Select ALL useful checks when an Internet Protocol Security (IPsec) tunnel is up but application traffic does not pass.

### Why this is right\n- **Routes to the remote networks** determine whether packets use the tunnel and whether return traffic has a path.\n- **Security policy and Network Address Translation (NAT) rules** can permit, deny, or change traffic addressing.\n- **Host addressing and host firewall settings** affect whether endpoints send and accept the test traffic.\n\n### The concept\nA tunnel being up shows that negotiation succeeded, but end-to-end traffic requires forwarding and permission at both sites. Check traffic logs and tunnel counters for evidence. Also verify the return path, since one-way success often points to asymmetrical routing or policy.\n\n### The other options\n- **Whether the IKE peer name uses the same spelling style**: peer identity matters during negotiation, but arbitrary spelling style is not the indicated first check after the IPsec tunnel is already up.\n\n### Terms\n- **NAT**: Network Address Translation, changing packet addresses.\n\n### Remember\nWhen IPsec is up but traffic fails, investigate the data path and policy.