2

How to debug IP Sec VPN on ASA using SSH? I try debug crypto ipsec terminal monitor logging monitor it asks for completion if i choose debug, all debug info are flooded. How do i view just IPSEC debugs via SSH?

  • I don't want to use logging class option – tyler durden Jul 19 '16 at 11:46
  • What's the output of "show debug"? Do you have other debugs running that are flooding your CLI? – Avery Abbott Jul 19 '16 at 14:21
  • # show debug debug crypto ipsec enabled at level 1 no other debugs are running – tyler durden Jul 20 '16 at 10:23
1

If you want to debug a single L2L VPN connection you can enable the following configuration

ASA# debug crypto condition peer 1.1.1.1

This should limit the debugs to only this specific L2L VPN Peer

You can confirm the setting with

ASA# sh crypto debug-condition
Crypto conditional debug is turned ON
IKE debug context unmatched flag:  OFF
IPSec debug context unmatched flag:  OFF
IKE debug context error flag:  OFF
IPSec debug context error flag:  OFF
IKE peer IP address filters:
1.1.1.1/32

After this you can use the debug crypto isakmp and debug crypto ipsec commands

When you are done be sure to remove the above condition we set with the command

ASA# debug crypto condition reset
Do you want to clear the crypto debug filters? [confirm]

Also, you might have to change the logging lever for monitor

logging monitor debugging

And during the SSH connection issue the command

terminal monitor

And to disable it enter

terminal no monitor

You should be able to disable all debugging with

no debug all

- Jouni

  • i want to debug RA ipsec VPN, i will go with condition option, it seems to be best option, – tyler durden Jul 21 '16 at 9:09
1

Most of the VPN issues you'll want to debug can resolved debugging the IKE portion of the debug. BTW, I'm assuming you mean debugging while SSH'd into the ASA itself.

*Depending on your code version

debug crypto ikev1 1-254 (start with 127, then 254) debug crypto ikev2 1-254 (start with 127, then 254)

debug crypto isakmp 1-254 (start with 127, then 254)

This will automatically display the debug output directly to your terminal but only relative to IPsec VPNs. Keep in mind, this output can be VERY verbose if you have active traffic that is constantly flowing trying to bring up a tunnel and can overflow your terminal.

  • yes that shows debugs even at level 1, – tyler durden Jul 21 '16 at 8:48
  • so this basically means debug crypto ipsec doesn't meen "debugging ike phase 2" – tyler durden Jul 21 '16 at 8:57
  • Correct Tyler :). I've never actually used 'debug crypto ipsec' to troubleshoot any issues with VPNs not establishing/building correctly. – Nick Roberts Jul 22 '16 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.