anchor.diff:  
   To figure out if you are affected by the same issue, run the following commands on each end of your IPSEC tunnel.
   
  -[source]
  -----
  +[source,numbered]
   >diag sys session filter dst <your phone or switch IP>
   >diag sys session list
  -
   session info: proto=17 proto_state=00 duration=59663 expire=109 timeout=0 flags=00000000 sockflag=00000000 sockport=0 av_idx=0 use=4
   origin-shaper=
   reply-shaper=
  
positive.code: set logtraffic all
  next
  end
  ----
  
  ##### The Root of the Issue
  
  
negative.code: serial=06476ede tos=ff/ff app_list=2004 app=16670 url_cat=0
  dd_type=0 dd_mode=0
  total session 1
  
  
  By looking at the the above at **(1)** and **(2)**, you can see that traffic from 192.168.0.4 -> 192.168.1.100 is trying to be routed over the WAN link. This is no good.
  
  