remote box outside interface: 63.147.76.30, inside interface 192.168.241.15 remote network: #ike esp from 192.168.0.0/16 to 10.50.3.0/24 peer 71.196.227.124 #ike esp from 63.147.76.30 to 10.50.3.0/24 peer 71.196.227.124 #ike esp from 63.147.76.30 to 71.196.227.124 Maybe try this? ike esp from 192.168.0.0/16 to 10.50.3.0/24 peer 71.196.227.194 ike esp from 63.147.76.30 to 10.50.3.0/24 peer 71.196.227.194 ike esp from 63.147.76.30 to 71.196.227.194 # netstat -rnf encap Routing tables Encap: Source Port Destination Port Proto SA(Address/Proto/Type/Direction) 10.50.3/24 0 192.168/16 0 0 71.196.227.124/esp/use/in 192.168/16 0 10.50.3/24 0 0 71.196.227.124/esp/require/out 10.50.3/24 0 63.147.76.30/32 0 0 71.196.227.124/esp/use/in 63.147.76.30/32 0 10.50.3/24 0 0 71.196.227.124/esp/require/out home box outside interface 71.192.227.124 inside interface 10.50.3.1 home network: ike passive esp from 10.50.3.0/24 to 192.168.0.0/16 peer 63.147.76.30 ike passive esp from 71.192.227.194 to 192.168.0.0/16 peer 63.147.76.30 ike passive esp from 71.196.227.194 to 63.147.76.30 # netstat -rnf encap Routing tables Encap: Source Port Destination Port Proto SA(Address/Proto/Type/Direction) 192.168/16 0 10.50.3/24 0 0 63.147.76.30/esp/use/in 10.50.3/24 0 192.168/16 0 0 63.147.76.30/esp/require/out 63.147.76.30/32 0 10.50.3/24 0 0 63.147.76.30/esp/use/in 10.50.3/24 0 63.147.76.30/32 0 0 63.147.76.30/esp/require/out