A network engineer is troubleshooting a VPN and wants to verify whether the decapsulation/encapsulation counters are increasing. Which CLI command should the engineer run?

The correct answer is B. Show vpn flow name <tunnel name>. Check if encapsulation and decapsulation bytes are increasing. If the firewall is passing traffic, then both values should be increasing. > show vpn flow name <tunnel.id/tunnel.name> | match bytes https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClivCAC

Submitted by saadiq_pk· Apr 18, 2026Configuration Troubleshooting

Question

Options

AShow running tunnel flow lookup
BShow vpn flow name <tunnel name>
CShow vpn ipsec-sa tunnel <tunnel name>
DShow vpn tunnel name | match encap

How the community answered

(32 responses)

A
3% (1)
B
88% (28)
C
3% (1)
D
6% (2)

Explanation

Check if encapsulation and decapsulation bytes are increasing. If the firewall is passing traffic, then both values should be increasing. > show vpn flow name <tunnel.id/tunnel.name> | match bytes https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClivCAC

Topics

#VPN Troubleshooting#CLI Commands#IPSec Counters

Community Discussion

No community discussion yet for this question.

Full PCNSE Practice