Cannot see incoming ESP packets with a packet capture.
Hi, I am not able to see any incoming ESP packet when running a packet capture in FortiGate. The tunnel is UP and running, everything is working find, but if I check the traffic, I just can see outgoing ESP packets but not incoming ones. I have a lot of FortiGates devices and same happens in all of them. Am I missing something? Thanks?
The thing is that I wanted to check the traffic between my FortiGate and AWS gateway, because the BGP session was not comming up. The traffic was between the FortiGate iself, and AWS remote Gateway, so the traffic was not maching any rule as far I know.
We have an IPsec between FGT and AWS for a customer, and running BGP over it. I can sniff BGP (TCP 179) exchanges with offloading enabled. I think it's because it's destined to FGT itself so it has to come out of NPU unlike passing-through traffic, which gets out of the egress interface only through NPU.
Yes, after some time I did realize that the tunnel was working fine (it was a BGP configuration issue) and I was able to sniffer the traffic going through the tunnel. I was just shocked after seeing that everything was working fine when fixed the BGP issue, but I was still unable to see ESP packets coming from the AWS public IP. Somehow the FortiGate just shows the outgoing ESP packets but not the incoming ESP packets when offloading is enabled.
Anyway, thank you very much for answers and information :)
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.