We have three different geo sites (SITE1, SITE2 and SITE3) and each site has PFSense firewall installed. Sites have been connected together with IPSec tunnels. Also Site2 is connected to customer network with IPSec tunnel. Customer does have Cisco ASA, and it doesn't support in this case VTI. We can access customer networks from SITE2, but we can not access those networks form SITE1 or SITE2. When sending packet to Customer network from SITE1 we can see packet coming to SITE2 but the packet is not continuing to Customer network. Should the packet be automatically routed to ipsec tunnel by PFSense, or would there be some trick we could static route those packages to customer network when we do not have VTI available at the Customer router?
SITE1 <- ipsec -> SITE2 <- ipsec> SITE3 | ipsec (BINAT/NAT) | Customer