Help for IPsec with inter Vlan Source!

Question

Hi everyone,
I have 6509 switch and 2800 router. Connectivity between them with satellite and run GRE tunnel over this media.
**6509
ip vrf VSAT
rd x : x
interface vlan 1
ip add 1.1.1.1 /28
ip vrf forwarding VSAT
interface tunnel 1
ip add 10.1.1.1 /24
tunnel source 1.1.1.1
tunnel des 2.2.2.2
**2800
interface vlan 1
ip add 2.2.2.2 /28
interface tunnel 1
ip add 10.1.1.2 /24
tunnel source  2.2.2.2
tunnel des 1.1.1.1
When I run IPsec over this tunnel, the tunnel does not work. ( going to down and never up until remove ipsec over tunnel!)
I use crypto map and bind this to the interface vlan in both side.
And when run " show crypto isakmp sa " I see this :    " MM_NO_STAT "
All expert, what you thing?
What configuration do I need to work properly?
Please help me. This urgent.
Thanks.

Answer 1

Unlike a Router, an ASA appliance will try and NAT traffic going from one internal subnet to another.
You need to add a static NAT per subnet, as below:
static (inside,PHONE) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
static (PHONE,inside) 192.168.10.0 192.168.10.0 netmask 255.255.255.0