topic Re: IPsec VPN Tunnel troubleshooting in Services

IPsec VPN Tunnel troubleshooting

az26 — Tue, 07 Jul 2026 07:39:23 GMT

I have an IPsec Site-to-Site VPN tunnel.

The tunnel is configured as a policy tunnel, with couple of traffic-selectors.

How can I see if there are IPsec SAs for each traffic-selector?
I only found "vpn tu" command on CLI on Checkpoint documentation.

Do I have to have a routing for the traffic that should go through the tunnel (i.e for the traffic-selctors)?

Then, in the smart-console, should I see logs with Firewall blade (matching a policy rule) or only VPN blade log with Encrypt/decrypt?

Re: IPsec VPN Tunnel troubleshooting

emmap — Tue, 07 Jul 2026 07:48:57 GMT

If you have a domain-base VPN you won't see any routes on the system associated with it. In the logs you will see encrypt/decrypt instead of accept logs.

If you run 'vpn tu tlist' on your gateway you will see a list of the SAs.

Re: IPsec VPN Tunnel troubleshooting

az26 — Tue, 07 Jul 2026 08:07:15 GMT

Thanks @emmap !
I can see one TS that's active at mement 👍
For the sake of troubleshooting, I removed the policy rule so I can see the traffic being dropped in the logs, yet no drop logs appear 😕
If there is no premit policy rule would the traffic still go through?

Re: IPsec VPN Tunnel troubleshooting

emmap — Tue, 07 Jul 2026 08:14:59 GMT

Traffic won't flow without a rule allowing it. If you're testing directly from the gateway though there's an implied rule accepting outbound traffic from it.