[root@fw root]# tcpdump -i ipsec0 -n
tcpdump: listening on ipsec0
20:05:47.215210 85.159.160.201.l2tp > 10.254.254.2.l2tp:  l2tp:[TLS](0/0)Ns=0,Nr=0 *MSGTYPE(SCCRQ) *PROTO_VER(1.0) *FRAMING_CAP(S) *BEARER_CAP() |...
20:05:48.148692 85.159.160.201.l2tp > 10.254.254.2.l2tp:  l2tp:[TLS](0/0)Ns=0,Nr=0 *MSGTYPE(SCCRQ) *PROTO_VER(1.0) *FRAMING_CAP(S) *BEARER_CAP() |...
20:05:50.175890 85.159.160.201.l2tp > 10.254.254.2.l2tp:  l2tp:[TLS](0/0)Ns=0,Nr=0 *MSGTYPE(SCCRQ) *PROTO_VER(1.0) *FRAMING_CAP(S) *BEARER_CAP() |...
20:05:50.487821 10.254.254.2.isakmp > 85.159.160.201.30510: isakmp: phase 1 ? ident: [|sa] (DF)
20:05:54.175366 85.159.160.201.l2tp > 10.254.254.2.l2tp:  l2tp:[TLS](0/0)Ns=0,Nr=0 *MSGTYPE(SCCRQ) *PROTO_VER(1.0) *FRAMING_CAP(S) *BEARER_CAP() |...
20:06:02.150956 85.159.160.201.l2tp > 10.254.254.2.l2tp:  l2tp:[TLS](0/0)Ns=0,Nr=0 *MSGTYPE(SCCRQ) *PROTO_VER(1.0) *FRAMING_CAP(S) *BEARER_CAP() |...
20:06:03.488620 10.254.254.2.4500 > 85.159.160.201.30510:  udp 1 (DF)
20:06:10.489026 10.254.254.2.isakmp > 85.159.160.201.30510: isakmp: phase 1 ? ident: [|sa] (DF)
20:06:12.147735 85.159.160.201.l2tp > 10.254.254.2.l2tp:  l2tp:[TLS](0/0)Ns=0,Nr=0 *MSGTYPE(SCCRQ) *PROTO_VER(1.0) *FRAMING_CAP(S) *BEARER_CAP() |...
20:06:22.351028 10.254.254.2.4500 > 85.159.160.201.30510:  udp 72 (DF)
20:06:22.870241 10.254.254.2.4500 > 85.159.160.201.30510:  udp 88 (DF)