VPN debug commands

[Andy White]

Hello,

I have about 30 site-to-site VPN's going through our ASA 5520, sometimes I need to know about issues with phase 1 and especially phase 2 of a VPN were a remote site hasnt added the correct subent for example.  What commands can I use from the CLI, because when I do "debug crypto isakmp 7" or "debug crypto ipsec 7" I get too much information from other VPN's, can I narrow the debugs down to just the peer IP?

Thanks

[Jennifer Halim]

Yes you can..

Here is the command to debug on specific peer:

debug crypto condition peer address

Command reference:

http://www.cisco.com/en/US/docs/security/asa/asa83/command/reference/d1.html#wp2106282

[Andy White]

Thanks, and is there a command to show all VPN's in brief?

[Jennifer Halim]

Yes, "show vpn-sessiondb" and you can choose which keyword after that as there is a few that you can choose from.

Here is the command reference:

http://www.cisco.com/en/US/docs/security/asa/asa83/command/reference/s7.html#wp1333764

[Andy White]

Sorry I mean is there a view where is will show the peer address and update etc?

[Jennifer Halim]

Sorry, what do you mean by update?

Do you want to see debug output or show output?