Funny - just tried again, as far as I can tell the same setup I had before, now the router used the Loopback-address for the outgoing ISAKMP session ... Only question that's left is - why doesn't this work for the Gi0/0 interface? :( Tnx anyway, -garry