How to debug IP Sec VPN on ASA using SSH?
debug crypto ipsec
logging monitor it asks for completion if i choose debug, all debug info are flooded. How do i view just IPSEC debugs via SSH?
If you want to debug a single L2L VPN connection you can enable the following configuration
ASA# debug crypto condition peer 220.127.116.11
This should limit the debugs to only this specific L2L VPN Peer
You can confirm the setting with
ASA# sh crypto debug-condition Crypto conditional debug is turned ON IKE debug context unmatched flag: OFF IPSec debug context unmatched flag: OFF IKE debug context error flag: OFF IPSec debug context error flag: OFF IKE peer IP address filters: 18.104.22.168/32
After this you can use the
debug crypto isakmp and
debug crypto ipsec commands
When you are done be sure to remove the above condition we set with the command
ASA# debug crypto condition reset Do you want to clear the crypto debug filters? [confirm]
Also, you might have to change the logging lever for monitor
logging monitor debugging
And during the SSH connection issue the command
And to disable it enter
terminal no monitor
You should be able to disable all debugging with
no debug all
Most of the VPN issues you'll want to debug can resolved debugging the IKE portion of the debug. BTW, I'm assuming you mean debugging while SSH'd into the ASA itself.
*Depending on your code version
debug crypto ikev1 1-254 (start with 127, then 254) debug crypto ikev2 1-254 (start with 127, then 254)
debug crypto isakmp 1-254 (start with 127, then 254)
This will automatically display the debug output directly to your terminal but only relative to IPsec VPNs. Keep in mind, this output can be VERY verbose if you have active traffic that is constantly flowing trying to bring up a tunnel and can overflow your terminal.