S2S VPN State & Statistics per tunnel/peer?

[Timothy_Hall]

Does anyone know a way to pull current statistics from a particular Site to Site VPN tunnel for troubleshooting purposes?  What I'm looking for is the equivalent of the Cisco show vpn-sessiondb command like this:

This command is useful for seeing if Tx/Rx counters are incrementing to confirm two-way communication for a VPN, and verify current rekey/lifetime timers.  Usually I would just run a packet capture and look for the presence of IKE/IPSEC traffic but there has to be a better way.  What I've tried:

1) cpstat -f all vpn - Dumps very detailed VPN statistics but they are global and no apparent way to focus on a particular tunnel.

2) vpn tu - Just shows SA states with no statistics

3) SmartView Monitor - Tunnels...Monitor Traffic of this tunnel.  Shows the live tunnel state and also allows graphing of top sources/destinations/connections including statistics but no apparent way to do it for all traffic in the tunnel.  I'd imagine this raw data can be acquired by the rtm driver via the rtm monitor command on the gateway, but there is practically no documentation for how to use it.

4) I suppose Accounting could be set on the rule matching traffic to/from the tunnel, but those stats would only be updated every 10 minutes.

Any other suggestions?

[the_rock]

I believe Fortinet has similar. Lets see if its possible with CP, great inquiry.

Andy

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Troubleshooting-IPsec-Site-to-Site-T...

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPsec-VPNs-tunnels/ta-p/195955

[the_rock]

Does command like below give you anything more?

Andy

[Expert@quantum-firewall:0]# vpn tu tlist -p 4.205.75.119

+-----------------------------------------+----------------------------------+---------------------+
| Peer: 4.205.75.119 - Azure | MSA: 7fdb539aa848 | i: 0 ref: 1 |
| Methods: ESP Tunnel PFS AES-256 SHA256..| | i: 1 ref: 1 |
| My TS: 0.0.0.0/0 | | i: 2 ref: 1 |
| Peer TS: 0.0.0.0/0 | | i: 3 ref: 1 |
| MSPI: 1800001 (i: 3, p: 0, d: 1) | No outbound SPI | |
| Tunnel created: | IPsec | |
| Tunnel expiration: | Disconnected | |
+-----------------------------------------+----------------------------------+---------------------+

(0) Site-to-Site tunnels are up:
IPsec 0
NAT-T 0

(0) Number of Active Clients:
NAT-T 0
Visitor Mode 0
SSL 0
L2TP 0
strongSwan 0

[Expert@quantum-firewall:0]#

[CheckPointerXL]

vpn tu tlist start it will trigger statistic counters for every phase2

Then, You can monitor encrypted/decrypted kbytes data by vpn tu tlist

[the_rock]

I dont believe thats good enough for Tim. I had that already on and did not give me anything close to what he showed from Cisco.

Andy