NAT exemption is required because the packet capture proves that the protected private traffic is being translated before IPsec processing. That changes the source address so the packet no longer matches the configured interesting-traffic selectors, preventing it from entering the intended security association. Cisco’s Secure Firewall NAT guidance states that traffic crossing a site-to-site VPN must be exempted from interface NAT rules; otherwise, it can be dropped or routed outside the tunnel. An identity NAT/NAT-exemption rule matching the local and remote subnet pair preserves the original addresses. The IKEv2 proposal, preshared key, transform set, access policy, and crypto-map placement are already validated. Fragmentation does not correct address translation, and neither a new tunnel group nor a prefilter attachment resolves the selector mismatch shown in the capture.

================