Helpful ReplyHot!Unable to sniff traffic from IPSEC VPN

Author
bsongstad
New Member
  • Total Posts : 9
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/04/21 09:45:54
  • Status: offline
2020/06/01 16:01:11 (permalink)
0

Unable to sniff traffic from IPSEC VPN

I'm trying to troubleshoot a routing or policy issue and I'm trying to capture traffic to help me.  Unfortunately, I can't seem to capture any traffic coming through my VPN.
I have a IPSEC VPN connected and passing traffic to the internal network. 
My IP address while connected is 172.16.255.65.
When I run "diag sniffer packet Outside-PSD-10G 'src host 172.16.255.65' 4 10" I get nothing.
If I run the same query with the filter set to none, I get gobs of traffic.  
If I change the interface to the VPN interface, it returns "That device is not up for RASVPNWIN".
Does anyone have any idea what I'm doing wrong?
Any insights are appreciated,
Thank you,
Bill
#1
Toshi Esumi
Expert Member
  • Total Posts : 2175
  • Scores: 213
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: offline
Re: Unable to sniff traffic from IPSEC VPN 2020/06/01 16:27:38 (permalink) ☄ Helpfulby bsongstad 2020/06/02 08:19:56
0
I don't know what model of FGT you're tunning, but you have to disable ASIC off-loading at the policies handling the traffic. Sniffer works at CPU only. The command is
  set auto-asic-offload disable 
#2
bsongstad
New Member
  • Total Posts : 9
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/04/21 09:45:54
  • Status: offline
Re: Unable to sniff traffic from IPSEC VPN 2020/06/02 07:48:46 (permalink)
0
Thanks Toshi.  This is a pair of clustered 800Cs.  Unfortunately I'm still not having any luck.  I ran 'set auto-asic-offload disable' on every policy that could possibly handle traffic from the VPN subnet and still nothing shows up in the sniffer.  I have tried every interface and still no traffic from the VPN users shows up.  Any idea what else I could be doing wrong?
 
Thanks,
Bill
#3
Toshi Esumi
Expert Member
  • Total Posts : 2175
  • Scores: 213
  • Reward points: 0
  • Joined: 2014/11/06 09:56:42
  • Status: offline
Re: Unable to sniff traffic from IPSEC VPN 2020/06/02 08:11:15 (permalink)
0
Is your tunnel interface mode IPSec? Or policy based IPsec?
#4
bsongstad
New Member
  • Total Posts : 9
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/04/21 09:45:54
  • Status: offline
Re: Unable to sniff traffic from IPSEC VPN 2020/06/02 08:14:58 (permalink)
0
So I found my answer while poking around in the routing monitor.  The interface I needed to sniff was ppp1.  That is not listed amongst the network interfaces.  Each dial-up connection creates a new ppp#  You can also use the entry from the Name Column in the IPsec Monitor which uses the format VPNInterfaceName_# starting with _0.  (just use the entry in the Name column).
 
-Bill
 
#5
bsongstad
New Member
  • Total Posts : 9
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/04/21 09:45:54
  • Status: offline
Re: Unable to sniff traffic from IPSEC VPN 2020/06/02 08:19:35 (permalink)
0
Actually, to clarify to anyone reading this later, the PPP1 interface shows the traffic through the tunnel, the VPNInterfaceName_0 actually shows the tunnel endpoints and not the traffic through the tunnel.
 
-Bill
 
#6
emnoc
Expert Member
  • Total Posts : 5748
  • Scores: 373
  • Reward points: 0
  • Joined: 2008/03/20 13:30:33
  • Location: AUSTIN TX AREA
  • Status: offline
Re: Unable to sniff traffic from IPSEC VPN 2020/06/02 09:04:29 (permalink)
0
Sorry but this does not even sound like IPSEC tunnel. I've never seen a PPP interface for ipsec at least on the fortigate side.  Hint if you are doing ipsec and need to know the interface name do a "diag vpn ike gateway | grep -i name:"   that interface name that you see in that output is what you need to use in your diag command
 
Ken Felix
 

PCNSE 
NSE 
StrongSwan  
#7
bsongstad
New Member
  • Total Posts : 9
  • Scores: 0
  • Reward points: 0
  • Joined: 2020/04/21 09:45:54
  • Status: offline
Re: Unable to sniff traffic from IPSEC VPN 2020/06/02 09:15:48 (permalink)
0
Thanks for the command Ken.  It shows the interfaces listed in the IPsec Monitor of the GUI. 
The VPN was made using the VPN wizard for Windows L2TP with IPSEC. 
The only way I've been able to see the traffic coming into and out of the tunnel is to use the interface ppp# from the routing monitor.  I have some more poking around to do for my other VPNs but the L2TP/IPsec tunnels are working that way.
 
-Bill
 
#8
emnoc
Expert Member
  • Total Posts : 5748
  • Scores: 373
  • Reward points: 0
  • Joined: 2008/03/20 13:30:33
  • Location: AUSTIN TX AREA
  • Status: offline
Re: Unable to sniff traffic from IPSEC VPN 2020/06/02 09:32:11 (permalink)
0
So  this is L2TP over ipsec
 
Ken Felix

PCNSE 
NSE 
StrongSwan  
#9
Jump to:
© 2020 APG vNext Commercial Version 5.5