IPSec site-to-site tunnel not allowing all traffic both ways

[Jordan.Dick]

I followed the guides to set up an IPSec site to site VPN tunnel between our main office and satellite office using static routing, but I can't access our servers through the tunnel. From the main office, I can access everything on the satellite office's subnet, but from the satellite office, the only thing I'm able to access through the tunnel is the management interface of the firewall itself.

Both offices have GlobalProtect gateways set up so I can log in and access everything that way, but not through the IPSec tunnel.

The firewalls are set up as close to identical as possible. Every relevant config setting I could find is the same. They're on distinct subnets, all the checks on the tunnel show that the connection is working, the security policies are is set to allow all traffic through the tunnel in both directions, and I added a route on each firewall's virtual router to direct traffic bound for the other subnet to the tunnel interface. On both firewalls, the management interface is at a static address on the subnet.

Can anyone shed some light on what might be happening?

[BPry]

@Jordan.Dick,

When you connect to the satellite office gateway, are you seeing associated traffic logs on the satellite firewall? I'd double check the traffic logs on the satellite and see if it's getting the traffic and properly forwarding the traffic through the tunnel to your main office. Then do the same on the main office; are you actually seeing the traffic coming through from the satellite office? 

[Jordan.Dick]

Looking at the traffic logs, the traffic is passing through in both directions.

I spent some time on the phone with the support team and discovered the source of the problem.

The tunnel was working correctly the whole time, but the devices I was trying to connect to are all connected to two separate networks at the main office, and their default gateways are all pointing at the router on the other subnet, so whenever I tried to open a session with any of them, their reply packets would all be sent out to the other router instead of back through the tunnel.

To get around this, I set up a NAT for all traffic coming through the tunnel, so the devices' reply packets are directed to the Palo Alto firewall on the subnet they have routing table entries for.