Hello,   below is an example. You need to configure 'mls qos vlan-based' on all physical access and trunk ports which are allowing VLAN 10 traffic, in addition to applying the service policy to the VLAN interface (SVI).   mls qos ! policy-map VLAN10_8MB class class-default police 8000000 8000 exceed-action drop ! interface GigabitEthernet0/1 switchport trunk encapsulation dot1q switchport mode trunk mls qos vlan-based ! interface FastEthernet0/1 switchport access vlan 10 switchport mode access mls qos vlan-based ! interface Vlan10 service-policy input VLAN10_8MB ... View more

Hello,   try and change the DH and PFS groups as below (marked in bold). The ASA groups need to match, obviously. Also, to be sure, check the NTP settings on both devices and make sure the clocks match...   If possible, post the ASA config as well...   crypto ikev2 proposal ikev2-TEST-prop encryption aes-cbc-256 integrity sha384 group 5 2 14 ! crypto ikev2 policy ikev2-TEST-pol match fvrf TEST_vrf match address local X.X.X.247 proposal ikev2-TEST-prop ! crypto ikev2 keyring TEST_Keyring peer inscom description TEST address X.X.X.37 pre-shared-key local <pre-shared-key removed> pre-shared-key remote <pre-shared-key removed> ! crypto ikev2 profile X.X.X.ikev2-prof description TEST profile match fvrf TEST match identity remote address X.X.X.37 255.255.255.255 authentication local pre-share authentication remote pre-share keyring local TEST_Keyring dpd 10 2 on-demand ivrf TEST_vrf ! crypto ipsec transform-set TEST_transform-aes esp-aes 256 esp-sha-hmac mode tunnel ! crypto map TEST_map local-address Loopback311 crypto map TEST_map 10 ipsec-isakmp description TEST set peer X.X.X.37 set transform-set TEST-transform-aes set pfs group2 set ikev2-profile TEST-ikev2-prof match address TEST_ACL ! ip route vrf TEST_vrf 0.0.0.0 0.0.0.0 GigabitEthernet1/0/1.79 X.X.X.10 ! ip access-list extended TEST_ACL permit ip X.X.X.113.0 0.0.0.64 any ! interface GigabitEthernet1/0/1.2978 encapsulation dot1Q 79 ip vrf forwarding TEST ip address X.X.X.14 255.255.255.248 crypto map TEST_map ! interface GigabitEthernet1/0/0.52 encapsulation dot1Q 251 ip vrf forwarding TEST_vrf ip address X.X.X.6 255.255.255.248 ip mtu 1376 ip tcp adjust-mss 1336 ! interface Loopback311 description TEST loopback ip vrf forwarding TEST_vrf ip address X.X.X.246 255.255.255.255 ... View more

Hello,   this post is getting very messy. Post the current running configuration, otherwise nobody knows what we are looking at anymore... ... View more

