Windows 8 inbound IPsec authentication failing?

I am getting some very strange behavior out of the Windows 8 Advanced Firewall / IPsec implementation.

It appears now that all inbound traffic that isn't return traffic from a previously contacted host is being dropped. Why?

Background:

I'm working on getting initial Windows 8 integration on my network, predominantly Windows 7 and Server 2008 R2 based. One of the requirements is using IPsec. I'm seeing some very unusual behavior from the Windows Advanced Firewall.

1. I can't generally establish inbound connections using an IPsec secured connection (assuming the use of a computer name or computer group). Outbound connections are fine.
2. On the rare chance that I do get an inbound connection to work I get something like the following, indicating two quick mode associations.

I've tried everything I can think of on this, even using two stock windows 8 systems without any group policies, etc applied to rule out my environment. The behavior remains the same.

This was apparently all systems joined to my domain during a certain time frame, including a couple Windows 7s. Building exactly identical VMs and joining them today functions 100% normally.

I'm guessing that a group policy or the like was the hangup, although there isn't any proof in the logs of a failure of this nature.

I've tried both rejoining the domain and deleting C:\WINDOWS\security\Database\secedit.sdb.

It looks like this was a wider issue then just inbound ipsec - it was all inbound traffic on the problem machines. I shut down the windows firewall service and my connections were still failing. It wasn't until I shut down the base filtering engine that things started working inbound.

I have tried using secedit /configure /cfg c:\Windows\inf\defltbase.inf /db defltbase.sdb /verbose to reset the local security rules without impact.