Debug commands for IPsec VPN

[abob21]

Hi All,

I would like to monitor Ipsec VPN tunnel logs because having intermittent connection loss to remote host.

May I know below debug commands are safe to run on prod router, any performance impacted? or If you have any better solution please suggest.

• debug crypto ipsec
• debug crypto isakmp
• debug crypt engine

Thanks in advance!

Bob

[Aditya Ganjoo · Accepted solution]

Hi Bob,

If there are multiple tunnels then i would not recommend to use these debugs as it would spike the CPU usage on the device.

You can turn on conditional debugging using the command:

debug cry condition peer <>

Regards,

Aditya

[abob21]

Hi Aditya,

Thank for your reply. Currently just one tunnel using but soon to have multiple tunnels.

I will try conditional debug command. 

Regards,

Bob

[Aditya Ganjoo · Accepted solution]

Hi Bob,

Thanks a lot.

Please mark it as a solution if it has answered your query.

Regards,

Aditya