Objectives
The simulator ticks each one as soon as the network meets it.
FWB was given the wrong key for FWA: its remote key must be IKE2KEY.
FWB’s crypto ACL no longer mirrors FWA’s: it must permit 192.168.2.0/24 to 192.168.1.0/24 (object LOCAL to object REMOTE).
FWA lost its NAT exemption, so PCA’s traffic is translated and misses the tunnel: put the rule back.
PCA reaches PCB through the tunnel.
Before you start
Fix one fault at a time and ping again. A missing NAT exemption gives no VPN reason at all: the packet simply goes to the internet, translated, and the provider has no route back. packet-tracer input inside icmp 192.168.1.10 8 0 192.168.2.10 on FWA shows the NAT step.
Concept
Site-to-site IPsec VPN
Two firewalls join their LANs across the internet. Interesting traffic, which the crypto ACL names, is encrypted and sent to the peer. First the firewalls agree in IKE phase 1 (a policy both have, and the same pre-shared key), then in phase 2 (a transform set or proposal both have, and crypto ACLs that mirror each other). NAT comes before encryption, so the VPN traffic needs a NAT exemption.
