debug Phase 2 selectors

[billykaka]

Hello, I am troubleshooting a VPN with the other party is a Cisco ASA.

I would like to know the exact format of the Phase 2 selectors/Encryption Id's/Proxy Id being sent to us by the Cisco ASA

I have tried the following commands to debug IKE

diagnose debug disable diagnose vpn ike log-filter clear diagnose vpn ike log-filter dst-addr4 <Peer IP Address) diagnose debug app ike 255 diagnose debug enable

diagnose debug disable

diagnose debug reset

diag vpn ike log filter name <phase1-name> diag debug app ike -1 diag debug enable

However my debug output does not show a phase 2 selector/encryption domain/proxy id.

What am I doing wrong and how can i get the debug to show me the selector/encryption domain/proxy id's being sent to us by the cisco asa

Thank you

[samsonmartinez]

Hello,

Were you ever able to figure this out? I'm trying to get the same data but all I can see is the selectors I am sending ...

Thanks!

-Samson

[emnoc]

Your debugging IKE which is not going to carry  PH2 ipsec-sa information. I never had to debug  IPSEC-SA btw, just make sure you and the cisco are matching and no  quad 0s { 0.0.0.0/0:0 }

Does the ASA show ESP errors, that's a sign of mis-matched  proxy-ids btw

Ken