cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1681
Views
0
Helpful
2
Replies

IPSec Debugging issue

tahscolony
Level 1
Level 1

I have a 5555-X with 9.5(2)14 and trying to debug a VPN connection.  I was able to debug IKE just fine, but when I try to debug IPSec, no matter what level I use, I get very sparse information.

IPSEC: Received a PFKey message from IKE
IPSEC: Parsing PFKey GETSPI message
IPSEC: Creating IPsec SA
IPSEC: Getting the inbound SPI
IPSEC: New embryonic SA created @ 0x00002aaaf9f0f180,
    SCB: 0xE425B070,
    Direction: inbound
    SPI      : 0xDC1FC202
    Session ID: 0x002D9000
    VPIF num  : 0x00000002
    Tunnel type: l2l
    Protocol   : esp
    Lifetime   : 240 seconds
IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=1.x.x.1, sport=256, daddr=2.x.x.0, dport=256
IPSEC(crypto_map_check)-5: Checking crypto map outside_map 1: skipping because 5-tuple does not match ACL VPN-Interesting-networks.
IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.
IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=1.x.x.1, sport=256, daddr=2.x.x.0, dport=256
IPSEC(crypto_map_check)-5: Checking crypto map outside_map 1: skipping because 5-tuple does not match ACL VPN-Interesting-networks.
IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.
IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=1.x.x.1, sport=256, daddr=2.x.x.0, dport=256
IPSEC(crypto_map_check)-5: Checking crypto map outside_map 1: skipping because 5-tuple does not match ACL VPN-Interesting-networks.
IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.

IPSEC WARNING: Failed to get last received info for SessionID: 0x002D9000
IPSEC: Received a PFKey message from IKE
IPSEC: Destroy current inbound SPI: 0xDC1FC202

I have an existing VPN in use on map 1, working fine, its map 10 I am trying to debug, this is all I am seeing no matter what level I try. I used to be able to get everything I needed running debug crypto ipsec 127, now I get just the 3 crypto map lines, with it set to 255, I get the above.

Is it a bug?

2 Replies 2

Rahul Govindan
VIP Alumni
VIP Alumni

Very strange, I have never seen this issue before. Usually anything from 13-254 gives the same level of info and 255 gives the maximum information. Do you have the output you get when it is level 127?

That is the output above from a debug crypto ipsec 127!

This link http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113574-tg-asa-ipsec-ike-debugs-main-00.html#anc8 shows after QM1 what I am expected to see, and what I am seeing is in my original post.

Very strange indeed.  I have a TAC case opened up on this.