How to sniff packets from afar?

I have a customer that has an EAL-4 Firewall with strong CGI scripting
protection on it and I was asked to look at a pen-test for him.
He currently has some of his own people periodically try to break-in to
keep it current with his changing environment.
I was wondering if any knows of a way to sniff packets from either his
VPN tunnel connections or traffic through his firewall when you cannot
connect directly in between his ISP and router.

I was told it is possible, but I don't see how. Also, would anyone know
how to tap a T1 line from a dmark without disrupting service and without
knowing the parameters?

--
Shawn.