Troubleshooting – Understanding VPN related logs

Understanding VPN related logs

This document provides some IPsec log samples:

IPsec phase1 negotiating

logid=”0101037127″ type=”event” subtype=”vpn” level=”notice” vd=”root” eventtime=1544132571 logdesc=”Progress IPsec phase 1″ msg=”progress IPsec phase 1″ action=”negotiate” remip=11.101.1.1 locip=173.1.1.1 remport=500 locport=500 outintf=”port13″ cook-

ies=”e41eeecb2c92b337/0000000000000000″ user=”N/A” group=”N/A” xauthuser=”N/A” xauthgroup=”N/A” assignip=N/A vpntunnel=”to_HQ” status=”success” init=”local” mode=”aggressive” dir=”outbound” stage=1 role=”initiator” result=”OK” IPsec phase1 negotiated

logid=”0101037127″ type=”event” subtype=”vpn” level=”notice” vd=”root” eventtime=1544132571 logdesc=”Progress IPsec phase 1″ msg=”progress IPsec phase 1″ action=”negotiate” remip=11.101.1.1 locip=173.1.1.1 remport=500 locport=500 outintf=”port13″ cook-

ies=”e41eeecb2c92b337/1230131a28eb4e73″ user=”N/A” group=”N/A” xauthuser=”N/A” xauthgroup=”N/A” assignip=N/A vpntunnel=”to_HQ” status=”success” init=”local” mode=”aggressive” dir=”outbound” stage=2 role=”initiator” result=”DONE”

 

IPsec phase1 tunnel up

logid=”0101037138″ type=”event” subtype=”vpn” level=”notice” vd=”root” eventtime=1544132604 logdesc=”IPsec connection status changed” msg=”IPsec connection status change” action=”tunnelup” remip=11.101.1.1 locip=173.1.1.1 remport=500 locport=500 outintf=”port13″ cookies=”5b1c59fab2029e43/bf517e686d3943d2″ user=”N/A” group=”N/A” xauthuser=”N/A” xauthgroup=”N/A” assignip=11.11.11.1 vpntunnel=”to_HQ” tunnelip=N/A tunnelid=1530910918 tunneltype=”ipsec” duration=0 sentbyte=0 rcvdbyte=0 nextstat=0 IPsec phase2 negotiate

logid=”0101037129″ type=”event” subtype=”vpn” level=”notice” vd=”root” eventtime=1544132604 logdesc=”Progress IPsec phase 2″ msg=”progress IPsec phase 2″ action=”negotiate” remip=11.101.1.1

locip=173.1.1.1 remport=500 locport=500 outintf=”port13″ cookies=”5b1c59fab2029e43/bf517e686d3943d2″ user=”N/A” group=”N/A” xauthuser=”N/A” xauthgroup=”N/A” assignip=11.11.11.1 vpntunnel=”to_HQ” status=”success” init=”local” mode=”quick” dir=”outbound” stage=1 role=”initiator” result=”OK” IPsec phase2 tunnel up

logid=”0101037139″ type=”event” subtype=”vpn” level=”notice” vd=”root” eventtime=1544132604 logdesc=”IPsec phase 2 status changed” msg=”IPsec phase 2 status change” action=”phase2-up” remip=11.101.1.1 locip=173.1.1.1 remport=500 locport=500 outintf=”port13″ cookies=”5b1c59fab2029e43/bf517e686d3943d2″ user=”N/A” group=”N/A” xauthuser=”N/A” xauthgroup=”N/A” assignip=11.11.11.1 vpntunnel=”to_HQ”

phase2_name=”to_HQ” IPsec phase2 sa install

logid=”0101037133″ type=”event” subtype=”vpn” level=”notice” vd=”root” eventtime=1544132604 logdesc=”IPsec SA installed” msg=”install IPsec SA” action=”install_sa” remip=11.101.1.1 locipp=173.1.1.1 remport=500 locport=500 outintf=”port13″ cookies=”5b1c59fab2029e43/bf517e686d3943d2″ userr=”N/A” group=”N/A” xauthuser=”N/A” xauthgroup=”N/A” assignip=11.11.11.1 vpntunnel=”to_HQ” role=”initiator” in_spi=”ca646448″ out_spi=”747c10c6″ IPsec tunnel statistics

logid=”0101037141″ type=”event” subtype=”vpn” level=”notice” vd=”root” eventtime=1544131118 logdesc=”IPsec tunnel statistics” msg=”IPsec tunnel statistics” action=”tunnel-stats” remip=10.1.100.15 locip=172.16.200.4 remport=500 locport=500 outintf=”mgmt1″ cookies=”3539884dbd8f3567/c32e4c1beca91b36″ user=”N/A” group=”N/A” xauthuser=”N/A” xauthgroup=”N/A” assignip=N/A vpntunnel=”L2tpoIPsec_ 0″ tunnelip=10.1.100.15 tunnelid=1530910802 tunneltype=”ipsec” duration=6231 sentbyte=57343 rcvdbyte=142640 nextstat=60 IPsec phase2 tunnel down

logid=”0101037138″ type=”event” subtype=”vpn” level=”notice” vd=”root” eventtime=1544132571 logdesc=”IPsec connection status changed” msg=”IPsec connection status change” action=”tunneldown” remip=11.101.1.1 locip=173.1.1.1 remport=500 locport=500 outintf=”port13″ cookies=”30820aa390687e39/886e72bf5461fb8d” user=”N/A” group=”N/A” xauthuser=”N/A” xauthgroup=”N/A” assignip=11.11.11.1 vpntunnel=”to_HQ” tunnelip=N/A tunnelid=1530910786 tunneltype=”ipsec” duration=6425 sentbyte=504 rcvdbyte=152 nextstat=0 IPsec phase1 sa deleted

logid=”0101037134″ type=”event” subtype=”vpn” level=”notice” vd=”root” eventtime=1544132571 logdesc=”IPsec phase 1 SA deleted” msg=”delete IPsec phase 1 SA” action=”delete_phase1_sa” remip=11.101.1.1 locip=173.1.1.1 remport=500 locport=500 outintf=”port13″ cookies=”30820aa390687e39/886e72bf5461fb8d” user=”N/A” group=”N/A” xauthuser=”N/A” xauthgroup=”N/A” assignip=11.11.11.1 vpntunnel=”to_HQ”


Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Don't Forget To visit the YouTube Channel for the latest Fortinet Training Videos and Question / Answer sessions!
- FortinetGuru YouTube Channel
- FortiSwitch Training Videos