VPN Debugger

[TurgutKaplanogl]

VPN Debugger can be used on Check Point Gateways to collect debug information, which is one of the most critical steps in troubleshooting both Client-to-Site(IPSec or SSL) and Site-to-Site VPN issues.

In addition, the debug tool includes a built-in feature to quickly collect CPINFO, enabling faster and more efficient support workflows.

Note: One-time before running the script

Expert mode: chmod +x cp_vpn_debugger.py

Expert mode: dos2unix cp_vpn_debugger.py

Example for Client to Site Debug;

==================================================
Check Point VPN Debug Tool
==================================================
1) Site to Site VPN (S2S)
2) Client to Site VPN (C2S)
3) Collect CPINFO
0) Exit

Select an option: 2

==================================================
Client to Site VPN
==================================================
1) IPSec
2) Mobile Access (SSL)
0) Back

Select an option: 1
==================================================
S2S / C2S-IPSec Debug ENABLE
==================================================
[CMD] vpn debug trunc
[CMD] vpn debug on TDERROR_ALL_ALL=5
[CMD] ike debug trunc ALL=5

Debug ENABLED
Reproduce the issue now.
Press [Q] to STOP debug

Stopping debug...
[CMD] vpn debug truncoff
[CMD] vpn debug off
[CMD] vpn debug ikeoff
[CMD] ike debug off
[CMD] cp -v /opt/CPsuite-R81.20/fw1/log/ike* /var/log/C2S_IPSEC_20251219_130552/ 2>/dev/null
'/opt/CPsuite-R81.20/fw1/log/iked0.elg' -> '/var/log/C2S_IPSEC_20251219_130552/iked0.elg'
'/opt/CPsuite-R81.20/fw1/log/iked0.elg.0' -> '/var/log/C2S_IPSEC_20251219_130552/iked0.elg.0'
'/opt/CPsuite-R81.20/fw1/log/iked0.ikev1trace' -> '/var/log/C2S_IPSEC_20251219_130552/iked0.ikev1trace'
'/opt/CPsuite-R81.20/fw1/log/iked0.ikev1trace.0' -> '/var/log/C2S_IPSEC_20251219_130552/iked0.ikev1trace.0'
'/opt/CPsuite-R81.20/fw1/log/iked0.ikev2trace' -> '/var/log/C2S_IPSEC_20251219_130552/iked0.ikev2trace'
'/opt/CPsuite-R81.20/fw1/log/iked0.ikev2trace.0' -> '/var/log/C2S_IPSEC_20251219_130552/iked0.ikev2trace.0'
'/opt/CPsuite-R81.20/fw1/log/iked1.elg' -> '/var/log/C2S_IPSEC_20251219_130552/iked1.elg'
'/opt/CPsuite-R81.20/fw1/log/iked1.elg.0' -> '/var/log/C2S_IPSEC_20251219_130552/iked1.elg.0'
'/opt/CPsuite-R81.20/fw1/log/iked1.ikev1trace' -> '/var/log/C2S_IPSEC_20251219_130552/iked1.ikev1trace'
'/opt/CPsuite-R81.20/fw1/log/iked1.ikev1trace.0' -> '/var/log/C2S_IPSEC_20251219_130552/iked1.ikev1trace.0'
'/opt/CPsuite-R81.20/fw1/log/iked1.ikev2trace' -> '/var/log/C2S_IPSEC_20251219_130552/iked1.ikev2trace'
'/opt/CPsuite-R81.20/fw1/log/iked1.ikev2trace.0' -> '/var/log/C2S_IPSEC_20251219_130552/iked1.ikev2trace.0'
'/opt/CPsuite-R81.20/fw1/log/iked2.elg' -> '/var/log/C2S_IPSEC_20251219_130552/iked2.elg'
'/opt/CPsuite-R81.20/fw1/log/iked2.elg.0' -> '/var/log/C2S_IPSEC_20251219_130552/iked2.elg.0'
'/opt/CPsuite-R81.20/fw1/log/iked2.ikev1trace' -> '/var/log/C2S_IPSEC_20251219_130552/iked2.ikev1trace'
'/opt/CPsuite-R81.20/fw1/log/iked2.ikev1trace.0' -> '/var/log/C2S_IPSEC_20251219_130552/iked2.ikev1trace.0'
'/opt/CPsuite-R81.20/fw1/log/iked2.ikev2trace' -> '/var/log/C2S_IPSEC_20251219_130552/iked2.ikev2trace'
'/opt/CPsuite-R81.20/fw1/log/iked2.ikev2trace.0' -> '/var/log/C2S_IPSEC_20251219_130552/iked2.ikev2trace.0'
[CMD] cp -v /opt/CPsuite-R81.20/fw1/log/vpnd* /var/log/C2S_IPSEC_20251219_130552/ 2>/dev/null
'/opt/CPsuite-R81.20/fw1/log/vpnd.elg' -> '/var/log/C2S_IPSEC_20251219_130552/vpnd.elg'
'/opt/CPsuite-R81.20/fw1/log/vpnd.elg.0' -> '/var/log/C2S_IPSEC_20251219_130552/vpnd.elg.0'
'/opt/CPsuite-R81.20/fw1/log/vpnd.ikev1trace' -> '/var/log/C2S_IPSEC_20251219_130552/vpnd.ikev1trace'
'/opt/CPsuite-R81.20/fw1/log/vpnd.ikev1trace.0' -> '/var/log/C2S_IPSEC_20251219_130552/vpnd.ikev1trace.0'
'/opt/CPsuite-R81.20/fw1/log/vpnd.ikev2trace' -> '/var/log/C2S_IPSEC_20251219_130552/vpnd.ikev2trace'
'/opt/CPsuite-R81.20/fw1/log/vpnd.ikev2trace.0' -> '/var/log/C2S_IPSEC_20251219_130552/vpnd.ikev2trace.0'
[CMD] cp -v /opt/CPsuite-R81.20/fw1/log/legacy_ike* /var/log/C2S_IPSEC_20251219_130552/ 2>/dev/null
[CMD] tar czf /var/log/C2S_IPSEC_20251219_130552.tar.gz -C /var/log C2S_IPSEC_20251219_130552

[+] Logs collected: /var/log/C2S_IPSEC_20251219_130552.tar.gz

Press ENTER to return to menu

[PhoneBoy]

Nice!