IPsec related diagnose commands
This section provides IPsec related diagnose commands.
-
Daemon IKE summary information list:
diagnose vpn ike statusconnection: 2/50 IKE SA: created 2/51 established 2/9 times 0/13/40 ms IPsec SA: created 1/13 established 1/7 times 0/8/30 ms
-
IPsec phase1 interface status:
diagnose vpn ike gateway listvd: root/0 name: tofgtc version: 1 interface: port13 42 addr: 173.1.1.1:500 -> 172.16.200.3:500 created: 4313s ago IKE SA: created 1/1 established 1/1 time 10/10/10 ms IPsec SA: created 0/0 id/spi: 92 5639f7f8a5dc54c0/809a6c9bbd266a4b direction: initiator status: established 4313-4313s ago = 10ms proposal: aes128-sha256 key: 74aa3d63d88e10ea-8a1c73b296b06578 lifetime/rekey: 86400/81786 DPD sent/recv: 00000000/00000000 vd: root/0 name: to_HQ version: 1 interface: port13 42 addr: 173.1.1.1:500 -> 11.101.1.1:500 created: 1013s ago assigned IPv4 address: 11.11.11.1/255.255.255.252 IKE SA: created 1/1 established 1/1 time 0/0/0 ms IPsec SA: created 1/1 established 1/1 time 0/0/0 ms id/spi: 95 255791bd30c749f4/c2505db65210258b direction: initiator status: established 1013-1013s ago = 0ms proposal: aes128-sha256 key: bb101b9127ed5844-1582fd614d5a8a33 lifetime/rekey: 86400/85086 DPD sent/recv: 00000000/00000010
-
IPsec phase2 tunnel status:
diagnose vpn tunnel listlist all ipsec tunnel in vd 0 ---- nname=L2tpoIPsec ver=1 serial=6 172.16.200.4:0->0.0.0.0:0 tun_id=0.0.0.0 bound_if=4 lgwy=static/1 tun=intf/0 mode=dialup/2 encap=none/24 options[0018]=npu create_dev proxyid_num=0 child_num=0 refcnt=10 ilast=13544 olast=13544 ad=/0 stat: rxp=0 txp=0 rxb=0 txb=0 dpd: mode=on-idle on=0 idle=60000ms retry=3 count=0 seqno=0 natt: mode=none draft=0 interval=0 remote_port=0 run_tally=0 ---- name=to_HQ ver=1 serial=7 173.1.1.1:0->11.101.1.1:0 tun_id=11.101.1.1 bound_if=42 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/8 options[0008]=npu proxyid_num=1 child_num=0 refcnt=13 ilast=10 olast=1112 ad=/0 stat: rxp=1 txp=4 rxb=152 txb=336 dpd: mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=5 natt: mode=none draft=0 interval=0 remote_port=0 proxyid=to_HQ proto=0 sa=1 ref=2 serial=1 src: 0:0.0.0.0/0.0.0.0:0 dst: 0:0.0.0.0/0.0.0.0:0 SA: ref=6 options=10226 type=00 soft=0 mtu=1438 expire=41773/0B replaywin=2048 seqno=5 esn=0 replaywin_lastseq=00000002 itn=0 life: type=01 bytes=0/0 timeout=42900/43200 dec: spi=ca64644a esp=aes key=16 6cc873fdef91337a6cf9b6948972c90f ah=sha1 key=20 e576dbe3ff92605931e5670ad57763c50c7dc73a enc: spi=747c10c8 esp=aes key=16 5060ad8d0da6824204e3596c0bd762f4 ah=sha1 key=20 52965cbd5b6ad95212fc825929d26c0401948abe dec:pkts/bytes=1/84, enc:pkts/bytes=4/608 npu_flag=03 npu_rgwy=11.101.1.1 npu_lgwy=173.1.1.1 npu_selid=5 dec_npuid=2 enc_npuid=2 -
Packets encrypted/decrypted counter:
