That's due to a CG-NAT issue which breaks client-server communication. There is a possible workaround to punch VPN tunnels from a "spoke" site behind Cellular to a "Hub" site sitting on a fixed internet connection. Follow these steps: 1-Make sure the cellular site is a spoke 2-Make sure the hub is a fixed site (NOT cellular) 3-For the hub site, configure Manual NAT traversal by choosing a UDP port of choice (e.g. UDP 1234) 4-For the hub site, in case of ANY firewalls upstream your MX facing the internet (e.g. Internet -> Firewall -> MX) please add a port forwarding rule on the firewall (NOT the MX) to allow ANY traffic towards the MX on the UDP port configured in step 3 (For example: Port forwarding source-ip-any source-port-any MX-WAN-ip UDP-1234) That should fix the tunnel issue and you will have bi-directional traffic between spoke and hub. You might still have NAT Unfriendly on the VPN status page, but indeed you can do site to site ping and tunnels will be stable.
... View more