12-22-2016 02:01 PM - edited 02-21-2020 09:06 PM
I have a 5555-X with 9.5(2)14 and trying to debug a VPN connection. I was able to debug IKE just fine, but when I try to debug IPSec, no matter what level I use, I get very sparse information.
IPSEC: Received a PFKey message from IKE
IPSEC: Parsing PFKey GETSPI message
IPSEC: Creating IPsec SA
IPSEC: Getting the inbound SPI
IPSEC: New embryonic SA created @ 0x00002aaaf9f0f180,
SCB: 0xE425B070,
Direction: inbound
SPI : 0xDC1FC202
Session ID: 0x002D9000
VPIF num : 0x00000002
Tunnel type: l2l
Protocol : esp
Lifetime : 240 seconds
IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=1.x.x.1, sport=256, daddr=2.x.x.0, dport=256
IPSEC(crypto_map_check)-5: Checking crypto map outside_map 1: skipping because 5-tuple does not match ACL VPN-Interesting-networks.
IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.
IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=1.x.x.1, sport=256, daddr=2.x.x.0, dport=256
IPSEC(crypto_map_check)-5: Checking crypto map outside_map 1: skipping because 5-tuple does not match ACL VPN-Interesting-networks.
IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.
IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=1.x.x.1, sport=256, daddr=2.x.x.0, dport=256
IPSEC(crypto_map_check)-5: Checking crypto map outside_map 1: skipping because 5-tuple does not match ACL VPN-Interesting-networks.
IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.
IPSEC WARNING: Failed to get last received info for SessionID: 0x002D9000
IPSEC: Received a PFKey message from IKE
IPSEC: Destroy current inbound SPI: 0xDC1FC202
I have an existing VPN in use on map 1, working fine, its map 10 I am trying to debug, this is all I am seeing no matter what level I try. I used to be able to get everything I needed running debug crypto ipsec 127, now I get just the 3 crypto map lines, with it set to 255, I get the above.
Is it a bug?
12-22-2016 04:34 PM
Very strange, I have never seen this issue before. Usually anything from 13-254 gives the same level of info and 255 gives the maximum information. Do you have the output you get when it is level 127?
12-27-2016 06:46 AM
That is the output above from a debug crypto ipsec 127!
This link http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113574-tg-asa-ipsec-ike-debugs-main-00.html#anc8 shows after QM1 what I am expected to see, and what I am seeing is in my original post.
Very strange indeed. I have a TAC case opened up on this.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide