Checking of historical tunnel logs

Question

Hi everyone!

I am currently doing a clean-up on our FG501-E.

Part of cleanup is to check whether the tunnels are still passing traffic.

Where could I efficiently check this type of log?

I did the 3 and no results came back

1. diag vpn ike gateway list

2. Went to the GUI > Dashboard > Network > IPSEC

3. Went to FortiAnalyzer > Events > VPN

It feels like I am doing wrong on checking. Could you kindly suggest other ways to check this?

Regards!

akileshc · Answer

Hello renzanjopcaparas,

To efficiently check whether IPsec tunnels on your FortiGate 501E are passing traffic, you can use the following methods:

### 1. Check IPsec Tunnel Status via CLI

* List all tunnels:

diagnose vpn tunnel list

This shows detailed information about each tunnel, including whether it is up and passing traffic.

* Check a specific tunnel:

diagnose vpn tunnel list name <tunnel_name>

Replace `<tunnel_name>` with the actual tunnel name to filter the output.

### 2. Monitor Traffic on Tunnels

* Traffic statistics:
In the output of `diagnose vpn tunnel list`, check the `rxp`, `txp`, `rxb`, and `txb` values, which show received/transmitted packets and bytes.

### 3. Use the FortiGate GUI

* IPsec Monitor:
Navigate to VPN > Monitor > IPsec Monitor. This provides a visual view of tunnel status and traffic flow.

### 4. Check FortiAnalyzer Logs

* Ensure FortiAnalyzer is receiving logs from the FortiGate. Look for VPN Event Logs related to the tunnels. If no logs appear, verify that logging is properly configured on the FortiGate.

### 5. Debugging Tools

* Debug Flow:
If you suspect traffic issues, capture and analyze flows using:

diagnose debug flow filter addr <ip_address>
diagnose debug flow show console enable
diagnose debug flow trace start 100
diagnose debug enable

# Replace `<ip_address>` with the relevant address to filter traffic

These steps should help you verify tunnel status and troubleshoot traffic issues effectively.

Regards,