Use the VPN Diagnostic Report

You can run the VPN Diagnostic Report to see configuration and status information about a gateway and its associated tunnels over a short period of time. This is helpful when you want to troubleshoot a branch office VPN tunnel problem. When you run the VPN Diagnostic Report, the Firebox temporarily increases the log level for the selected gateway and collects log messages for the duration of the report. The finished report shows the gateway and tunnel configuration, and information about the status of any active tunnels for the selected gateway. If a problem was found, it can also provide a recommendation about what to try next.

When you run the VPN Diagnostic Report, your Firebox can automatically attempt to correct some types of problems found in the processes that make the VPN function. This does not change the configured VPN settings. If the Firebox attempts to correct a problem, the Conclusion section of the VPN Diagnostic Report indicates that an attempt was made to correct a problem, and might include a recommendation to run the report again or take some other action.

Run the VPN Diagnostic Report

You can run the VPN Diagnostic Report from Fireware Web UI or Firebox System Manager. To see the most complete and useful diagnostic messages, run the report while the remote gateway endpoint attempts to initiate the VPN negotiation. For more information, see Monitor and Troubleshoot BOVPN Tunnels.

Run the Report from Fireware Web UI

From Fireware Web UI, you can run the VPN Diagnostic Report from three locations:

  • System Status > VPN Statistics page, Debug tab

Select the gateway to include in the report and the duration to run the report.

  • System Status > VPN Statistics page, Branch Office VPN tab

From any gateway or tunnel, you can start the report for the selected gateway.

  • System Status > Diagnostics page, VPN tab

Select the gateway to include in the report and the duration to run the report.

For more information about how to run the VPN Diagnostic Report from either tab on the VPN Statistics page, see Run VPN Statistical Reports.

For more information about how to run the VPN Diagnostic Report from the Diagnostics page, see Run the VPN Diagnostic Report.

Run the Report from Firebox System Manager

From Firebox System Manager, you can run the VPN Diagnostic Report from two locations:

  • Front Panel tab

Select a VPN interface or gateway and right-click it to start the report.

  • Diagnostic Tasks dialog box

Select the gateway to include in the report and the duration to run the report.

For more information about how to run the VPN Diagnostic Report from Firebox System Manager, see Run Diagnostic Tasks to Learn More About Log Messages.

Read the VPN Diagnostic Report

The VPN Diagnostic Report includes these sections:

Conclusion

This is the complete report summary and can include information about actions you can take to resolve any issues identified by the report. For each tunnel route, the report shows whether the tunnel route was established, whether traffic was detected after the report started, and error messages related to the tunnel. Some error messages include information about what you can do to correct a problem with the VPN tunnel.

Gateway Summary

This is a summary of the gateway configuration and each configured gateway endpoint.

Tunnel Summary

This is a summary of the tunnel configuration for all tunnels that use the selected gateway. This includes both active and inactive tunnels.

Run-time Info (bvpn routes)

This section only appears when you run the diagnostic report for a branch office VPN virtual interface. It includes the static and dynamic routes that use the BOVPN virtual interface, and the metric for each route.

Run-time Info (gateway IKE_SA)

The status of the IKE (Phase 1) security association for the gateway.

Run-time Info (tunnel IPSEC_SA)

The status of the IPSec tunnel (Phase 2) security association for active tunnels that use the gateway.

Run-time Info (tunnel IPSec_SP)

The status of the IPSec tunnel (Phase 2) security policy for active tunnels that use the gateway.

Address Pairs in Firewalld

The status of the address pairs for each tunnel. This section does not appear when you run the report for a branch office VPN virtual interface.

Policy checker result

The policies that manage inbound and outbound traffic for each tunnel route.

For more information about how to interpret the policy checker results, see Use Policy Checker to Find a Policy.

Related Logs

If tunnel negotiation occurs while the Diagnostic Report runs, the tunnel negotiation log messages appear in this section. If the remote device attempts to negotiate or rekey the tunnel while the report runs, the log messages that appear in this section include more informative details.

See Also

Use VPN Diagnostic Messages

Use the BOVPN Configuration Reports

Give Us Feedback     Get Support     All Product Documentation     Technical Search