Traffic Statistics for Tunnel Routing and IPSec
Statistics
Destination[port]
For IPSec in Tunnel mode, this is the Destination and Destination Port
of the Quick Mode selector of the IPSec SA (the Destination and Port
configured to the Phase 2).
For IPSec in Transport mode, this is the destination IP address of the
Tunnel Routing packets (GRE encapsulated), which is equal to the
Remote IP of the IPSec SA (the Remote IP configured to the Phase 1).
Port information will not be list for this case.
Protocol
For IPSec in Tunnel mode, this is the Protocol of the Quick Mode
selector of the IPSec SA (the Protocol configured to the Phase 2).
For IPSec in Transport mode, this is always "gre".
Created time
The time that the IPSec SA is established.
Last used time
The time that the IPSec SA is applied last to a data packet.
For the details of parameters of IPSec, see "
".
Traffic Statistics for Tunnel Routing and IPSec
Compare with general IP transmission, traffic transferred through FortiWAN's Tunnel Routing or IPSec is charged
extra on GRE/ESP encapsulation and decapsulation (See "
" and "
"). In order to individually
allocate bandwidth to applications encapsulated in GRE and ESP packets, Tunnel Routing and IPSEC are designed to
be transparent to Bandwidth Management (See "
"). Bandwidth Management shapes the
traffic before packet encapsulation or after packet decapsulation. FortiWAN's traffic statistics is associated with the
operation of Bandwidth Management, which implies traffic of Tunnel Routing and IPSec is partially transparent to the
statistics function. FortiWAN gives the traffic statistics in three ways: BM log, statistics on Web UI and FortiWAN
Reports. Traffic statistics for Tunnel Routing and IPSec in the three ways are discussed as follows.
BM logs
A BM log is actually a traffic statistics (inbound-pkts, inbound-bytes, outbound-pkts, outbound-bytes, total-pkts and
total-bytes) in a time period for a traffic (source IP, destination IP, source port and destination port) that matches the
Bandwidth Management filter (See Log format in "
"). Bandwidth Management treats the traffic equally no
matter whether it is later transferred through Tunnel Routing and IPSec. The BM log tells nothing directly (through the
source port and destination port fields) that a transmission is actually done by Tunnel Routing, IPSec or normal IP
routing. You might be aware of a Tunnel Routing and IPSec transmission through the source IP and destination IP in
the logs, if you those IP addresses are already predefined just for the Tunnel Routing and IPSec transmission. The
only situation that you see the GRE or ESP indicated by source port and destination fields in a BM log is when the
traffic comes from other VPN devices.
Statistics on Web UI
Pages
Statistics > Traffic
and
Statistics > BM
(See "
" and "
") the traffic statistics
by WAN links and defined Bandwidth Management classes, which tells nothing directly about Tunnel Routing and
FortiWAN Handbook
Fortinet Technologies Inc.
253
