Use Cases for SD-WAN Capabilities in Cisco Secure Firewall

PDF

Verify Traffic Flow Over the VPN Tunnel

Updated: February 5, 2026

Overview

Provides instructions to verify traffic flow across the VPN tunnel to confirm routing, tunnel status, and end-to-end connectivity between hub and spoke devices.

Perform the following verifications for the VPN tunnel.

  • Verify Tunnel Status on the Site-to-site VPN Dashboard

    1. To verify that the VPN tunnel is up and green, choose Overview > Dashboards > Site-to-site VPN.

      Site-to-site VPN dashboard

    2. Hover over NGFW1. The View Full Information icon is displayed next to NGFW1.

    3. Click the View Full Information icon.A side pane with tunnel details and additional actions appears.

    4. Click the CLI Details tab in the side pane.

    5. Click Maximize View to display a maximized dialog box that contains the details of the IPSec security associations.

    6. You can expand the CLI for the show commands in the lower portion of the dialog box to view the VTI interfaces on the devices.

      Tunnel details in the site-to-site VPN dashboard

    7. Click Close to terminate the Tunnel Details window.

  • Verify Routing on the Hub and Branch Nodes-To verify that the OSPF routes have been correctly learned on the NGFW1 and NGFWBR1. nodes:

    1. Choose Devices > Device Management.

    2. To edit NGFW1, click the Edit (edit icon) icon.

    3. Click the Device tab.

    4. Click the CLI button in the General card. The CLI Troubleshoot window appears

    5. Enter show route in the Command field and click Execute .

    6. Review the routes on the NGFW1 node and confirm the VPN route for the spoke’s VTI IP (169.254.20.1) and OSPF learnt route for the Branch_LAN (198.19.11.0/24) as displayed in the figure below.

      Output of show route command for a hub

    7. Repeat Steps 2 through 5 for the NGFWBR1 node.

    8. Review the routes on the NGFWBR1 node. Confirm the OSPF routes learnt for the hub's VTI IP (198.48.133.81) and for the Corporate_LAN (198.19.10.0/24) as displayed in the figure below.

      Output of show route command for a spoke device

  • Verify Traffic between Protected Networks Behind the Spoke and Hub Nodes

    Log into the WKST BR workstation (198.19.11.225) and SSH to the host (198.19.10.200) behind NGFW1. Ensure that you are able to SSH successfully to the host.

    Verifying traffic between protected networks behind the spoke and hub Nodes from the workstation

  • Verify Connectivity Between Branch and Spoke Nodes Using Unified Events

    1. Choose Analysis > Unified Events.

    2. Add the VPN Action, Encrypt Peer, Decrypt Peer, and Egress Interface columns using the column picker.

    3. Reorder and resize the new columns along with the columns, Destination Port/ICMP Code, Access Control Rule, Access Control Policy, and Device as seen in the figure below.

      Verify connectivity between branch and spoke nodes using Unified Events

    4. To view the events related to the SSH connection from the WKST BR to Corporate Host choose the row with 22 (ssh/tcp) in the Destination Port/ICMP Code column. Note the Encrypt action on NGFWBR1 over the outside_static_vti_1 interface followed by the Decrypt action on the NGFW1 as shown in the figure above.