firewall a

object-group network DM_INLINE_NETWORK_1
network-object yyy.xx.7.0 255.255.255.0
network-object yyy.xx.8.0 255.255.255.0
network-object yyy.xx.9.0 255.255.255.0

access-list 110 extended permit ip object-group DM_INLINE_NETWORK_1 host 192.zzz.x.10

crypto ipsec transform-set pippo esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000

crypto map galileo 10 match address 110
crypto map galileo 10 set peer ss.zz.yy.xx
crypto map galileo 10 set transform-set pippo
crypto map galileo interface OUTSIDE
crypto isakmp enable OUTSIDE
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400

tunnel-group ss.zz.yy.xx type ipsec-l2l
tunnel-group ss.zz.yy.xx ipsec-attributes
pre-shared-key pippo

Firewall b

object network ff

host 192.zzz.x.10

object-group network DM_INLINE_NETWORK_2

network-object yyy.xx.7.0 255.255.255.0
  network-object yyy.xx.8.0 255.255.255.0
  network-object yyy.xx.9.0 255.255.255.0

access-list outside_1_cryptomap extended permit ip object ff object-group DM_INLINE_NETWORK_2

nat (INSIDE,any) source static obj-192.zzz.x.0 obj-192.zzzz.x.0 destination static obj-yyy.xx.9.0 obj-yyy.xx.9.0 unidirectional

nat (INSIDE,any) source static obj-yyy.xx.9.0 obj-yyy.xx.9.0 destination static obj-192.zzz.x.0 obj-192.zzz.x.0 unidirectional

crypto ipsec transform-set pippo esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000

crypto map galileo 10 match address 110
crypto map galileo 10 set peer yy.zz.ss.xx
crypto map galileo 10 set transform-set pippo
crypto map galileo interface OUTSIDE
crypto isakmp enable OUTSIDE
crypto isakmp policy 10
  authentication pre-share
  encryption 3des
  hash sha
  group 2
  lifetime 86400

tunnel-group yy.zz.ss.xx type ipsec-l2l
tunnel-group yy.zz.ss.xx ipsec-attributes
  pre-shared-key pippo

The outside interface on the firewall b has private address and then this private address have to be nat with ip pubblic address.

Best regards

Carmine

The outside address of firewall B which you said is being Natted , is the NAT happening on another device between the two firewalls ?

Manish

the recommended configuration of an IPsec endpoint behind a nat (static one-to-one nat) is to use isakmp identity hostname

so that the isakmp identity can match the information of the layer 3

funny it worked in the first place...

on b (which is translated) i would configure:

isakmp identity hostname

on a i would:

change the tunnel-group to the hostname (instead of ip address)

add a name which resolves hostname to the public (translated) ip of b

then i would run deb crypto isakmp on a and initiate a tunnel-negotiation from b

and vice-verse a deb cry isak on b and initiate from a

watch carefuly, the debug output differs on 8.2 and 8.3

look for something like "landing on group" or "matching tunnel group"

PS your config, it says on b:

crypto map galileo 10 match address 110

but:

access-list outside_1_cryptomap extended permit ip object ff object-group DM_INLINE_NETWORK_2