Thanks Toshi. This is a pair of clustered 800Cs. Unfortunately I'm still not having any luck. I ran 'set auto-asic-offload disable' on every policy that could possibly handle traffic from the VPN subnet and still nothing shows up in the sniffer. I have tried every interface and still no traffic from the VPN users shows up. Any idea what else I could be doing wrong?
So I found my answer while poking around in the routing monitor. The interface I needed to sniff was ppp1. That is not listed amongst the network interfaces. Each dial-up connection creates a new ppp# You can also use the entry from the Name Column in the IPsec Monitor which uses the format VPNInterfaceName_# starting with _0. (just use the entry in the Name column).
Actually, to clarify to anyone reading this later, the PPP1 interface shows the traffic through the tunnel, the VPNInterfaceName_0 actually shows the tunnel endpoints and not the traffic through the tunnel.
Sorry but this does not even sound like IPSEC tunnel. I've never seen a PPP interface for ipsec at least on the fortigate side. Hint if you are doing ipsec and need to know the interface name do a "diag vpn ike gateway | grep -i name:" that interface name that you see in that output is what you need to use in your diag command
Thanks for the command Ken. It shows the interfaces listed in the IPsec Monitor of the GUI.
The VPN was made using the VPN wizard for Windows L2TP with IPSEC.
The only way I've been able to see the traffic coming into and out of the tunnel is to use the interface ppp# from the routing monitor. I have some more poking around to do for my other VPNs but the L2TP/IPsec tunnels are working that way.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.