VPN traffic capture

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

VPN traffic capture

L1 Bithead

Hello,
I need to capture what passes through a VPN site-to-site tunnel. I'd like to see the tunnel and not the ESP.
With tcpdump you can use the command "tcpdump -i enc0" which decrypts the ESP.
On Palo Alto, what is the equivalent command? Because with view-pcap follow yes filter-pcap <filename> I can only see the ESP.
Thanks

1 accepted solution

Accepted Solutions

Hi @GuillaumeV ,

With view-pcap command you can review the captures  that are done  when debugging/troubleshooting VPN negotiation.

To capture traffic passing through the firewall you need to use the Packet capture feature - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTJCA0

 

Above link goes into details how to define packet capture filter. If you filter based on the private IP address you will capture unencrypted. If you add filter for remote IPsec peer IP, you will capture the encrypted ESP traffic as well.

 

 

View solution in original post

1 REPLY 1

Hi @GuillaumeV ,

With view-pcap command you can review the captures  that are done  when debugging/troubleshooting VPN negotiation.

To capture traffic passing through the firewall you need to use the Packet capture feature - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTJCA0

 

Above link goes into details how to define packet capture filter. If you filter based on the private IP address you will capture unencrypted. If you add filter for remote IPsec peer IP, you will capture the encrypted ESP traffic as well.

 

 

  • 1 accepted solution
  • 1003 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!