Site 2 Site VPN

[RC-BHF]

I have an issue where we have ike traffic comeing from the end point which is being allowed but the ipsec-esp is being caught by the deny all rule. The strange thing is that the the rule to allow ike and ipsec-esp is on the same rule.

We do carry out NAT on the public IP for some ports , is this this the issues

Can any one please point me in the right direction

[_slv_]

Please show us that rule. What about port/services - are You using defualt one?

Regards

Slawek

[TranceforLife]

Based on the external source IP (your remote office) temporary allow all traffic (any) and observe the behaviour. ESP has no port number so no it is not a NAT issue. 

[BPry · Accepted solution]

As @_slv_ already pointed out your rule is likely malformed so the traffic isn't getting caught. A picture of the rule would do wonders here over the logs. 

[OtakarKlier]

Hello,

On my tunnels I have the following applications allowed so they are not blocked. I also whitelist the source/destination IP's for my site to site vpns for added protection:

Hope that helps.