Verify IPSec VPN Tunnel Transmit Traffic
This topic explains the architectural limitation causing transmitted inner packets to
be missing from packet captures on IPSec tunnel interfaces along with the
workround.
| Where Can I Use This? | What Do I Need? |
|---|
When troubleshooting IPsec VPN traffic using packet capture on a logical tunnel
interface (for example, tunnel.1), you may observe incoming packets while the
outgoing inner traffic remains invisible.
In Palo Alto Networks firewalls, the packet capture utility intercepts traffic at four
specific dataplane stages:
receive (Rx),
firewall,
drop, and
transmit (Tx).
| Stage | Capture Point Description |
|---|
| Receive | Captured as the packet enters the physical interface. |
| Firewall | Captured during the security policy and session lookup. |
| Drop | Captured if the packet is discarded (for example, threat or
policy deny). |
| Transmit | Captured as the packet exits; for tunnels, this only shows
encrypted data. |
The reason unencrypted "inner" traffic is missing from transmitted (Tx) captures on a
logical tunnel interface is due to the sequence of the firewall’s packet-processing
pipeline.
When a packet is destined for an IPsec VPN, the firewall encrypts it before it leaves the
device. The observation point for a logical tunnel interface is typically positioned at
a stage where the data has already been transformed:
- Rx (Received): The firewall has already stripped away the encryption,
allowing you to see the "clear text" packet as it enters the system.
- Tx (Transmitted): The firewall performs encryption and encapsulation
before the packet reaches the final capture hook.
By the time the packet is processed for transmission, the original IP header and payload
have been wrapped inside an Encapsulating Security Payload (ESP) header. Because the
"inner" packet no longer exists in its raw form at the exit point of the logical
interface, the packet capture tool only sees the resulting encrypted traffic or, in many
cases, misses the transmission stage entirely because the packet has been handed off to
the encryption hardware.
Since you cannot rely on a standard packet capture to view the inner Tx traffic on a
tunnel interface, you should use the following methods to verify that traffic is
successfully leaving the firewall:
