Unfortunately, I did not save any packet captures, so I only saw that it was on the IPsec port.