debug crypto ipsec via ssh

Question

How to debug IP Sec VPN on ASA using SSH? I try debug crypto ipsec terminal monitor logging monitor it asks for completion if i choose debug, all debug info are flooded. How do i view just IPSEC debugs via SSH?

Answer 1

If you want to debug a single L2L VPN connection you can enable the following configuration

ASA# debug crypto condition peer 1.1.1.1

This should limit the debugs to only this specific L2L VPN Peer

You can confirm the setting with

ASA# sh crypto debug-condition
Crypto conditional debug is turned ON
IKE debug context unmatched flag:  OFF
IPSec debug context unmatched flag:  OFF
IKE debug context error flag:  OFF
IPSec debug context error flag:  OFF
IKE peer IP address filters:
1.1.1.1/32

After this you can use the debug crypto isakmp and debug crypto ipsec commands

When you are done be sure to remove the above condition we set with the command

ASA# debug crypto condition reset
Do you want to clear the crypto debug filters? [confirm]

Also, you might have to change the logging lever for monitor

logging monitor debugging

And during the SSH connection issue the command

terminal monitor

And to disable it enter

terminal no monitor

You should be able to disable all debugging with

no debug all

- Jouni

Answer 2

Most of the VPN issues you'll want to debug can resolved debugging the IKE portion of the debug. BTW, I'm assuming you mean debugging while SSH'd into the ASA itself.

*Depending on your code version

debug crypto ikev1 1-254 (start with 127, then 254) debug crypto ikev2 1-254 (start with 127, then 254)

debug crypto isakmp 1-254 (start with 127, then 254)

This will automatically display the debug output directly to your terminal but only relative to IPsec VPNs. Keep in mind, this output can be VERY verbose if you have active traffic that is constantly flowing trying to bring up a tunnel and can overflow your terminal.