Strange issue with IPSEC

Hello all ,

Im breaking my head for about 2-3 hours troubleshooting connectivity issues between a checkpoint virtual firewall and mikrotik chr. I have create an ipsec tunnel between them. Topology is very simple . A virtual machine on the lan network behind checkpoint and the same on mikrotik side. No traffic is passing .

So tunnel is up , i can see the active peer is online and also the install SAs from all the source and destinations . Im running ping to both sides but nothing is passing. Firewall to the servers behind the routers is offline . I can see traffic passing through the counters of the SAs and also in the active peer.

Running wireshark in the server behind mikrotik i can see icmp coming from the remote site .
Running wireshark in the checkpoint site no traffic comming from mikrotik , nothing at all .

Any ideas maybe ?

Maybe you have an incorrect NAT setup in your MikroTik?

Might be useful:
http://forum.mikrotik.com/t/i-can-t-see-the-network-in-google-cloud-platform/137365/1