Debug commands to view IPsec tunnel establishment and troubleshooting

2.9 Configure and verify site-to-site and remote access

📘CompTIA Security+ (SY0-701)

---

When you configure site-to-site or remote access VPNs, the tunnels may not always come up as expected. To verify and troubleshoot IPsec tunnels, Cisco devices provide debug commands that give detailed information about what is happening during tunnel setup. This is crucial for exams because the Cisco test often asks how to confirm VPN operation or troubleshoot issues.

We’ll cover:

1. Why debugging is needed
2. Key debug commands
3. Understanding debug outputs
4. Best practices for using debug safely

---

1. Why Debugging is Needed

Even if the VPN configuration seems correct:

• The tunnel might not establish
• Authentication could fail
• Traffic may not pass through the tunnel

Debug commands show step-by-step messages of the VPN process, such as:

• Phase 1 (ISAKMP/IKE negotiation)
• Phase 2 (IPsec SA establishment)
• Encryption and authentication details

This helps you pinpoint the exact cause of failure.

---

2. Key Debug Commands for IPsec VPN

Here’s a list of the most important commands you need for Cisco IOS routers or ASA firewalls:

A. Debug IKE (ISAKMP)

IKE handles Phase 1 of IPsec, where the two VPN peers authenticate each other and agree on a secure channel.

• Command:

debug crypto isakmp

• Purpose: Shows messages about ISAKMP negotiation, including:
  • Key exchange attempts
  • Authentication success/failure
  • Encryption method selection
• Common output info:

ISAKMP: Peer <IP> initiated connection
ISAKMP: Identity verified
ISAKMP: SA established

Exam tip: If Phase 1 fails, Phase 2 cannot start, so always check IKE first.

---

B. Debug IPsec (Crypto)

IPsec handles Phase 2, where the actual encrypted tunnel is created and traffic passes.

• Command:

debug crypto ipsec

• Purpose: Shows IPsec Security Associations (SAs) being established and traffic encryption.
• Common output info:

IPsec SA established for tunnel <peer IP>
Encrypting packet
Decrypting packet

Useful when packets are not passing through the VPN even though the tunnel exists.

---

C. Show Commands (Non-Debug, Verification)

While debug is active, you often verify the tunnel state using show commands:

1. Show crypto isakmp sa – Phase 1 status

Router# show crypto isakmp sa

• Displays if IKE SAs are Active, QM_IDLE, or MM_ACTIVE
• Shows encryption, authentication, and lifetime

2. Show crypto ipsec sa – Phase 2 status

Router# show crypto ipsec sa

• Shows IPsec SA statistics
• Number of packets encrypted/decrypted
• Tunnel is up/down

3. Show crypto engine connections active (Cisco ASA) – shows which crypto engines are processing traffic.

---

D. Debug Logging Options

Sometimes you want more detailed information:

• Debug crypto isakmp detail – Shows detailed negotiation steps
• Debug crypto ipsec detail – Shows encryption of each packet and errors
• Debug crypto engine – Advanced debug to see hardware crypto engine errors

---

3. Understanding Debug Output

When you run debug commands:

• Phase 1 (ISAKMP/IKE) messages indicate:
  • Peer discovery
  • Authentication failure (wrong pre-shared key)
  • Encryption mismatch
• Phase 2 (IPsec) messages indicate:
  • SA creation success or failure
  • Traffic encryption/decryption
  • Mismatched transform sets (encryption algorithms must match)
• Common errors to know for the exam: ErrorMeaningNO_PROPOSAL_CHOSENEncryption/authentication settings mismatchAUTH_FAILEDPre-shared key or certificate wrongINVALID_PACKETTraffic is blocked, possibly ACL issueTIMEOUTPeer did not respond

Exam tip: Recognizing these errors is often tested, so memorize the main ones.

---

4. Best Practices for Debugging

Debugging is CPU-intensive. Use it carefully:

1. Only enable debug on one tunnel at a time.
2. Always monitor CPU; excessive debug can affect device performance.
3. Turn off debug after use:

undebug all

or

no debug all

4. Use show commands first to confirm tunnel is down before debugging.
5. For production environments, debug during maintenance windows.

---

5. Step-by-Step VPN Debugging Approach

Here’s a simple method to troubleshoot:

1. Verify tunnel configuration:

show running-config

2. Check Phase 1 (ISAKMP) status:

show crypto isakmp sa

3. If Phase 1 is down, enable debug:

debug crypto isakmp

4. Check Phase 2 (IPsec) status:

show crypto ipsec sa

5. If Phase 2 is failing, enable debug:

debug crypto ipsec

6. Analyze debug output and correct configuration:
   • Pre-shared keys
   • Transform sets
   • ACLs
   • Encryption/hash methods
7. Once tunnel is stable, disable debug:

undebug all

---

✅ Key Takeaways for the Exam

• Phase 1 = ISAKMP/IKE, Phase 2 = IPsec.
• Use debug crypto isakmp for Phase 1 issues.
• Use debug crypto ipsec for Phase 2 and traffic issues.
• Always verify using show crypto isakmp sa and show crypto ipsec sa.
• Recognize common errors like NO_PROPOSAL_CHOSEN, AUTH_FAILED, and TIMEOUT.
• Disable debug after troubleshooting.

Tip: Exam questions often provide debug outputs and ask you to identify the cause of VPN failure. Practice reading debug messages carefully.