Connected keys with a missing protected subnet

Two sites establish a VPN and show a connected tunnel indicator. Existing application traffic between their original subnets works, but a new server network cannot be reached. The local definition includes the new range while the remote accepted selector remains limited to the original subnet. An external capture filtered only for the private server address is empty, and the path uses NAT traversal. Outbound counters for unrelated existing traffic continue increasing. A larger file transfer on an old subnet also stalls, although small requests pass. The team has not correlated the precise failing tuples with both peers’ selector and packet evidence. No universal encapsulation overhead or timeout value is supplied.