I love standing up 128T instances on all sorts of hardware, physical and virtualized. Love seeing SVR connections get formed, and all kinds of analytics start to get painted in Conductor GUI screens. I enjoy working with our Debug tools in PCLI and Conductor GUI, watching individual sessions get formed, and I hate seeing those sessions dive into an IPSEC tunnel, never to be seen again, when we build connectivity to 3rd party content filtering devices and services.
Here you can see a bunch of sessions with all of their detail, services, tenants, source and destination, start time, timer value, and so forth.
And here are a pair of IPSEC tunnels created from 128T router to a cloud based content filtering service. All of the original individual session data is now buried within those tunnels, so no way to see it on the egress. That's the problem with tunnels, they obfuscate.
Oh, and I love upgrading 128T software, and discover all the new features just added, like a kid in a candy store...