Skip to main content
AlexFerenX
AlexFerenX
Visitor III
June 10, 2026
Question

Filtering IKE debugging based on phase1 name

  • June 10, 2026
  • 3 replies
  • 96 views

Hi!

Supposedly, setting executing “diagnose vpn ike log filter name” with phase1 name as argument will confine “diagnose debug application ike 255” or “diagnose debug application ike -1” debug logs to only that tunnel. However, when I do it, I see debug logs for all tunnels. 

How to filter out all the tunnels’ debug logs?

Thanks!

    3 replies

    sjoshi
    Staff
    sjoshi
    Staff
    June 10, 2026

    Hi ​@AlexFerenX 

     

    Try using below command to filter specific remote side.

    diagnose vpn ike log-filter dst-addr4 x.x.x.x <---- To filter using remote-gateway address.

     

    Starting from v7.4.1, the command to filter logs related to a specific Remote Peer IP has been changed to:

    diagnose vpn ike log filter rem-addr4 <ip.of.remote.peer>  

     

    Based on the firmware, execute the command

    Thanks, Salon
    AlexFerenX
    AlexFerenXAuthor
    Visitor III
    June 10, 2026

    Try using below command to filter specific remote side.

     

    Thanks, address filter works, but, not my question.

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    June 10, 2026

    Is it a dialup IPsec? Or did you do “diag debug reset”, or at least “diag vpn ike log filter clear” before entering the new filter command to clear previous filters? But I would guess a type or two is most likely scenario.
    I almost never used that filter so far and always figuring out the source IP first (if it’s really hitting the interface by sniffing with the IP first), then use it for “diag vpn ike log filter rem-addr4 [source_IP]” especially when it doesn’t come up (it might be hitting a different phase1). This always works.

    Toshi

    AlexFerenX
    AlexFerenXAuthor
    Visitor III
    June 10, 2026

    Thanks, address filler works, but, not my question.

    AlexFerenX
    AlexFerenXAuthor
    Visitor III
    June 10, 2026

    .

    AlexFerenX
    AlexFerenXAuthor
    Visitor III
    June 10, 2026

    Fortinet, if a bug… fix it?

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    June 10, 2026

    If you think it’s a bug with 7.2.9, you need to upgrade to the latest 7.2, which is 7.2.13 to see if it fixes it. If it still has the problem, you need to open a TAC case and get a bug report generated. Then you can track or get updated for the status of bug fix.

    Toshi

    AlexFerenX
    AlexFerenXAuthor
    Visitor III
    June 10, 2026

    It is a bug in latest 7.2. Creating a ticket against a diagnose commands won’t work - they don’t cause traffic problem so not a support issue - instant rejection.

    Terms & ConditionsAccessibility statement