Hi,
Logs are a very good and useful tool. Most of the network guys usually ignore it, forgetting the fact that is the box view of everything happening there, for a firewall it includes many things:
Dropped packets
Inspected traffic
Connection stats
Attack info
VPN info
user's login
More and more and more
With logging there is useful info about VPN. So this is the approach i would recommend when troubleshooting vpn:
1) look at the logs at the debugging level. You might detect the failure directly and you get the Bingo!!!!!
2) Use the debugs with a condition
debug cry isa 128
debug cry ipsec 128
debug cry condition peer a.x.v.b
3) Captures are very important. If you ask me why, i tell you because it is really what is being sent on the network. So as we say captures always tell you the truth!
Here is someone that not everyone knows which is isakmp captures:
capture isa type isakmp interface outside
Test and then
show cap isa decode
it reveals a lot about the isakmp packets exchanged and it is not phase 1 but phase 2 too :P)
So, always mix and understand what is happening.
Moh,
