Got SSL working between the 2925 and 2860

mbames wrote: Got SSL working between the 2925 and 2860

Other than changing 'type' of VPN, I take it no other configuration changes were necessary?

Assuming the 2925 used to have separate site-to-site links to the 2860 and 2820, maybe you can reorganise things to get connectivity back... you could establish a link from the 2860<-->2820 (which I'm assuming are unaffected by the VF nonsense). There would have to be a route definition (probably using "More" options or Route Policy entry) on the 2925, to reflect that 192.168.102.x is now accessed via 192.168.123.n.

Performance would be hit, but it might get everything connected again.

(PS - I've never tried a config. like that, but it ought to work )