Debug an IPsec configuration

If you experience issues with an IPsec tunnel not being successfully negotiated with the remote end of the tunnel, you can enable IPsec debug messages to be written to the system log. See View system and event logs for more information about viewing the system log.

 

  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Click VPN > IPsec.
  4. Click to expand Advanced.
  5. For Debug level, select one of the following:
    • Disable debug messages.
    • Basic auditing debug: Logs basic auditing information, (for example, SA up/SA down).
    • Generic control flow : Select this for basic debugging information.
    • Detailed control flow : More detailed debugging control flow.
    • Raw data: Includes raw data dumps in hexadecimal format.
    • Sensitive material: Also includes sensitive material in dumps (for example, encryption keys).
  6. Click Apply to save the configuration and apply the change.

 

  1. Select the device in Remote Manager and click Actions > Open Console, or log into the IX15 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:

    > config
(config)>

  3. Set the IPsec debug value:
    config> vpn ipsec advanced debug value
config>

    where value is one of:

    • none. (Default) No debug messages are written.
    • basic_auditing: Logs basic auditing information, (for example, SA up/SA down).
    • generic_control: Select this for basic debugging information.
    • detailed_control: More detailed debugging control flow.
    • raw_data: Includes raw data dumps in hexadecimal format.
    • sensitive_data: Also includes sensitive material in dumps (for example, encryption keys).
  4. Save the configuration and apply the change.
    (config)> save
Configuration saved.
>
  5. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.