debug crypto on firepower managed by FMC

[michael18]

how do you see output on a Firepower cli that is manged by FMC. Im trying to run debug crypto ikev2 protocol and platform. I dont see any messages in the FMC syslog

[Rob Ingram]

@michael18 SSH to the FTD - from the CLI enter system support-diagnostics CLI and run debugs there.

https://www.cisco.com/c/en/us/td/docs/security/firepower/621/configuration/guide/fpmc-config-guide-v621/firepower_threat_defense_vpn_troubleshooting.pdf

[michael18]

Thanks for the info. Ill take a look at that document.

in diag CLI, when I enable the debug I get response:

  INFO: 'logging debug-trace' is enabled. All debug messages are currently being redirected to syslog:711001 and will not appear in any monitor session

When i look in FMC syslog I dont see any info relating to the VPN im looking at

[Rob Ingram]

@michael18 in the platform settings policy applied to that FTD, what syslog settings have you configured?

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/740/management-center-device-config-74/interfaces-settings-platform.html#concept_8637BBD154854CA498A2DA66D55A115E

[michael18]

the logging level was set to errors. ive updated this to debugging but still dont see anything in FMC syslogs.

how do I enable monitor logging so i can see debug on local CLI

Thanks

[Rob Ingram]

@michael18 check out this guide for the syslog settings to VPN debugging.

https://www.cisco.com/c/en/us/support/docs/security/secure-firewall-management-center/220647-implement-platform-settings-for-vpn-trou.html

[MHM Cisco World]

I reply to your Q below 
you need to clear crypto to see new IPsec VPN in CLI

MHM

[MHM Cisco World]

711001 is level 7 so you need to config FMC platform setting syslog to use level 7

and it not appear in CLI meaning there is no new IPsec phase1 and phase2 exhange between peer 

you need to force peer to re-exchange ipsec by clear crypto sa 
MHM