Site-to-site VPN
Start with the inner packet. Which source subnet and destination subnet should be protected? In a domain-based VPN, each peer needs a consistent view of the protected networks. A successful negotiation for one subnet pair does not establish that another pair belongs to the VPN.
Next follow the outer connection. Check the public address chosen for the peer, the authentication method and the negotiated settings. Once a tunnel exists, inspect the access decision, translations and return route for the inner packet. Test from actual protected hosts. A ping between gateway public interfaces exercises a different path.