CLI to show IPsec VPN Child SA Role (Initiator/Responder)

Hi ​@kalanfuga ,

Hope you are referring to this output : 
#dia vpn ike gateway list <phase1name>

SPOKE1 # dia vpn ike gateway list name SPOKE1_ILL

vd: root/0
name: SPOKE1_ILL
version: 2
interface: port2 4
addr: x.x.x.x:500 -> x.x.x.x:500
tun_id: x.x.x.x/::x.x.x.x
remote_location: 0.0.0.0
network-id: 1
transport: UDP
virtual-interface-addr: remote: 192.168.1.2
created: 8166s ago
peer-id: x.x.x.x
peer-id-auth: no
pending-queue: 0
PPK: no
IKE SA: created 1/1  established 1/1  time 9010/9010/9010 ms
IPsec SA: created 1/1  established 1/1  time 9010/9010/9010 ms

  id/spi: 0 4ac0c14e64dac43e/ed0277455dc86471
  direction: initiator   <----------------------------------------------------------------
  status: established 8166-8157s ago = 9010ms
  proposal: aes128-sha256
  child: no
  SK_ei: 0561c32152c56250-093504db5eac973d
  SK_er: eed35d7e1cf315a7-55242ca986fe1c03
  SK_ai: a135310e1b006eed-a220bd5af5ff3e32-490936f510b7974f-bec9d70d66bfca65
  SK_ar: f0d2a4a47c6dab63-b5545165511e49cd-a44cc0f1f8db927f-f35daa244ae3304d
  PPK: no
  message-id sent/recv: 2/0
  QKD: no
  PQC-KEM (IKE): no
  PQC-KEM (all IPsec): no
  lifetime/rekey: 86400/77942
  DPD sent/recv: 00000000/00000000
  peer-id: x.x.x.x

HUB# dia vpn ike gateway  list 

vd: root/0
name: ILL_TO_ILL_0
version: 2
interface: port2 4
addr: x.x.x.x:500 -> x.x.x.x:500
tun_id: 192.168.3.2/::10.0.0.3
remote_location: 0.0.0.0
network-id: 1
transport: UDP
created: 8259s ago
peer-id: x.x.x.x
peer-id-auth: no
pending-queue: 0
PPK: no
IKE SA: created 1/1  established 1/1  time 0/0/0 ms
IPsec SA: created 1/1  established 1/1  time 0/0/0 ms

  id/spi: 0 a6d9254dc57cb942/a712cbf169779da3
  direction: responder  <-------------------------------------------------------------------
  status: established 8259-8259s ago = 0ms
  proposal: aes128-sha256
  child: no
  SK_ei: 642480b66a2aafb0-0b0ba9376ba096a4
  SK_er: 94388a7b0f6662be-d5a40b3d87187df9
  SK_ai: d112ca7b1890cbf6-441e1d0e54cc984f-039b5bfe3cf5d2b4-b3d8916e1c600695
  SK_ar: b9ec9870c5de9da4-0918d7f46a608a29-9b3a29fac3761026-18b77ba71f17dd29
  PPK: no
  message-id sent/recv: 0/2
  QKD: no
  lifetime/rekey: 86400/77870
  DPD sent/recv: 00000000/00000000
  peer-id: x.x.x.x

If you have found a solution, please like and mark it as solved to make it easily accessible for everyone.

Thanks,
Mayur Padma

Hi ​@kalanfuga ,

There is couple of ways to identify whether the FortiGate is acting as initiator or responder.

K_7_7-2 (root) # diagnose vpn ike gateway list name VPN1_ISP1 | grep direction 
  direction: initiator

(replace the VPN1_ISP1 with your VPN phase1 name and grep direction will just show you the required output you are looking for)

Refer below document to get more information