Configuring IPSec VPN logging

Last Updated : Nov 06, 2012 |

About this task

IPSec VPN logging allows you to view the start and finish of IKE phase 1 and IKE phase 2 negotiations. Most importantly, it displays the configuration of both peers, so that you can pinpoint the problem in case of a mismatch between the IPSec VPN configuration of the peers.

Note:

For more information about logging, see System logging.

Procedure

  1. Use the set logging session enable command to enable session logging. 
    Gxxx-001# set logging session enable
Done!
CLI-Notification: write: set logging session enable
  2. Use the set logging session condition ISAKMP command to view all ISAKMP messages of Info level and above.

    For example:

    Gxxx-001# set logging session condition ISAKMP Info
Done!
CLI-Notification: write: set logging session condition ISAKMP Info
  3. Use the set logging session condition IPSEC command to view all IPSec messages of Info level and above.

    For example:

    Gxxx-001# set logging session condition IPSEC Info
Done!
CLI-Notification: write: set logging session condition IPSEC Info
  4. Initiate a session by pinging the peer device.

    For example.

    Gxxx-001# ping 135.64.102.109

Result

The logging information details the IKE negotiations, including the ISAKMP SA and IPSec SA configuration of the peers.

Example

IPSEC-Informational: Call IKE negotiation for outgoing SPD entry 901_20:
  Peers 149.49.77.202<->135.64.102.109 
ISAKMP-Informational: Initiating IKE phase 1 negotiation:
  Peers 149.49.77.202<->135.64.102.109 
ISAKMP-Informational: Finished IKE phase 1 negotiation, creating ISAKMP 
SA:
  Peers 149.49.77.202<->135.64.102.109
  Icookie - 0e2fb5ac12ec04b2, Rcookie - 541b912b0a30085d
  esp-des, esp-sha-hmac, DH group 1, Lifetime 86400 seconds 
ISAKMP-Informational: Initiating IKE phase 2 negotiation:
  Peers 149.49.77.202<->135.64.102.109 
ISAKMP-Informational: Finished IKE phase 2, creating outbound IPSEC SA:
  SPI 0x4d706e3, Peers 149.49.77.202<->135.64.102.109
  Identities: 149.49.77.0/255.255.255.0->135.64.102.0/255.255.255.0
  esp-des, esp-md5-hmac, 3600 seconds, 4608000 KB 
ISAKMP-Informational: Finished IKE phase 2, creating inbound IPSEC SA:
  SPI 0x6798, Peers 135.64.102.109<->149.49.77.202
  Identities: 135.64.102.0/255.255.255.0->149.49.77.0/255.255.255.0
  esp-des, esp-md5-hmac, 3600 seconds, 4608000 KB
Related information
IPSec VPN maintenance