IPSec Virtual Tunnel Interface Behind NAT

[sahmadhashmi]

Topology

Problem Description

I have a topology on eve-ng in which I have 3 CSRv and 1 ISRv routers, In that topology I created a IPSEC tunnel over VTI. The problem I'm facing is that the tunnel interface on the router which is on side 1 is down (Protocol is down but status is UP) however the tunnel interface on the router which is on side 2 is UP (Line Protocol is UP) Also, I'm doing NAT on the Edge_R1 router on side1

Please help me to understand why the IPsec is not coming UP and the tunnel interface on side 1.

I'm attaching the configuration script of the routers.

[MHM Cisco World]

What IKE v1 you use ?

Share config if you can both vti side 

MHM

[balaji.bandi]

Pos the configuration and make sure your NAT working for requirement.

For IPSEC, you need to open / forward / PAT the following:

• UDP 500
• UDP 4500
• ESP

enable debug and check 

I'm attaching the configuration script of the routers.

attach the configuration of all devices.

[ccieexpert]

run the debugs as listed in this link:

https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec-debug-00.html

that should give you an idea.. or attach the config.

[sahmadhashmi]

Thanks all for your response.
So I'm using IKEV2 and I have checked the nat translations, it working as expected.

Also, I have attached the configuration of the routers.

[MHM Cisco World · Accepted solution]

first fast review 
the tunnel in ISR use tunnel source IP that is not direct connect to router ?
it must use g1 
change it and check 

MHM

[sahmadhashmi]

Thanks MHM, Yes after changing the source as Gig1, Tunnel comes UP and started to work.

Thanks for your help! Appreciated  

[sahmadhashmi]

Thanks Everyone for your help

[juliawhites87]

It sounds like your issue might be related to NAT interfering with the IPsec tunnel establishment. Ensure that NAT traversal (NAT-T) is enabled on both sides of the tunnel. Also, check if your ACLs are correctly configured to allow IPsec traffic through the NAT device.