After extensive tracing of the traffic, what happens is that XG receives the packet, but it does not encapsulate it to send over the xfrm interface.
this is from the server side:
this is from the client side:
where you can see that IP packet 1288 never reaches the client.
this is a capture on the XG by doing tcpdump -nei any 'port 4899'
it shows each packet twice, captured from the LAN and VPN interface.
you can see IP Packet 1288 being sent out over the WAN / xfrm interface
but capturing ESP traffic from the server side XG and decrypting it (tcpdump -ne proto 50), it shows that the IP packet was never encapsulated to be sent over the xfrm tunnel
you can see IP packet 2356 sent out, but IP packet 1288 never makes it to the ESP
This thread was automatically locked due to age.
