access-list inside_nat0_outbound extended permit ip 192.168.60.0 255.255.255.0 192.168.102.0 255.255.255.0

nat (inside) 0 access-list inside_nat0_outbound

access-list outside_cryptomap extended permit ip 192.168.60.0 255.255.255.0 192.168.102.0 255.255.255.0

crypto map outside_map0 3 match address outside_cryptomap

crypto map outside_map0 3 set pfs group2

crypto map outside_map0 3 set connection-type bi-directional

crypto map outside_map0 3 set peer X.X.X.X

crypto map outside_map0 3 set transform-set ESP-3DES-MD5

crypto map outside_map0 3 set security-association lifetime seconds 28800

crypto map outside_map0 3 set security-association lifetime kilobytes 4608000

crypto map outside_map0 3 set inheritance rule

crypto map outside_map0 3 set phase1-mode main

crypto map outside_map0 3 set reverse-route

tunnel-group X.X.X.X type ipsec-l2l

tunnel-group X.X.X.X general-attributes

no accounting-server-group

default-group-policy DfltGrpPolicy

tunnel-group X.X.X.X ipsec-attributes

pre-shared-key 1234

peer-id-validate req

no chain

no trust-point

isakmp keepalive threshold 10 retry 2

Another strange pointer is that when i do a ping from the firewall, sourcing it from the firewalls inside interface ip (192.168.60.1), the ping is successful and also when the guys from remote end ping that ip they get replies. Its only when we ping anything behind that interface tho in the same subnet. In the lan the dg points to the firewalls ip (192.168.60.1) so its nothing to do with routing.

Do you have nat-control enable?.

Regards,

Carlos Roque

yes nat-control is enabled.