Hello,   use the configs below and just remove the route inside statements on both ASAs. I don't think your ASA is connected to a LAN interface, is tha right ?   remoteasa172# remoteasa172# remoteasa172# remoteasa172# remoteasa172# remoteasa172# : Hardware: ASA5520, 2048 MB RAM, CPU Pentium 4 Celeron 2000 MHz ASA Version 9.1(7)32 ! interface GigabitEthernet0/0 nameif outside security-level 0 ip address 192.168.168.232 255.255.255.0 ! interface GigabitEthernet0/1 nameif inside security-level 100 ip address 192.168.172.1 255.255.255.0 ! object network 192.168.172.0_24 subnet 192.168.172.0 255.255.255.0 object network 192.168.180.0_24 subnet 192.168.180.0 255.255.255.0 ! access-list OUTSIDE-IN extended permit ip any any log access-list OUTSIDE-IN extended permit icmp any any log access-list OUTSIDE-IN extended permit tcp any any log access-list OUTSIDE-OUT extended permit ip any any log access-list OUTSIDE-OUT extended permit icmp any any log access-list OUTSIDE-OUT extended permit tcp any any log access-list INSIDE-IN extended permit ip any any log access-list INSIDE-IN extended permit icmp any any log access-list INSIDE-IN extended permit tcp any any log access-list INSIDE-OUT extended permit ip any any log access-list INSIDE-OUT extended permit icmp any any log access-list INSIDE-OUT extended permit tcp any any log ! access-list LAN_Traffic extended permit ip object 192.168.172.0_24 object 192.168.180.0_24 log ! nat (inside,outside) source static 192.168.172.0_24 192.168.172.0_24 destination static 192.168.180.0_24 192.168.180.0_24 no-proxy-arp route-lookup ! nat (inside,outside) after-auto source dynamic any interface ! access-group OUTSIDE-IN in interface outside access-group OUTSIDE-OUT out interface outside access-group INSIDE-IN in interface inside access-group INSIDE-OUT out interface inside ! route outside 0.0.0.0 0.0.0.0 192.168.168.1 1 --> route inside 192.168.180.0 255.255.255.0 192.168.168.240 1 ! crypto ipsec ikev1 transform-set TS esp-aes-256 esp-sha-hmac crypto ipsec security-association pmtu-aging infinite crypto map CMAP 80 set pfs crypto map CMAP 80 set peer 192.168.168.240 crypto map CMAP 80 set ikev1 transform-set TS crypto map CMAP interface outside crypto ca trustpool policy crypto ikev1 enable outside crypto ikev1 policy 1 authentication pre-share encryption aes hash sha group 2 lifetime 86400 ! tunnel-group 192.168.168.240 type ipsec-l2l tunnel-group 192.168.168.240 ipsec-attributes ikev1 pre-shared-key ***** ! remoteasa172# remoteasa172# remoteasa172# -----------------================ remoteasa180 ===============--------------------- remoteasa180# remoteasa180# remoteasa180# remoteasa180# : Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz ASA Version 9.2(4)5 ! interface Ethernet0/0 description OUTSIDE_200 switchport access vlan 200 ! interface Ethernet0/1 description INSIDE_180 switchport access vlan 180 ! interface Vlan180 nameif inside security-level 100 ip address 192.168.180.1 255.255.255.0 ! interface Vlan200 description OUTSIDE_200 nameif outside security-level 0 ip address 192.168.168.240 255.255.255.0 ! object network 192.168.180.0_24 subnet 192.168.180.0 255.255.255.0 object network 192.168.172.0_24 subnet 192.168.172.0 255.255.255.0 ! access-list OUTSIDE-IN extended permit ip any any log access-list OUTSIDE-IN extended permit icmp any any log access-list OUTSIDE-IN extended permit tcp any any log access-list OUTSIDE-OUT extended permit ip any any log access-list OUTSIDE-OUT extended permit icmp any any log access-list OUTSIDE-OUT extended permit tcp any any log access-list INSIDE-IN extended permit ip any any log access-list INSIDE-IN extended permit icmp any any log access-list INSIDE-IN extended permit tcp any any log access-list INSIDE-OUT extended permit ip any any log access-list INSIDE-OUT extended permit icmp any any log access-list INSIDE-OUT extended permit tcp any any log ! access-list LAN_Traffic extended permit ip object 192.168.180.0_24 object 192.168.172.0_24 ! nat (inside,outside) source static 192.168.180.0_24 192.168.180.0_24 destination static 192.168.172.0_24 192.168.172.0_24 no-proxy-arp route-lookup ! nat (inside,outside) after-auto source dynamic any interface ! access-group INSIDE-IN in interface inside access-group INSIDE-OUT out interface inside access-group OUTSIDE-IN in interface outside access-group OUTSIDE-OUT out interface outside ! route outside 0.0.0.0 0.0.0.0 192.168.168.1 1 --> no route inside 192.168.172.0 255.255.255.0 192.168.168.232 1 ! crypto ipsec ikev1 transform-set TS esp-aes-256 esp-sha-hmac crypto ipsec security-association pmtu-aging infinite crypto map CMAP 72 match address LAN_Traffic crypto map CMAP 72 set pfs crypto map CMAP 72 set peer 192.168.168.232 crypto map CMAP 72 set ikev1 transform-set TS crypto map CMAP interface outside crypto ca trustpool policy crypto ikev1 enable outside crypto ikev1 policy 1 authentication pre-share encryption aes hash sha group 2 lifetime 86400 ! tunnel-group 192.168.168.232 type ipsec-l2l tunnel-group 192.168.168.232 ipsec-attributes ikev1 pre-shared-key ***** ! remoteasa180# ... View more

Hello,   post the running configs again...   To repeat what was asked earlier, to which interface is the other ASA connected ? Your remote network is routed through the inside, is that right ? ... View more

Hello,   so the current running config is working now ? The NAT statements were missing, and in your original post, the access-list had a typo (182 instead of 192)...   Good luck... ... View more

Type. Remove ip nat inside from that interface...   Curious to know if you get it to work.... ... View more

Hello,   which interface is the other ASA connected to (what is the outgoing interface) ? ... View more

