We have the tunnel established, but traffic doesn't appear to be hitting the tunnel only when leaving my side. I see no packet encaps, but do get decaps. I've went over and over the config and I'm not seeing anything that stands out. The remote side is a Cisco ASR1002-X.
I was thinking it may either be route or security profile related, but I have the route setup to use the tunnel.10 interface for this specific VPN in the virtual router. The odd thing on the security policy is I have added one for this traffic at the top of my list basically, but when I view the logs when sending test traffic the traffic is hitting our catch all at the bottom of the list.
Why would it not be hitting my rule toward the top? Any help is greatly appreciated!
Awesome!
1. Correct 2. Not necessarily, I've seen it "magically" establish but then fail on the actual communication, especially if there's more than 1 pair, or supernets 3. Zones would be internal interface to tunnel interface zone (i.e. trust to vpn and reverse), ones are determined after a route lookup (so if the route points outward, the destination zone would become untrust) 4. That's good! Any requirement for NAT?
A few things could cause this - no route into the tunnel - mismatched proxyID on the tunnel - mismatched zone names (see routing table) - local routing overlap (conflicting local subnet)