Unable to sniff traffic from IPSEC VPN

[bsongstad]

I'm trying to troubleshoot a routing or policy issue and I'm trying to capture traffic to help me.  Unfortunately, I can't seem to capture any traffic coming through my VPN.

I have a IPSEC VPN connected and passing traffic to the internal network. 

My IP address while connected is 172.16.255.65.

When I run "diag sniffer packet Outside-PSD-10G 'src host 172.16.255.65' 4 10" I get nothing.

If I run the same query with the filter set to none, I get gobs of traffic.  

If I change the interface to the VPN interface, it returns "That device is not up for RASVPNWIN".

Does anyone have any idea what I'm doing wrong?

Any insights are appreciated,

Thank you,

Bill

[Toshi_Esumi · Accepted solution]

I don't know what model of FGT you're tunning, but you have to disable ASIC off-loading at the policies handling the traffic. Sniffer works at CPU only. The command is

  set auto-asic-offload disable 

[bsongstad]

Thanks Toshi.  This is a pair of clustered 800Cs.  Unfortunately I'm still not having any luck.  I ran 'set auto-asic-offload disable' on every policy that could possibly handle traffic from the VPN subnet and still nothing shows up in the sniffer.  I have tried every interface and still no traffic from the VPN users shows up.  Any idea what else I could be doing wrong?

Thanks,

Bill

[Toshi_Esumi]

Is your tunnel interface mode IPSec? Or policy based IPsec?

[bsongstad]

So I found my answer while poking around in the routing monitor.  The interface I needed to sniff was ppp1.  That is not listed amongst the network interfaces.  Each dial-up connection creates a new ppp#  You can also use the entry from the Name Column in the IPsec Monitor which uses the format VPNInterfaceName_# starting with _0.  (just use the entry in the Name column).

-Bill

[bsongstad]

Actually, to clarify to anyone reading this later, the PPP1 interface shows the traffic through the tunnel, the VPNInterfaceName_0 actually shows the tunnel endpoints and not the traffic through the tunnel.

-Bill

[emnoc]

Sorry but this does not even sound like IPSEC tunnel. I've never seen a PPP interface for ipsec at least on the fortigate side.  Hint if you are doing ipsec and need to know the interface name do a "diag vpn ike gateway | grep -i name:"   that interface name that you see in that output is what you need to use in your diag command

Ken Felix

[bsongstad]

Thanks for the command Ken.  It shows the interfaces listed in the IPsec Monitor of the GUI. 

The VPN was made using the VPN wizard for Windows L2TP with IPSEC. 

The only way I've been able to see the traffic coming into and out of the tunnel is to use the interface ppp# from the routing monitor.  I have some more poking around to do for my other VPNs but the L2TP/IPsec tunnels are working that way.

-Bill

[emnoc]

So  this is L2TP over ipsec

Ken Felix