L2L IKEV2 IPSEC TUNNEL - ESTABLISHED SAs -

[Prime56]

Hi all,

I have a SA established and am trying to ping the remote tunnel interface. I have my site set to 172.16.118.1 and the remote side set to 118.2.

After attempting to ping, I issue show crypto ipsec sa and I see this:

#pkts encaps: 5, #pkts encrypt: 5, #pkts digest: 5
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0

What would be causing this? I've enabled NAT traversal, management-access inside, any other suggestions?

I'll be happy to provide any output needed.

[Prime56]

Can we dial it back? My issue isn't sending the traffic over the VPN, its pinging the directly connected VTI interface. I would like that to be successful before adding routes to route the traffic.

[MHM Cisco World]

simply tunnel shutdown and do ping again, do you see same encrypt hit and decrypt miss ?