
Source: zzz.net
User: zebra
Information: MAC: ZA-ZA-AZ-AZ-ZA
OM: Assigned IP address for 14400 seconds - lease renewed or reassigned
om_method: IP pools
assigned_IP: 1.1.1.1
Encryption Scheme: IKE
Subproduct: VPN
VPN Feature: OfficeMode
Product: VPN-1 Power/UTM

The big difference I can see is that yours is an Alert and not a Log. There should be some indication why its an Alert. As for other differences, you don't list out the Mac or the assigned IP, so I'm assuming they weren't present. Which makes me wonder what you're using for DHCP, if its not the gateway then that's the first place I'd look. Also, why are you using a 300 second lease time, if you're that short on IPs then you should change your pool size.

On a side note, here's a short list of services which may be used during the authentication sequence, any drops with these may also cause a delay in authenticating:

tcp/264
tcp/500
udp/500
udp/259
udp/2746
udp/4500