>I restarted the pix too but the problem is the same... >Agent Smith wrote: >add this to pix >isakmp identity address >then restart the tunnel I solved with: isakmp identity address on the pix and rightid=pix_private_ip_before_nat Now again the SA is done but: 1) no ipsec0 device found 2) no ping to subnet Can you help me? Thanks