My understanding is even with a PSK you need port 500 open for the initial handshake.