Routes and firewall policies needed for tunnel traffic

A common surprise with route-based IPsec is that the tunnel can show up while no traffic passes between the sites. That is because bringing the tunnel up is only half the job: you must also tell the FortiGate to route the remote subnets into the tunnel and to permit that traffic with firewall policies. This is heavily tested because it separates people who clicked through a wizard from people who understand the data path.