Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
slouw
Contributor

How to generate debugs

This post is to seek help to generate some debug output.
The context is an attempt to setup a new IPsec tunnel on a new site to connect into an existing SD-WAN hub.
I believe that I have copied the config of any existing site to a new setup but upon adding the first tunnel it remains status = down.
I am wanting to generate some debugs but not seeing any output.
All I have done is the following command:
diagnose debug enable

Do I need to do anything else?
I have left the IKE filter at default i.e. No filtering.
I am not sure if there is somewhere I need to specifically turn on IKE debugging?
Appreciate any help

2023-10-26 09h12m16s35.jpg2023-10-26 09h01m33s34 Post diagnose debug info.jpg

1 Solution
Toshi_Esumi
Esteemed Contributor III

"diag debug enable" is to just get any/all debug output you specifically set up into your CLI session. You have to run IKE debugging specifically following a KB like below:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPSEC-Tunnel-debugging-IKE/ta-p/1900...

 

Toshi

View solution in original post

5 REPLIES 5
Toshi_Esumi
Esteemed Contributor III

"diag debug enable" is to just get any/all debug output you specifically set up into your CLI session. You have to run IKE debugging specifically following a KB like below:

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPSEC-Tunnel-debugging-IKE/ta-p/1900...

 

Toshi

slouw
Contributor

Thanks @Toshi_Esumi 

From that doc I use the command

diag debug app ike -1

And I see I have some output.

Happiness.... :)

Toshi_Esumi
Esteemed Contributor III

On the spoke side, you likely have only one IPsec so the IKE debug works fine without any filtering. But on the hub side, there must be mulitple IPSec so you definitely want to filter the debugging only for the one from this spoke. At that time you want to use the command:
"diag vpn ike log-filter <option> <parameter>"

as in the KB before enabling the output with "diag debug ena".

Toshi

slouw

Understood thanks

I have enabled a couple of debugs now on my test box

Is there a command to show what debugs are enabled?

Toshi_Esumi
Esteemed Contributor III

"diag debug info"

To stop "diag debug app ike -1" specifically is "diag debug app ike 0".
But we almost always use "diag debug reset" to stop all of them then start over.

Toshi

Top Kudoed Authors