1. show routing route
For example

2. ping source IP host IP

3. traceroute host IP

4. test routing fib-lookup IP
blin@HSA-Firewall> test routing fib-lookup virtual-router default ip 10.2.2.36
runtime route lookup
virtual-router: default
destination: 10.2.2.36
result:
via 12.x.x.129 interface ethernet1/1, source 12.1x.x.130, metric 10
runtime route lookup
virtual-router: Test
destination: 10.2.2.36
result:
via 50.x.x.126 interface tunnel.100, source 169.x.x.250, metric 10
5. test vpn ipsec-sa
blin@HSA-Firewall> test vpn ipsec-sa
- tunnel test for given VPN tunnel
| Pipe through a command
Finish input
blin@HSA-Firewall> test vpn ipsec-sa tunnel
ADP-Tunnel:net1 ADP-Tunnel:net1
Azure-Tunnel Azure-Tunnel
Comcast Comcast
Home-VPN Home-VPN
ipsec-tunnel-1 ipsec-tunnel-1
ipsec-tunnel-2 ipsec-tunnel-2
test for given VPN tunnel
blin@HSA-Firewall> test vpn ipsec-sa tunnel Comcast
Start time: Sep.25 19:03:48
Initiate 1 IPSec SA for tunnel Comcast.