If I monitor the complete traffic of a Cisco ASA Firewall outside Interface, I get traffic volumes for my servers inside IPs and also for the esp traffic between the outside tunnel interfaces between sites. The esp traffic volume is similar to the inside traffic pakets.

So,... is the esp traffic the hole traffic including the encapsulated inside IP pakets or is it only the addional encryption overhead?

Thx for your help!

UH