IPsec tunnel up but traffic cannot reachable

Topo: PC1(1.1)-------USG6370(2.1)------internet-----(3.1)USG6370-------PC2(4.1) Issue:between two USG, we can see the tunnel is up ,but PC cannot ping each other. Handling process 1、check the security policy , the policy has already permit PC1 to PC2 ; 2、check the IPsec SA and IKE SA , find all SA is up ; 3、check firewall session of destination port is 4500 , find the session is abnormal ,the two firewall public IPs are been NAT , and it will make IPsec tunnel up ,but cannot forword traffic. Solution： Local to untrust cannot NAT , should configure No-nat policy on it . This post was last edited by Finn92 at 2018-08-03 03:30.