diagnose vpn ipsec statusAll ipsec crypto devices in use: NP6_0: Encryption (encrypted/decrypted) null : 0 1. des : 0 1. 3des : 0 1. aes : 0 1. aes-gcm : 0 1. aria : 0 1. seed : 0 1. chacha20poly1305 : 0 1. Integrity (generated/validated) null : 0 1. md5 : 0 1. sha1 : 0 1. sha256 : 0 1. sha384 : 0 1. sha512 : 0 1. NP6_1: Encryption (encrypted/decrypted) null : 0 1. des : 0 1. 3des : 0 1. aes : 337152 46069 aes-gcm : 0 1. aria : 0 1. seed : 0 1. chacha20poly1305 : 0 1. Integrity (generated/validated) null : 0 1. md5 : 0 1. sha1 : 337152 46069 sha256 : 0 1. sha384 : 0 1. sha512 : 0 1. NPU Host Offloading: Encryption (encrypted/decrypted) null : 0 1. des : 0 1. 3des : 0 1. aes : 38 1. aes-gcm : 0 1. aria : 0 1. seed : 0 1. chacha20poly1305 : 0 1. Integrity (generated/validated) null : 0 1. md5 : 0 1. sha1 : 38 1. sha256 : 0 1. sha384 : 0 1. sha512 : 0 1. CP8: Encryption (encrypted/decrypted) null : 0 1. des : 0 1. 3des : 1337 1582 aes : 71 11426 aes-gcm : 0 1. aria : 0 1. seed : 0 1. chacha20poly1305 : 0 1. Integrity (generated/validated) null : 0 1. md5 : 48 28 sha1 : 1360 12980 sha256 : 0 1. sha384 : 0 1. sha512 : 0 1. SOFTWARE: Encryption (encrypted/decrypted) null : 0 1. des : 0 1. 3des : 0 1. aes : 0 1. aes-gcm : 0 1. aria : 0 1. seed : 0 1. chacha20poly1305 : 0 1. Integrity (generated/validated) null : 0 1. md5 : 0 1. sha1 : 0 1. sha256 : 0 1. sha384 : 0 1. sha512 : 0 1. -
diagnose debug application ike -1-
diagnose vpn ike log filter rem-addr4 11.101.1.1 -
diagnose vpn ike log filter loc-addr4 173.1.1.1
# ike 0:to_HQ:101: initiator: aggressive mode is sending 1st message... ike 0:to_HQ:101: cookie dff03f1d4820222a/0000000000000000 ike 0:to_HQ:101: sent IKE msg (agg_i1send): 173.1.1.1:500->11.101.1.1:500, len=912, id=dff03f1d4820222a/0000000000000000 ike 0: comes 11.101.1.1:500->173.1.1.1:500,ifindex=42.... ike 0: IKEv1 exchange=Aggressive id=dff03f1d4820222a/6c2caf4dcf5bab75 len=624 ike 0:to_HQ:101: initiator: aggressive mode get 1st response... ike 0:to_HQ:101: VID RFC 3947 4A131C81070358455C5728F20E95452F ike 0:to_HQ:101: VID DPD AFCAD71368A1F1C96B8696FC77570100 ike 0:to_HQ:101: DPD negotiated ike 0:to_HQ:101: VID draft-ietf-ipsra-isakmp-xauth-06.txt 09002689DFD6B712 ike 0:to_HQ:101: VID CISCO-UNITY 12F5F28C457168A9702D9FE274CC0204 ike 0:to_HQ:101: peer supports UNITY ike 0:to_HQ:101: VID FORTIGATE 8299031757A36082C6A621DE00000000 ike 0:to_HQ:101: peer is [[QualityAssurance62/FortiGate]]/FortiOS (v0 b0) ike 0:to_HQ:101: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3 ike 0:to_HQ:101: VID FRAGMENTATION 4048B7D56EBCE88525E7DE7F00D6C2D3C0000000 ike 0:to_HQ:101: peer identifier IPV4_ADDR 11.101.1.1 ike 0:to_HQ:101: negotiation result ike 0:to_HQ:101: proposal id = 1: ike 0:to_HQ:101: protocol id = ISAKMP: ike 0:to_HQ:101: trans_id = KEY_IKE. ike 0:to_HQ:101: encapsulation = IKE/none ike 0:to_HQ:101: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=128 ike 0:to_HQ:101: type=OAKLEY_HASH_ALG, val=SHA2_256. ike 0:to_HQ:101: type=AUTH_METHOD, val=PRESHARED_KEY_XAUTH_I. ike 0:to_HQ:101: type=OAKLEY_GROUP, val=MODP2048. ike 0:to_HQ:101: ISAKMP SA lifetime=86400 ike 0:to_HQ:101: received NAT-D payload type 20 ike 0:to_HQ:101: received NAT-D payload type 20 ike 0:to_HQ:101: selected NAT-T version: RFC 3947 ike 0:to_HQ:101: NAT not detected ike 0:to_HQ:101: ISAKMP SA dff03f1d4820222a/6c2caf4dcf5bab75 key 16:D81CAE6B2500435BFF195491E80148F3 ike 0:to_HQ:101: PSK authentication succeeded ike 0:to_HQ:101: authentication OK ike 0:to_HQ:101: add INITIAL-CONTACT ike 