If I ping from the spoke I see the packet's encap'd and encrypt'd. I'm seeing the packets decap'd and decrypt'd at the hub. But the encap counter at the hub is still 0. What I think this means is that the spoke is correctly sending packets, the hub is correctly receiving the packets, but the hub is not responding and sending back encapsulated packets.

What could be causing this?

This is usually due to a routing, NAT, or packet filtering issue.  You can always perform a packet capture on the hub host to validate that your test traffic is being received and replied to.  You can then configure an input ACL with logging on the hub router inside interface to confirm that the traffic in question is being received.  If it is, you will want to review the above three items for accuracy.  Feel free to post your config if you want me to review.

I feel like a giant idiot, but I found out what the problem was. I'm going to swallow my pride and just own up to it.

I have been configuring these two routers by consoling into them, and because of that I did not have anything plugged into the Ethernet inside interface. So the tunnel was built, but pings were failing. I plugged up a laptop to test it, and magically it worked. I suppose that either adding a loopback interface as an inside interface or just plugging a computer up to test would it would have solved this issue.

Well, lesson learned.

Robert

Thanks for posting back to the forum and indicating that you had solved the problem and what it was that solved the problem. It makes the forum more useful when people can read about an issue and can then read an explanation of what the problem was and what was done to solve the problem. In this case it may be especially helpful as it reminds us that sometimes the problem is as simple as an interface being down (because nothing was plugged into the interface).You may have swallowed a bit of pride but you have been helpful to the forum.

HTH

Rick

I have defintely done that before.  Trying to ping the SVI without a PC connected.  The easiest approach to testing as you said is to configure a pair of loopback interfaces and then source ping in order to confirm that the tunnel is working.