Hello,   your access list 50 doesn't look right, as the destination is not 'any' (the Internet), but 10.2.4.0/24.   Make the changes marked in bold:   version 12.3 service timestamps debug datetime msec localtime service timestamps log datetime msec localtime service password-encryption ! hostname 2801 ! boot-start-marker boot-end-marker ! logging buffered 51200 warnings enable secret ????????????????????? ! clock timezone CDT -6 clock summer-time CDT recurring mmi polling-interval 60 no mmi auto-configure no mmi pvc mmi snmp-timeout 180 aaa new-model ! aaa authentication login default local aaa authentication login vtymethod group tacacs+ line aaa authentication login conmethod line aaa authentication enable default group tacacs+ enable aaa authentication ppp default none aaa authorization config-commands aaa authorization exec default local group tacacs+ none aaa authorization commands 1 default group tacacs+ if-authenticated aaa authorization commands 15 default group tacacs+ none aaa accounting exec default start-stop group tacacs+ aaa accounting commands 1 default start-stop group tacacs+ aaa accounting commands 15 default start-stop group tacacs+ aaa accounting network default start-stop group tacacs+ aaa accounting system default start-stop group tacacs+ aaa session-id common ip subnet-zero ip cef ! ip dhcp excluded-address 10.16.12.1 ip dhcp excluded-address 10.16.22.250 10.16.22.254 ip dhcp excluded-address 10.16.22.248 ! ip dhcp pool phones network 10.16.12.0 255.255.255.0 option 150 ip 10.2.4.4 default-router 10.16.12.1 dns-server 8.8.8.8 8.8.4.4 ! ip domain name domain.com ip multicast-routing no ftp-server write-enable ! voice-card 0 ! ccm-manager redundant-host 10.2.4.5 ccm-manager mgcp ccm-manager music-on-hold ccm-manager config server 10.2.4.4 ccm-manager config ! username tah privilege 15 password 7 ????????????????? username Cisco privilege 15 password 7 ???????????????? username CTS password 7 ????????????????????????? ! class-map match-any AutoQoS-VoIP-RTP-Trust match ip dscp ef class-map match-any AutoQoS-VoIP-Control-Trust match ip dscp cs3 match ip dscp af31 ! policy-map AutoQoS-Policy-Trust class AutoQoS-VoIP-RTP-Trust priority percent 70 class AutoQoS-VoIP-Control-Trust bandwidth percent 5 class class-default fair-queue ! buffers small permanent 100 buffers middle permanent 150 ! interface Tunnel0 description Backup to ???????????? bandwidth 768 ip address 10.151.1.134 255.255.255.252 tunnel source FastEthernet0/1 tunnel destination ??.??.??.252 ! interface Loopback0 ip address ??.???.???.1 255.255.255.248 ! interface FastEthernet0/0 description INFO no ip address ip route-cache flow duplex auto speed auto ! interface FastEthernet0/0.2 description Voice VLAN encapsulation dot1Q 2 ip address 10.16.12.1 255.255.255.0 ip pim sparse-dense-mode ! interface FastEthernet0/0.3 encapsulation dot1Q 3 ip address 10.150.44.250 255.255.255.0 ip nat inside ! interface FastEthernet0/0.4 description DMZ (Public) VLAN encapsulation dot1Q 4 ip nat inside ! interface FastEthernet0/0.50 description voice vlan encapsulation dot1Q 50 ip address 10.50.100.1 255.255.255.0 ip nat inside ! interface FastEthernet0/1 description Backup Interface ip address 10.24.24.5 255.255.255.252 duplex auto speed auto ! interface Serial0/2/0 bandwidth 1536 ip address 10.300.207.2 255.255.255.252 ip pim sparse-dense-mode ip nat outside service-policy output AutoQoS-Policy-Trust encapsulation ppp load-interval 30 auto qos voip trust ! ip local pool pptp 192.168.1.10 192.168.1.20 ip classless ip route 0.0.0.0 0.0.0.0 10.300.207.1 ip route 10.16.12.0 255.255.255.0 10.300.207.1 ip route ??.???.??.252 255.255.255.255 ??.??.??.?85 ! no ip http server ip http authentication local no ip http secure-server ip http timeout-policy idle 5 life 86400 requests 10000 ip pim bidir-enable ip pim autorp listener ip mroute 0.0.0.0 0.0.0.0 10.300.207.1 ip nat pool Voice 10.16.12.248 10.16.12.248 netmask 255.255.255.0 ip nat inside source list 50 pool Voice overload ip nat inside source list 1 interface Serial0/2/0overload ip tacacs source-interface FastEthernet0/0.2 ! access-list 1 permit 10.50.100.0 0.0.0.255 ! access-list 50 permit ip 10.150.44.0 0.0.0.255 10.2.4.0 0.0.0.255 snmp-server community Voice11 RW ! tacacs-server host ??.??.??.?58 tacacs-server host ??.??.??.?4 tacacs-server timeout 2 tacacs-server directed-request tacacs-server key 7 ????????????????? ! control-plane ! rmon event 33333 log trap AutoQoS description "AutoQoS SNMP traps for Voice Drops" owner AutoQoS rmon alarm 33333 cbQosCMDropBitRate.1060.1055 30 absolute rising-threshold 1 33333 falling-threshold 0 owner AutoQoS ! line con 0 exec-timeout 240 0 password 7 ?????????????????? login authentication conmethod line aux 0 password 7 ?????????????? line vty 0 4 password 7 ?????????????? login authentication vtymethod transport input ssh line vty 5 15 password 7 ???????????????? login authentication vtymethod transport input telnet ssh ! ntp clock-period 17178224 ntp server 216.239.35.0 end ... View more

Hello,   is the command 'show snmp stats oid' available on your 3750 ?   What SNMP version are you using ? Post the config of the switch... ... View more