0:to_HQ:101: sent IKE msg (agg_i2send): 173.1.1.1:500->11.101.1.1:500, len=172, id=dff03f1d4820222a/6c2caf4dcf5bab75 ike 0:to_HQ:101: established IKE SA dff03f1d4820222a/6c2caf4dcf5bab75 ike 0: comes 11.101.1.1:500->173.1.1.1:500,ifindex=42.... ike 0: IKEv1 exchange=Mode config id=dff03f1d4820222a/6c2caf4dcf5bab75:97d88fb4 len=92 ike 0:to_HQ:101: mode-cfg type 16521 request 0: ike 0:to_HQ:101: mode-cfg type 16522 request 0: ike 0:to_HQ:101: sent IKE msg (cfg_send): 173.1.1.1:500->11.101.1.1:500, len=108, id=dff03f1d4820222a/6c2caf4dcf5bab75:97d88fb4 ike 0: comes 11.101.1.1:500->173.1.1.1:500,ifindex=42.... ike 0: IKEv1 exchange=Mode config id=dff03f1d4820222a/6c2caf4dcf5bab75:3724f295 len=92 ike 0:to_HQ:101: sent IKE msg (cfg_send): 173.1.1.1:500->11.101.1.1:500, len=92, id=dff03f1d4820222a/6c2caf4dcf5bab75:3724f295 ike 0:to_HQ:101: initiating mode-cfg pull from peer ike 0:to_HQ:101: mode-cfg request APPLICATION_VERSION ike 0:to_HQ:101: mode-cfg request INTERNAL_IP4_ADDRESS ike 0:to_HQ:101: mode-cfg request INTERNAL_IP4_NETMASK ike 0:to_HQ:101: mode-cfg request UNITY_SPLIT_INCLUDE ike 0:to_HQ:101: mode-cfg request UNITY_PFS ike 0:to_HQ:101: sent IKE msg (cfg_send): 173.1.1.1:500->11.101.1.1:500, len=140, id=dff03f1d4820222a/6c2caf4dcf5bab75:3bca961f ike 0: comes 11.101.1.1:500->173.1.1.1:500,ifindex=42.... ike 0: IKEv1 exchange=Mode config id=dff03f1d4820222a/6c2caf4dcf5bab75:3bca961f len=172 ike 0:to_HQ:101: mode-cfg type 1 response 4:0B0B0B01 ike 0:to_HQ:101: mode-cfg received INTERNAL_IP4_ADDRESS 11.11.11.1 ike 0:to_HQ:101: mode-cfg type 2 response 4:FFFFFFFC ike 0:to_HQ:101: mode-cfg received INTERNAL_IP4_NETMASK 255.255.255.252 ike 0:to_HQ:101: mode-cfg received UNITY_PFS 1 ike 0:to_HQ:101: mode-cfg type 28676 response 28:0A016400FFFFFF000000000000000A016500FFFFFF00000000000000 ike 0:to_HQ:101: mode-cfg received UNITY_SPLIT_INCLUDE 0 10.1.100.0/255.255.255.0:0 local port 0 ike 0:to_HQ:101: mode-cfg received UNITY_SPLIT_INCLUDE 0 10.1.101.0/255.255.255.0:0 local port 0 ike 0:to_HQ:101: mode-cfg received APPLICATION_VERSION 'FortiGate-100D v6.0.3,build0200,181009 (GA)' ike 0:to_HQ: mode-cfg add 11.11.11.1/255.255.255.252 to 'to_HQ'/58 ike 0:to_HQ: set oper up ike 0:to_HQ: schedule auto-negotiate ike 0:to_HQ:101: no pending Quick-Mode negotiations ike shrank heap by 159744 bytes ike 0:to_HQ:to_HQ: IPsec SA connect 42 173.1.1.1->11.101.1.1:0 ike 0:to_HQ:to_HQ: using existing connection
# ike 0:to_HQ:to_HQ: config found ike 0:to_HQ:to_HQ: IPsec SA connect 42 173.1.1.1->11.101.1.1:500 negotiating ike 0:to_HQ:101: cookie dff03f1d4820222a/6c2caf4dcf5bab75:32f4cc01 ike 0:to_HQ:101:to_HQ:259: initiator selectors 0 0:0.0.0.0/0.0.0.0:0:0->0:0.0.0.0/0.0.0.0:0:0 ike 0:to_HQ:101: sent IKE msg (quick_i1send): 173.1.1.1:500->11.101.1.1:500, len=620, id=dff03f1d4820222a/6c2caf4dcf5bab75:32f4cc01 ike 0: comes 11.101.1.1:500->173.1.1.1:500,ifindex=42.... ike 0: IKEv1 exchange=Quick id=dff03f1d4820222a/6c2caf4dcf5bab75:32f4cc01 len=444 ike 0:to_HQ:101:to_HQ:259: responder selectors 0:0.0.0.0/0.0.0.0:0->0:0.0.0.0/0.0.0.0:0 ike 0:to_HQ:101:to_HQ:259: my proposal: ike 0:to_HQ:101:to_HQ:259: proposal id = 1: ike 