When packets from 20 to 120 are entering enc0 device the Firewall is good. If 120 can reach 20, everything good. But when 20 can't access 120 and packets going to enc0, you'll see something in ipsec log or dropped packets.