Unable to sniff traffic from IPSEC VPN

Forum|Forum|6 years ago
June 1, 2020
1 reply
11583 views

I'm trying to troubleshoot a routing or policy issue and I'm trying to capture traffic to help me. Unfortunately, I can't seem to capture any traffic coming through my VPN.

I have a IPSEC VPN connected and passing traffic to the internal network.

My IP address while connected is 172.16.255.65.

When I run "diag sniffer packet Outside-PSD-10G 'src host 172.16.255.65' 4 10" I get nothing.

If I run the same query with the filter set to none, I get gobs of traffic.

If I change the interface to the VPN interface, it returns "That device is not up for RASVPNWIN".

Does anyone have any idea what I'm doing wrong?

Any insights are appreciated,

Thank you,

Bill

VPN

Best answer by Toshi_Esumi

I don't know what model of FGT you're tunning, but you have to disable ASIC off-loading at the policies handling the traffic. Sniffer works at CPU only. The command is

set auto-asic-offload disable

Toshi_EsumiAnswer

SuperUser

I don't know what model of FGT you're tunning, but you have to disable ASIC off-loading at the policies handling the traffic. Sniffer works at CPU only. The command is

set auto-asic-offload disable

bsongstadAuthor

New Member

Thanks Toshi. This is a pair of clustered 800Cs. Unfortunately I'm still not having any luck. I ran 'set auto-asic-offload disable' on every policy that could possibly handle traffic from the VPN subnet and still nothing shows up in the sniffer. I have tried every interface and still no traffic from the VPN users shows up. Any idea what else I could be doing wrong?

Thanks,

Bill

Toshi_Esumi

SuperUser

Is your tunnel interface mode IPSec? Or policy based IPsec?

Sign up

Login with SSO

Login to the community

Login with SSO