IPSEC Pass through

This might have been asked previously, if so please point me to the right thread.

I am trying to make a VPN connection between two Cisco VPN Firewalls that are sitting in behind an Astaro and a ZyXEL that are connected via a site to site IPSec on the Astaro.

LAN 1: 192.168.31.0/24
Cisco 1 Internal: 192.168.31.1
Cisco 1 External: 192.168.21.1

ZyXEL Internal: 192.168.21.254
ZyXEL External: 88.x.x.x

Astaro External: 213.x.x.x
Astaro Internal: 192.168.10.13

Cisco 2 External: 192.168.10.41
Cisco 2 Internal: 192.168.0.1

LAN 2: 192.168.0.0/24

192.168.31.0/24 can connect to 192.168.10.0/24; but the VPN traffic from Cisco 1 isn't reaching Cisco 2. Obviously the traffic is being blocked at the Astaro but I can't find anything in logs to suggest where the problem might be. Any suggestions would be welcome.