Cisco ASA IPsec SSH Logging – How to Debug Crypto IPsec

cisco-asaipsecloggingssh

How to debug IP Sec VPN on ASA using SSH?
I try debug crypto ipsec terminal monitor logging monitor it asks for completion if i choose debug, all debug info are flooded. How do i view just IPSEC debugs via SSH?

Best Answer

If you want to debug a single L2L VPN connection you can enable the following configuration

ASA# debug crypto condition peer 1.1.1.1

This should limit the debugs to only this specific L2L VPN Peer

You can confirm the setting with

ASA# sh crypto debug-condition
Crypto conditional debug is turned ON
IKE debug context unmatched flag:  OFF
IPSec debug context unmatched flag:  OFF
IKE debug context error flag:  OFF
IPSec debug context error flag:  OFF
IKE peer IP address filters:
1.1.1.1/32

After this you can use the debug crypto isakmp and debug crypto ipsec commands

When you are done be sure to remove the above condition we set with the command

ASA# debug crypto condition reset
Do you want to clear the crypto debug filters? [confirm]

Also, you might have to change the logging lever for monitor

logging monitor debugging

And during the SSH connection issue the command

terminal monitor

And to disable it enter

terminal no monitor

You should be able to disable all debugging with

no debug all

- Jouni

Related Topic