ike debug

Background

Starting in R81.10, separate daemons handle different VPN connections:

  • The VPN daemon vpnd.

    Handles these VPN connections:

    • Site-to-Site connections from peer Security Gateways with a Statically Assigned IP address

    • All connections from non-IPsec Remote Access clients (SSL Network Extender)

    • Multi-Portal traffic

    The VPN daemon on a Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. listens on these ports:

    • IKE: 500 (UDP)

    • IKE NAT-T: 4500 (UDP)

    • Tunnel Test: 18234 (UDP)

    • L2TP: 1701 (UDP)

    • Reliable Data Protocol (RDP): 259 (UDP)

    • Session infrastructure manager: 9996 (TCP)

    This process is a child of the FWD process (see the $FWDIR/conf/fwauthd.conf file on a Security Gateway).

  • The IKE daemon iked (introduced in R81.10).

    Handles these VPN connections:

    • All connections from IKE Remote Access clients clients (for example, Endpoint clients)

    • Site-to-Site connections from peer Security Gateways with a Dynamically Assigned IP address (DAIP)

    • Large Scale VPN (LSV) connections

    • Connections from SmartLSM ROBO gateways

    Listens on these ports on a Security Gateway:

    • IKE: 30500 - 30563 (UDP)

    • IKE NAT-T: 34500 - 34563 (UDP)

    • Tunnel Test: 48234 - 48297 (UDP)

    • Reliable Data Protocol (RDP): 30259 - 30322 (UDP)

    • L2TP: 31701 - 31764 (UDP)

    CLI Syntax: vpn iked

    Starting in R81.20, there can be a maximum of 64 instances of the iked daemon that are calculated based on this formula:

    Number of IKED instances = (Number of CoreXL Firewall Instances) / (Value of Kernel Parameter 'ike_num_instances_per_daemon')

    Note - You can configure different values for the kernel parameter 'ike_num_instances_per_daemon'.

  • The CCC daemon cccd (introduced in R81.10).

    Responsible for the Circuit Cross-Connect (CCC) protocol, while:

    • IKE for the same clients runs in the IKE daemon iked

    • CCC TLS for the same clients runs in the VPN daemon vpnd

    CLI Syntax: vpn cccd

    This process is a child of the FWD process (see the $FWDIR/conf/fwauthd.conf file on a Security Gateway).

Disabling the IKE daemon "iked"

It is possible to configure the Security Gateway to disable the IKE daemon iked and work in the legacy mode, in which the VPN daemon vpnd handles all VPN connections.

Disabling the CCC daemon "cccd"

It is possible to configure the Security Gateway to disable the CCC daemon cccd and work in the legacy mode, in which the VPN daemon vpnd handles all VPN connections.

Description

This "ike debug" command instructs the IKE daemon iked to write debug messages to these log files:

File Description

Log File for each IKED instance

Main debug output file

$FWDIR/log/iked0.elg

$FWDIR/log/iked1.elg

... ...

$FWDIR/log/iked64.elg

IKEv1 output

$FWDIR/log/iked0.ikev1trace

$FWDIR/log/iked1.ikev1trace

... ...

$FWDIR/log/iked64.ikev1trace

IKEv2 output

$FWDIR/log/iked0.ikev2trace

$FWDIR/log/iked1.ikev2trace

... ...

$FWDIR/log/iked64.ikev2trace

Debugging of the IKE daemon iked is based on Debug Topics and Debug Levels:

  • A Debug Topic is a specific area, on which to perform debugging.

    Check Point Support provides the specific Debug Topics when needed.

  • Debug Levels range from 1 (least informative) to 5 (most informative - write all debug messages).

In addition, see vpn debug.

Syntax

ike debug

      on [<Debug_Topic>=<Debug_Level>]

      off

      ikeon [-s <Size_in_MB>]

      ikeoff

      [-i <IKED Index>] trunc [<Debug_Topic>=<Debug_Level>]

      truncon [<Debug_Topic>=<Debug_Level>]

      truncoff

      timeon [<Seconds>]

      timeoff

      ikefail [-s <Size_in_MB>]

      mon

      moff

      say ["String"]

      tunnel [<Level>]

Parameters

Parameter

Description

No Parameters

Shows the built-in usage.

on

Turns on high level IKE debug.

The debug writes the information in these files:

  • $FWDIR/log/iked<Index>.elg*

  • $FWDIR/log/iked<Index>.ikev1trace*

  • $FWDIR/log/iked<Index>.ikev2trace*

<Debug_Topic>=<Debug_Level>

Specifies the Debug Topic and the Debug Level.

Check Point Support provides these.

Best Practice - Run this command to start the debug:

ike debug trunc ALL=5

off

Turns off all IKE debug.

Best Practice - Run one of these commands to stop the IKE debug:

ike debug off

ike debug truncoff

ikeon [-s <Size_in_MB>]

Turns on the IKE trace.

The debug writes the information in the $FWDIR/log/iked<Index>.elg* files.

You can specify the size of the $FWDIR/log/iked<Index>.elg file, when to perform the log rotation (close the current activeClosed State of a Cluster Member that is fully operational: (1) In ClusterXL, this applies to the state of the Security Gateway component (2) In 3rd-party / OPSEC cluster, this applies to the state of the cluster State Synchronization mechanism. file, rename it, open a new active file).

ikeoff

Turns off the IKE trace.

Run this command to stop the IKE trace:

ike debug ikeoff

trunc

or

truncon

This command:

  1. Rotates the $FWDIR/log/iked<Index>.elg file

  2. Rotates the $FWDIR/log/iked<Index>.ikev1trace* file

  3. Rotates the $FWDIR/log/iked<Index>.ikev2trace* file

  4. Starts the IKE daemon debug

Best Practice - Run this command to start the IKE debug:

ike debug trunc ALL=5

Note - Use the "-i <IKED Index>" option to start the IKE debug of a specific IKE daemon instance.

truncoff

Stops the IKE daemon debug.

Run one of these commands to stop the IKE debug:

ike debug truncoff

ike debug off

timeon [<Seconds>]

Enables the timestamp in the log files.

Prints one timestamp after the specified number of seconds.

By default, prints the timestamp every 10 seconds.

timeoff

Disables the timestamp in the log files every number of seconds.

ikefail [-s <Size_in_MB>]

Logs failed IKE negotiations.

You can specify the size of the $FWDIR/log/iked<Index>.elg file, when to perform the log rotation (close the current active file, rename it, open a new active file).

mon

Enables the IKE Monitor.

Writes the IKE packets in the $FWDIR/log/ikemonitor.snoop file.

Warning - The output file may contain user X-Auth passwords. Make sure the file is protected.

moff

Disables the IKE Monitor.

say "String"

Writes the specified text string in the $FWDIR/log/iked<Index>.elg file.

For example, run: ike debug say "BEGIN TEST"

Notes:

  • Run this command after you start the VPN debug (with one of these commands: "ike debug on", "ike debug trunc", or "ike debug truncon").

  • The length of the string is limited to 255 characters.

tunnel [<Debug_Level>]

This command:

  1. Rotates the $FWDIR/log/iked<Index>.elg file

  2. Starts the IKE daemon debug with these two Debug Topics:

    tunnel

    ikev2

    If the <Debug_Level> is 2,3,4 or 5, then also enables this Debug Topic:

    CRLCache

The debug writes the information in these files:

  • $FWDIR/log/iked<Index>.elg

  • $FWDIR/log/iked<Index>.ikev1trace*

  • $FWDIR/log/iked<Index>.ikev2trace*