In your previous mail you wrote: sainfo address 192.168.1.0/24 any address 192.168.1.0/24 any { => the sainfo should be equal to the negociated phase 2 ID payloads, i.e., in transport mode /32 (or /128) is required. Regards Francis.Dupont@enst-bretagne.fr