topic ike.elg file empty after ike debug in Firewall and Security Management

ike.elg file empty after ike debug

AkosBakos — Mon, 01 Mar 2021 18:09:16 GMT

Hi All,

I bumped into a strange thing during vpn debugging:

after

#vpn debug trunc
#vpn debug ikeon

reproducate the issue: eg. deleting the tunnel with #vpn tu and rebuild it

#vpn debug ikeoff

I see only one row in the ike.elg file : "ike degug started" nothing more.

the vpnd.elg contains data

GW version: R80.40 JHF48

Have somebody such experience?

Akos

Re: ike.elg file empty after ike debug

the_rock — Mon, 01 Mar 2021 18:22:21 GMT

If its empty, it indicates there is not even an attempt at all. Try below:

vpn debug ikeon

test the connection

vpn debug ikeoff

Check ike.elg file. Maybe not a bad idea to run watch -d $FWDIR/log/ike.elg command on duplicate ssh window, just to see if size is increasing.

What is the tunnel? CP to Cisco, PAN, Fortinet, something else? New setup, old, ever worked before?

Andy

Re: ike.elg file empty after ike debug

AkosBakos — Mon, 01 Mar 2021 18:29:28 GMT

Hi Andy,

New setup
CP to Cisco
If the Cisco initiates the tunnel -> ok
If the CP initiates the tunnel -> I see the ougoing packet but Cisco side does not receive it

Therefore I want to do an ike debug but I bumped into this strange behaviour 😕

ike.elg is always empty except that one line

Re: ike.elg file empty after ike debug

the_rock — Mon, 01 Mar 2021 18:30:59 GMT

Message me privately and we can setup remote session.

Andy

Re: ike.elg file empty after ike debug

AkosBakos — Mon, 01 Mar 2021 18:35:39 GMT

Hi Andy,

Thank you.

Strange situation, but customer does not allow remote session at all.

So only tips are allowed.

Re: ike.elg file empty after ike debug

Timothy_Hall — Mon, 01 Mar 2021 19:36:28 GMT

ike.elg will only contain traces from IKEv1 activity. If you are using IKEv2 for the Cisco tunnel the file you need to look in is ikev2.xmll. The Windows ikeview utility can read and decode either file: sk30994: What is the IKEView utility?

Re: ike.elg file empty after ike debug

AkosBakos — Tue, 02 Mar 2021 07:15:48 GMT

Hi Timothy,

Yes, that is the problmem. Only one word come into my mind at the moment: "RTFM" 🙂

Thanks,