show vpn flow tunnel-id 2 #shows tun monitor

ipsec sdwan t1 ping failure ss:

full topology

pa1 rt

pa1 tunnels

pa1 log showing the ping to pa2 t1

and this is pa2 receiving the ping but response - ping profiles are allowed yes!