FortiGate diagnose vpn tunnel list

Overview

diagnose vpn tunnel list displays IPsec tunnel state and security-association information in the current VDOM.

It is one of the primary commands for determining whether Phase 2 SAs are installed and whether packet counters change when controlled traffic is generated.

Commands

List IPsec tunnels:

diagnose vpn tunnel list

Filter by tunnel name where supported:

diagnose vpn tunnel list name <tunnel-name>

Example:

diagnose vpn tunnel list name IPSEC-SITE-B

What to look for

The exact output varies by FortiOS version and VPN design, but common fields include:

• Tunnel name
• Local and remote gateway information
• Bound interface
• Tunnel mode/state
• Proxy ID / selector information
• Security-association state
• Packet and byte counters
• DPD state
• NAT-T information

Why packet counters matter

The command can expose receive/transmit packet counters.

Take a snapshot before a controlled test, generate traffic, then run the command again.

TX increases, RX does not

The local FortiGate is sending traffic toward the tunnel but is not seeing corresponding return traffic.

Investigate the remote side, return routing, selectors, remote policy, and destination service.

RX increases, TX does not

Traffic is arriving from the remote peer, but the expected local response is not being transmitted through the tunnel.

Investigate local routing, firewall policy, endpoint reachability, and the return application flow.

Neither changes

The tested traffic may not be entering this tunnel at all.

Check:

• Route selection
• Firewall policy
• Source/destination addresses
• Phase 2 selectors
• Packet sniffer
• Debug flow

Phase 2 / selector validation

Inspect the proxy ID / selector details and verify that the expected source and destination networks are represented.

A tunnel can be established while a particular traffic pair still does not fit the intended Phase 2 selector design.

VDOM consideration

Run the command in the VDOM that owns the VPN.

If you are in the wrong VDOM, the expected tunnel may not appear.

What this command does not prove

An installed SA does not prove that:

• The routing table selects the tunnel for your destination.
• The firewall policy allows your test traffic.
• NAT is configured correctly.
• The remote network has a return route.
• The destination application is listening.

Treat tunnel state as one layer of evidence, not the final diagnosis.

Risks and considerations

diagnose vpn tunnel list is read-only and safe for routine troubleshooting.

Do not confuse it with tunnel-control commands such as diagnose vpn tunnel down or diagnose vpn tunnel flush, which can disrupt active connectivity.

Related articles

• FortiGate IPsec tunnel is up but traffic does not pass
• FortiGate packet sniffer
• FortiGate debug flow
• FortiGate routing table

Sources

See the authoritative Fortinet references in the article metadata.