IPsec VPN Tunnel troubleshooting

[az26]

I have an IPsec Site-to-Site VPN tunnel.

The tunnel is configured as a policy tunnel, with couple of traffic-selectors. 

How can I see if there are IPsec SAs for each traffic-selector? 
I only found "vpn tu" command on CLI on Checkpoint documentation.

Do I have to have a routing for the traffic that should go through the tunnel (i.e for the traffic-selctors)?

Then, in the smart-console, should I see logs with Firewall blade (matching a policy rule) or only VPN blade log with Encrypt/decrypt?

[emmap · Accepted solution]

If you have a domain-base VPN you won't see any routes on the system associated with it. In the logs you will see encrypt/decrypt instead of accept logs. 

If you run 'vpn tu tlist' on your gateway you will see a list of the SAs.

[az26]

Thanks @emmap !
I can see one TS that's active at mement 👍 
For the sake of troubleshooting, I removed the policy rule so I can see the traffic being dropped in the logs, yet no drop logs appear 😕  
If there is no premit policy rule would the traffic still go through? 

[emmap]

Traffic won't flow without a rule allowing it. If you're testing directly from the gateway though there's an implied rule accepting outbound traffic from it.