V5R1 to V5R2 VPN

All,
 
I am trying to setup a VPN between two iSeries machines over the
internet.  I have successfully setup a test VPN between two of our
iSeries (both on V5R2) in the same network, but I need to expand that
concept.
 
Here is what I am trying to accomplish.  I have an iSeries (lets call it
AS1) with an internal IP address of 10.1.1.2.  The external access is
through a router, but we have no control over the router.  I am able to
access the internet using AS1.  This will be the iSeries that will
initiate the VPN by using FTP.
 
I have another iSeries (lets call this one AS2) with an internal IP
address of 10.100.4.22.  I have access and full control over the
firewall.  I have a static external IP address assigned to the internal
interface.  Put another way, AS2 has an external IP address assigned
with all traffic (and all protocols) forwarded to the internal address
on AS2 (10.100.4.22).  I setup AS2 to receive the VPN connection.
 
I first setup AS2 as the receiver.  After setting up AS2, and starting
the *VPN TCP server, the VPN connection went into the status
"On-Demand".  According to the documentation, this appears to be the
correct state to wait for VPN connections.  When I setup this
connection, I used the external address for AS1 (derived from a
different process to determine the ip address seen by the external
world).
 
I then setup AS1 to initiate the connection.  For the remote VPN server
address, I used the external address for AS2.  For the local server
address, I used the internal ip address if AS1.  The connection does not
go into the "On-Demand" status.  It stays in the "Idle" status.  I
tested an FTP connection -- the VPN stayed in the "Idle" status (even
after starting the *VPN TCP server).  I followed the directions
step-by-step from when I setup a successful temporary internal VPN --
from a V5R2 machine to AS2.
 
Any ideas or suggestions?
 
Thanks
 
Mike
 

=======================================
Mike Silvers
Senior Programmer/Analyst
iSeries Websphere Certified
Hainey Business Systems
Main Office:  (717) 718-9601 ext 237
Branch Office:  (410) 219-2695
Fax: (877) 804-9589
http://www.hbs-inc.com <http://www.hbs-inc.com/> 
AIM:  IBMJavaMan
=======================================