Create a Post
Showing results for 
Search instead for 
Did you mean: 

SSH Traffic Not Reaching Host Over VPN Tunnel

Hi all. We've had a VPN tunnel configured between our office and AWS for a little while now. It's worked ok up until today. The tunnel is up and ICMP traffic can pass through but SSH traffic cannot. The AWS side of the tunnel was configured by one of our suppliers and they SSH from AWS into a server in our office.

No configuration changes have been made and from the logs I can see that SSH traffic is coming over the tunnel from AWS and being decrypted by our firewall. I've had a go at FW monitor, filtering on port 22 requests against our server. This is the output:


[vs_0] [fw_0] eth5:i[44]: -> (TCP) len=60 id=61148 TCP: 53522 -> 22 .S.... seq=13bbb810 ack=00000000

Comparing the logs on Smart Console with the fwmonitor output, SmartConsole shows traffic coming into our vpnt2 interface which is correct, but fwmonitor shows eth5 which is our external interface.

I re-installed policy just to see if that made any difference but it hasn't. Why could this be? As I say, no config changes have been made so I'm stumped! Any pointers would be greatly appreciated.

0 Kudos
2 Replies

I believe fw monitor is going to show the physical interface involved (not the virtual one).
What does a fw ctl zdebug drop show?

0 Kudos
Champion Champion

Try using cppcap to take your capture, that tool can directly attach to a VTI interface.  Also run fw ctl zdebug + drop at the same time as Dameon suggested.

Gateway Performance Optimization R81.20 Course
now available at
0 Kudos


Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events