A host at Site A can ping a host at Site B, but the reverse test fails. Give a systematic set of checks grounded in the VPN course material.

### Why this is right\nOne-way reachability often means the reverse path, policy, or session initiation behavior differs from the working direction. Both sites need appropriate routes and rules, and logs can show where traffic is allowed or denied.\n\n### The concept\nA VPN tunnel protects traffic, but the firewall still routes and filters it. A successful ping in one direction does not prove that the destination site can return the packet. Traffic logs provide evidence such as source and destination addresses, application, action, and matching rule. Tunnel status and counters help distinguish negotiation failure from forwarding failure.\n\n### What a good answer covers\n- Check routes and gateways in both directions.\n- Verify security policies for the needed traffic.\n- Check logs and tunnel counters for evidence.\n- Check addressing, host firewalls, and NAT.\n- Distinguish tunnel status from application connectivity.\n\n### Remember\nOne-way success makes the return path and reverse policy prime checks.