How to monitor traffic through specific IPsec VPN tunnel ?

Question

Dear community,

at present I need to check if some traffic (ordinary ping) is routed to a tunnel or not.
On the previous UTM this was fairly easy by running "espdump" for this tunnel on the console.
When ping was routed OK and the rules allowed it, I would see the packet showing up on the console.

As far as I understood, the XG doesn't have the espdump command available.

So which options do I have, to verify, that packets are routed through a specific IPsec tunnel ?
Any advice is appreciated.

Best Regards
RanX

This thread was automatically locked due to age.

FormerMember · Accepted Answer

Hi RanX , 
 In that case, you can grep the tcpdump with inbound and outbound SPIs for specific tunnels: 
 Run the following command from Advanced Shell: 
 
 ipsec statusall 
 
 Find the SPIs for the specific tunnel as shown in the following sample: 
 
 To_Azure_XG -1{27}: INSTALLED, TUNNEL, reqid 5, ESP in UDP SPIs: cabd3fef_i c71719d2_o 
 
 Now run tcpdump on WAN interface with the following command: 
 
 tcpdump -n -s0 -p -i PortB | grep 'c71719d2\|cabd3fef' 
 
 08:43:19.831272 PortB, OUT: IP 192.168.1.16.4500 > 52.225.xxx.xxx.4500: UDP-encap: ESP(spi=0xc71719d2,seq=0x499), length 136 08:43:20.367136 PortB, OUT: IP 192.168.1.16.4500 > 52.225.xx.xx.4500: UDP-encap: ESP(spi=0xc71719d2,seq=0x49a), length 152 08:43:20.409947 PortB, IN: IP 52.225.xxx.xxx.4500 > 192.168.1.16.4500: UDP-encap: ESP(spi=0xcabd3fef,seq=0x145), length 152 08:43:20.995885 PortB, OUT: IP 192.168.1.16.4500 > 52.225.xxx.xxx.4500: UDP-encap: ESP(spi=0xc71719d2,seq=0x49b), length 152 08:43:21.370021 PortB, OUT: IP 192.168.1.16.4500 > 52.225.xxx.xxx.4500: UDP-encap: ESP(spi=0xc71719d2,seq=0x49c), length 152 08:43:21.408517 PortB, IN: IP 52.225.xxx.xx.4500 > 192.168.1.16.4500: UDP-encap: ESP(spi=0xcabd3fef,seq=0x146), length 152 
 Thanks,

FormerMember · Answer

Hi RanX , 
 Check out the following KBA if you want to dig more into the encrypted traffic: 
 
 Sophos Firewall: Decrypt IKE or ESP packets 
 
 If you want to capture traffic for specific tunnel you might have to use the destination public IP address along with the port 500. 
 Thanks,

How to monitor traffic through specific IPsec VPN tunnel ?

Top Replies