how to capture vpn traffic using packet capture in firepower FTD?

[jperez netics]

Hi everyone, i would like to know how to do a packet capture that match traffic passing through a Site to Site VPN, i tried using "match esp" and "type isakmp" in my capture arguments with no results, i even tried capturing using "match ip" and source IP from remote network with no results neither

i was trying a capture like this examples: 

capture prueba match ip host source any

capture prueba match esp host source any

capture prueba type isakmp trace detail

i also can see pkts encaps and decaps counters growing using the comand "show crypto ipsec sa peer x.x.x.x" so i know that the traffic is passing

What would be a correct way to capture site to site and webvpn traffic?

sometimes i need to know if the traffic is matching correct NAT and ACP rules and i usually do a packet capture to accomplish this but there is no case with Encrypted/VPN traffic

[Rob Ingram]

@jperez netics if you want to know if traffic is hitting the correct NAT and ACP rules, then use packet-tracer to simulate the traffic flow. Alternatively use the command system support firewall-engine-debug and filter on the src/dst ip/port, this will identify which ACP rule was matched.

[jperez netics]

When i try to do a packet tracer or packet capture with normal traffic there is no issue, i have problems with VPN traffic which becomes inconsistent when i try to capture it, and i cannot simulate incoming s2s vpn traffic because it always results in a drop as spoofing, also outgoing vpn traffic is not an issue.

regarding the system support firewall-engine-debug command, what ip protocol should i use with encrypted VPN traffic?

[Rob Ingram]

@jperez netics the tunnel would need to be up when you run packet-tracer for the inbound traffic.

It doesn't matter what protocol you select, it's optional, just define the source or destination ip and generate traffic, it will provide real time feedback.

[MHM Cisco World]

Use same packet tracer because the traffic will decrypt then acl and nat will apply not before that.

So if you have 

Webvpn 

Use packet tracer and use ip from pool you use for client 

Note:- dont use ip that already use by active client.

[MHM Cisco World · Accepted solution]

for S2S VPN
asa# capture OUT interface outside trace include-decrypted match tcp any any

include-decrypted<- this help you for VPN traffic 

[jperez netics · Accepted solution]

thank you very much, that was very very helpful, so for captures we can use this:

capture [name] interface [source-intf] trace include-decrypted match [protocol] [source] [destination]

and for packet tracer we can use this:

packet-tracer input [source-intf] [protocol] [source ip] [source port] [destination ip] [destination port] decrypted

Tested and working!