Cisco 3015 concentrator VPN bruteforce? And proxy with easy header rewrite?

Hello

I'm doing a pen-test in a Cisco 3015 concentrator - ipsec connections
tunneled over TCP port 10000.

By the way, ike-scan do not work with this vpn. Also the common tools
to brute force like THC-pptp, THC-Hydra and Medusa do not work also.

Nmap neither regoganize the port as opened (but it doesn't matter), it
say filtered, but I can telnet and estabilish a connection to it.

Do you have some experience with this device? Can you give me some
hints? And point me to some tools for identify, enumerate and
brute-force this Cisco implementation?

A bit off-topic: Does anyone know a easy to install and configure web
proxy for windows which enable headers rewrite? I need to setup a fast
web proxy at my windows box to replace all headers (before they are
sent to the webserver) of the "Cookie" field and a proprietary header.

Thanks folks.