IPSec Virtual Tunnel Interface Behind NAT

[sahmadhashmi]

Topology

Problem Description

I have a topology on eve-ng in which I have 3 CSRv and 1 ISRv routers, In that topology I created a IPSEC tunnel over VTI. The problem I'm facing is that the tunnel interface on the router which is on side 1 is down (Protocol is down but status is UP) however the tunnel interface on the router which is on side 2 is UP (Line Protocol is UP) Also, I'm doing NAT on the Edge_R1 router on side1

Please help me to understand why the IPsec is not coming UP and the tunnel interface on side 1.

I'm attaching the configuration script of the routers.

[MHM Cisco World]

What IKE v1 you use ?

Share config if you can both vti side 

MHM

[balaji.bandi]

Pos the configuration and make sure your NAT working for requirement.

For IPSEC, you need to open / forward / PAT the following:

• UDP 500
• UDP 4500
• ESP

enable debug and check 

I'm attaching the configuration script of the routers.

attach the configuration of all devices.

[ccieexpert]

run the debugs as listed in this link:

https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec-debug-00.html

that should give you an idea.. or attach the config.