Refer to the exhibit. A Cisco ASA is configured as a client to a router running as a FlexVPN server. The router is configured with a virtual template to terminate FlexVPN clients. Traffic between netw

Permitting 192.168.0.0/24 as the source to 172.16.20.0/24 as the destination reverses the selector direction relative to what the show output indicates the router has negotiated, so the mismatch would persist.

In an IKEv2/FlexVPN environment, the crypto ACL on the ASA client specifies the traffic selectors (proxy IDs) that are proposed to the FlexVPN server during negotiation. The show crypto ikev2 sa output reveals that the selectors the ASA is advertising do not match what the router expects; correcting the ACL to permit 172.16.20.0/24 (remote network) to 192.16.0.0/24 (local network as seen in the SA output) aligns the proposed selectors with the router's configuration and allows interesting traffic to be matched and encrypted.

Permitting 172.16.20.0/24 to 192.16.20.0/24 uses the same remote subnet on both sides of the ACL entry, which does not represent valid distinct source and destination networks.

The mismatch originates from the ASA client's crypto ACL, not from the FlexVPN server; changing the router's ACL would not correct the incorrect selectors being proposed by the ASA.