Check If Traffic Is Sent Into IPsec Tunnel

Forum|Forum|5 years ago
October 6, 2020
9 replies
23308 views

Hi guys,

I would be interested in what is the best/most reliable way to ensure that traffic is sent into an IPsec tunnel.

I.e. if I can see outgoing Traffic within the IPsec Monitor and I also see packets when starting a packet caputre on the VPN tunnel - does that confirm that the traffic is sent trough the tunnel?

Is there any (better) option to confirm this?

Best regards

cust0m

6.0

Best answer by emnoc

You can also diag sniffer packet <phase1 tunnel name> and see traffic in the tunnel also. Might be easier in some case than debug flow

Ken Felix

sw2090

SuperUser

do a flow debug to monitor traffic on the FGT:

diag debug ena

diag debug flow filter clear

diag debug flow filter dst <destination ip>

diag debug flow filter src <source ip>

diag debug flow trace start <numberofpackets>

then create some traffic that should flow from <source ip> to <destination ip> over the vpn to see what happens to your packets.

cust0mAuthor

New Member

Hi, thanks for the suggestion!

For version 6.0.8, I had to change "dst" to "daddr" and "src" to "saddr" in order to not get a syntax error. The other commands worked. Within the log output, I could see the message "enter IPsec interface-<name>". So from my point of view that confirms that the traffic is sent trough the tunnel!?

Best Regards cust0m

sw2090

SuperUser

yes its daddr and saddr of course. Sorry for that one ;>

yes if you see "enter IPsec interface-..." in the output of flow debug that means the traffic has entered the tunnel and you would have to look at the opposite end of the tunnel where it goes to when it leaves the tunnel again if needed :)

Sign up

Login with SSO

Login to the community

Login with SSO