Skip to main content
slouw
slouw
Explorer III
October 25, 2023
Solved

How to generate debugs

  • October 25, 2023
  • 3 replies
  • 2703 views

This post is to seek help to generate some debug output.
The context is an attempt to setup a new IPsec tunnel on a new site to connect into an existing SD-WAN hub.
I believe that I have copied the config of any existing site to a new setup but upon adding the first tunnel it remains status = down.
I am wanting to generate some debugs but not seeing any output.
All I have done is the following command:
diagnose debug enable

Do I need to do anything else?
I have left the IKE filter at default i.e. No filtering.
I am not sure if there is somewhere I need to specifically turn on IKE debugging?
Appreciate any help

2023-10-26 09h12m16s35.jpg2023-10-26 09h01m33s34 Post diagnose debug info.jpg

Best answer by Toshi_Esumi

"diag debug enable" is to just get any/all debug output you specifically set up into your CLI session. You have to run IKE debugging specifically following a KB like below:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPSEC-Tunnel-debugging-IKE/ta-p/190052

 

Toshi

3 replies

Toshi_Esumi
SuperUser
Toshi_EsumiAnswer
SuperUser
October 25, 2023

"diag debug enable" is to just get any/all debug output you specifically set up into your CLI session. You have to run IKE debugging specifically following a KB like below:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPSEC-Tunnel-debugging-IKE/ta-p/190052

 

Toshi

    slouw
    slouwAuthor
    Explorer III
    October 26, 2023

    Thanks @Toshi_Esumi 

    From that doc I use the command

    diag debug app ike -1

    And I see I have some output.

    Happiness.... :)

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    October 26, 2023

    On the spoke side, you likely have only one IPsec so the IKE debug works fine without any filtering. But on the hub side, there must be mulitple IPSec so you definitely want to filter the debugging only for the one from this spoke. At that time you want to use the command:
    "diag vpn ike log-filter <option> <parameter>"

    as in the KB before enabling the output with "diag debug ena".

    Toshi

      slouw
      slouwAuthor
      Explorer III
      October 26, 2023

      Understood thanks

      I have enabled a couple of debugs now on my test box

      Is there a command to show what debugs are enabled?

      Toshi_Esumi
      SuperUser
      Toshi_Esumi
      SuperUser
      October 26, 2023

      "diag debug info"

      To stop "diag debug app ike -1" specifically is "diag debug app ike 0".
      But we almost always use "diag debug reset" to stop all of them then start over.

      Toshi

        Terms & ConditionsAccessibility statement