NAT-Reflection on IPSec endpoint

[trendchiller]

Hi !

We have a remote subnet that is connected via IPSec to our mail subnet.
On the remote side all traffic is routed over our main subnet and it's gateway by using IPSec phase2 with remote / local subnet 0.0.0.0/0.
On our main gateway we set up outbound NAT for the remote subnet.
So far it works without problems…

On out main gateway we use WAN-CARP for redundancy.
On the WAN-CARP we use inbound NAT for a HTTPS server in our LAN.
From out main subnet this HTTPS server is reachable via it's original IP or with the external WAN-CARP (thanks to NAT-Reflection)

From the remote subnet this HTTPS server is NOT reachable with the external WAN-CARP (but with it's original IP in the main subnet)
So the question is why NAT-Reflection does not work in this case.

When someone from the remote location tries to reach the remote server over it’s external WAN-CARP IP
all my packet captures show packets from the remote subnet to our external WAN-CARP but no response back.

Does anyone have a thought / idea ?

regards,
martin