I have one site Ubuntu and the other site VyOS(behind the NAT). Normal IPsec tunnel is getting established and traffic is also flowing but when I try the same thing with VTI, packets are not getting decrypted at VyOS site. I can see the packets are coming on the IPsec interface(ESP packets) VyOS. I can see the bytes_o is getting incremented but bytes_i count is remain 0. I searched here and there on the internet but not getting any suitable information. Can any one shower light on this. thanks.