How to enable debug on a single VPN Peer? - Knowledge Base - Palo Alto Networks

How to enable debug on a single VPN Peer?

153718

Created On 09/25/18 19:44 PM - Last Modified 08/21/20 21:01 PM

IKE

IPSec

VPNs

8.1

8.0

9.0

PAN-OS

Symptom

Starting from PAN-OS 8.0, debugs can be enabled on a single VPN Peer. This is helpful when multiple VPN peers are configured and one VPN peer needs troubleshooting.

Environment

PAN-OS 8.0 and above.
Palo Alto Firewall.
IPSec VPN configured

Resolution

Starting from PAN-OS 8.0, we can enable IPSec VPN specific debugs per-peer:

Pre PAN-OS 8.0

admin@PA-VM-7.1> debug ike 
 > global   global 
 > pcap     pcap 
 > socket   socket 
 > stat     show IKE daemon statistics

Post-PAN-OS 8.0

admin@PA-VM-8.0> debug ike
> gateway   debug IKE gateway
> global    global
> pcap      pcap
> socket    socket
> stat      show IKE daemon statistics
> tunnel    debug IPSec tunnel

Using the " gateway " or " tunnel " keyword you can enable the logs per VPN gateway or IPSEC tunnel

Example:

admin@PA-VM-8.0> debug ike gateway IKE-GW-HQ
> clear   clear IPSec tunnel statistics
> off     Turn off IPSec tunnel debug logging
> on      Turn on IPSec tunnel debug logging
> stats   show IPSec tunnel statistics

admin@PA-VM-8.0> debug ike gateway IPSEC-HQ 
> clear   clear IPSec tunnel statistics
> off     Turn off IPSec tunnel debug logging
> on      Turn on IPSec tunnel debug logging
> stats   show IPSec tunnel statistics

To turn off the currently enabled settings use:

admin@PA-VM-8.0> debug ike gateway <name> off

To view the current debug settings use:

admin@PA-VM-8.0> debug ike global show  => The default settings are generally set to normal mode

The logs are stored in ikemgr.log and can be viewed by using the command "less mp-log ikemgr.log"

Additional Information

Note1: Debug filters can be enabled for up to 5 IKE Gateways and/or IPSEC tunnels.
Note2: For additional troubleshooting assistance Refer How to Troubleshoot IPSec VPN connectivity issues.

Other users also viewed:

How to download GlobalProtect from the Customer Support Portal

Download and Install the GlobalProtect App for Windows

Resource List: GlobalProtect Configuring and Troubleshooting

PAN-OS Software Updates

Where to find the current preferred software versions? (PAN-OS, GlobalProtect, User-ID Agent, Plugins)