Strongswan issue with source IP

I have established a VPN connection between a region in AWS and a datacenter implemented with OpenStack:

|---AWS------------------|        |-----OpenStack----------|
Private IP      EIP               Float. IP     Private IP
10.2.10.250 <-> 35.x.255.x TUNNEL 75.x.65.x <-> 172.16.0.156

If I try to ping from a host in OpenStack to another host in AWS, I get no reply. This is a line from tcpdump running in 10.2.10.250 VPN server:

3:04:01.523351 IP 172.16.0.156 > 10.2.10.27: ICMP echo request, id 9407, seq 8, length 64

The problem is that the server I am pinging from is not 172.16.0.156 but it is something like 172.16.0.125. So I think that in OpenStack networking something is forcing SNAT. I have flushed all iptables on both hosts. I reproduced the environment in two AWS regions and the ping works, the source IP is correct.

This is the /etc/ipsec.conf file:

config setup
        charondebug="all"
        uniqueids=yes
        strictcrlpolicy=no

conn %default
        ike=aes256-sha2_256-modp1024!
        esp=aes256-sha2_256!
        keyingtries=0
        ikelifetime=1h
        lifetime=8h
        dpddelay=30
        dpdtimeout=120
        dpdaction=restart
        auto=start
        keyexchange=ikev2
        type=tunnel

conn uswest2-x-to-x-x
    leftfirewall=yes
        leftcert=device-x-x_cert.pem
        leftid="C=CH, O=strongSwan, CN=device-x-x"
        rightid="C=CH, O=strongSwan, CN=device-uswest2-x-a"
        left=172.16.0.156
        leftsubnet=172.16.0.0/24
        right=35.x.255.x
        rightsubnet=10.2.0.0/16

And iptables:

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain DOCKER (0 references)
target     prot opt source               destination

Chain DOCKER-ISOLATION (0 references)
target     prot opt source               destination