It turns out that setting the remote subnet to a single host doesn't
seem to work.  So:

This works:
sainfo address 10.31.50.0/24 any address 198.162.241.0/24 any {
	encryption_algorithm 3des;
	authentication_algorithm hmac_md5;
	compression_algorithm deflate;
	pfs_group 2;
	lifetime time 86400 secs;
}

This doesn't:
sainfo address 10.31.50.0/24 any address 198.162.241.51/32 any {
	encryption_algorithm 3des;
	authentication_algorithm hmac_md5;
	compression_algorithm deflate;
	pfs_group 2;
	lifetime time 86400 secs;
}

This passes phase 1 but fails phase 2:
sainfo address 10.31.50.0/24 any address 198.162.241.51/24 any {
	encryption_algorithm 3des;
	authentication_algorithm hmac_md5;
	compression_algorithm deflate;
	pfs_group 2;
	lifetime time 86400 secs;
}

-- 
George Farris   farrisg at mala dot bc dot ca
Malaspina University-College