IKEView not displaying ike.elg captures?

[Joe_Kanaszka]

Hey guys.  Any idea why IKEView is not showing my IKE capture logs?  I can view the info in notepad.  It shows only some captures and I can't figure out what the issue is?

I'm running the app on Win11.

Thank you.

[the_rock]

Is it latest ikeview utility?

Andy

[Joe_Kanaszka]

I thought so?...Let me double check.  Yes.  appears to be latest one. Version 200.0.0.4.  

Isn't it supposed to be able to open all ike.elg files?

[the_rock]

I know you cant send the actual ike file, but if you have random one that does not have any sensitive info, happy to try here.

Andy

[Joe_Kanaszka]

Thanks man.  I can't inspect them right now but thank you.   Weird.  

[the_rock]

You got it. One I sent you is definitely the latest one.

Andy

[the_rock]

This is the one I use and never had that problem.

Andy

[Joe_Kanaszka]

So it appears you can't open up iked.elg files.  ok.  Some captures I do not have anything but iked files.  

[the_rock]

Correct...ONLY ike.elg

[Joe_Kanaszka]

• Can an R81.20 gateway produce Ike.elg files?  

[the_rock]

Yes sir, 100%

[Joe_Kanaszka]

Morning!  Quick question. How can I get my R81.20 gateway to generate Ike.elg logs?  Or is there a way to analyze Ike’s.elg files as easily?  

Thank you again!

[the_rock]

vpn debug trunc (rotates vpn debug files)

vpn debug ikeon

-leave it on for few mins

vpn debug ikeoff

check $FWDIR/log dir

[Joe_Kanaszka]

Thanks man. I’ll give it a shot. I don’t think I was leaving it on long enough. 

[the_rock]

Just ued ikeview I sent you to open ike.elg file from customer's R81.20 fw we generated 2 weeks ago or so and worked like a charm, no issues.

Andy

[Timothy_Hall]

Be aware that IKE debugs are written to different files depending on which version of IKE is in use.  IKEv1 is ike.elg, IKEv2 is ike2.xmll usually, but could also be legacy_ike2.xmll.  If you are opening the correct file(s) my guess would be some kind of output format change in the debug that ikeview does not understand, particularly if you are running the more recent versions of gateway code that moved the IKE negotiation function out of the very old vpnd and into the new iked.