Enabling IKE and VPN debugging

Commands used to debug IKE and VPN failures are entered on the Security Gateway involved in the VPN communication. There is no overhead on the Security Gateway due to enabling debugging mode. The Security Gateway does not require a restart or reboot to enable debugging mode. The output is written in a text format to the respective file(s) in the $FWDIR\log directory.

The vpn debug on command activates debugging mode of VPND, the vpn daemon. Debug output will be written to the$FWDIR\log\vpnd.elg file. In order to turn it off, simply type vpn debug off.

The vpn debug ikeon command turns on IKE debugging mode. IKE packets will be written to the $FWDIR\log\ike.elgfile. In order to turn it off, simply type vpn debug ikeoff.

vpn debug trunc empties the ike.elg file, adds a stamp line "...TRUNCATE issued..." and enables both VPN and IKE debugging.

For VSX NGX, VSX NGX R65, VSX NGX R67

• The vpn -vs debug on command activates debugging mode of VPND, the vpn daemon.


• The vpn -vs debug ikeon command turns on IKE debugging mode.


• vpn -vs debug trunc empties the ike.elg file, adds a stamp line "...TRUNCATE issued..." and enables both VPN and IKE debugging.