0:to_HQ:101:to_HQ:259: protocol id = IPSEC_ESP: ike 0:to_HQ:101:to_HQ:259: PFS DH group = 14 ike 0:to_HQ:101:to_HQ:259: trans_id = ESP_AES_CBC (key_len = 128) ike 0:to_HQ:101:to_HQ:259: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:to_HQ:101:to_HQ:259: type = AUTH_ALG, val=SHA1 ike 0:to_HQ:101:to_HQ:259: trans_id = ESP_AES_CBC (key_len = 256) ike 0:to_HQ:101:to_HQ:259: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:to_HQ:101:to_HQ:259: type = AUTH_ALG, val=SHA1 ike 0:to_HQ:101:to_HQ:259: trans_id = ESP_AES_CBC (key_len = 128) ike 0:to_HQ:101:to_HQ:259: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:to_HQ:101:to_HQ:259: type = AUTH_ALG, val=SHA2_256 ike 0:to_HQ:101:to_HQ:259: trans_id = ESP_AES_CBC (key_len = 256) ike 0:to_HQ:101:to_HQ:259: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:to_HQ:101:to_HQ:259: type = AUTH_ALG, val=SHA2_256 ike 0:to_HQ:101:to_HQ:259: trans_id = ESP_AES_GCM_16 (key_len = 128) ike 0:to_HQ:101:to_HQ:259: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:to_HQ:101:to_HQ:259: type = AUTH_ALG, val=NULL ike 0:to_HQ:101:to_HQ:259: trans_id = ESP_AES_GCM_16 (key_len = 256) ike 0:to_HQ:101:to_HQ:259: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:to_HQ:101:to_HQ:259: type = AUTH_ALG, val=NULL ike 0:to_HQ:101:to_HQ:259: trans_id = ESP_CHACHA20_POLY1305 (key_len = 256) ike 0:to_HQ:101:to_HQ:259: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:to_HQ:101:to_HQ:259: type = AUTH_ALG, val=NULL ike 0:to_HQ:101:to_HQ:259: incoming proposal: ike 0:to_HQ:101:to_HQ:259: proposal id = 1: ike 0:to_HQ:101:to_HQ:259: protocol id = IPSEC_ESP: ike 0:to_HQ:101:to_HQ:259: PFS DH group = 14 ike 0:to_HQ:101:to_HQ:259: trans_id = ESP_AES_CBC (key_len = 128) ike 0:to_HQ:101:to_HQ:259: encapsulation = ENCAPSULATION_MODE_TUNNEL ike 0:to_HQ:101:to_HQ:259: type = AUTH_ALG, val=SHA1 ike 0:to_HQ: schedule auto-negotiate ike 0:to_HQ:101:to_HQ:259: replay protection enabled ike 0:to_HQ:101:to_HQ:259: SA life soft seconds=42902. ike 0:to_HQ:101:to_HQ:259: SA life hard seconds=43200. ike 0:to_HQ:101:to_HQ:259: IPsec SA selectors #src=1 #dst=1 ike 0:to_HQ:101:to_HQ:259: src 0 4 0:0.0.0.0/0.0.0.0:0 ike 0:to_HQ:101:to_HQ:259: dst 0 4 0:0.0.0.0/0.0.0.0:0 ike 0:to_HQ:101:to_HQ:259: add IPsec SA: SPIs=ca64644b/747c10c9 ike 0:to_HQ:101:to_HQ:259: IPsec SA dec spi ca64644b key 16:D5C60F1A3951B288CE4DEC7E04D2119D auth 20:F872A7A26964208A9AA368A31AEFA3DB3F3780BC ike 0:to_HQ:101:to_HQ:259: IPsec SA enc spi 747c10c9 key 16:97952E1594F718128D9D7B09400856EA auth 20:4D5E5BC45A9D5A9A4631E911932F5650A4639A37 ike 0:to_HQ:101:to_HQ:259: added IPsec SA: SPIs=ca64644b/747c10c9 ike 0:to_HQ:101:to_HQ:259: sending SNMP tunnel UP trap ike 0:to_HQ:101: sent IKE msg (quick_i2send): 173.1.1.1:500->11.101.1.1:500, len=76, id=dff03f1d4820222a/6c2caf4dcf5bab75:32f4cc01
-
-
Flush a Phase2 tunnel security association (SA) by name:
-
List the tunnels:
diagnose vpn tunnel list -
Pick and flush the specific tunnel or tunnels:
diagnose vpn tunnel flush <name> [<name>] ... [<name>]# diagnose vpn tunnel list list all ipsec tunnel in vd 0 ------------------------------------------------------ name=ng-vpn-access_0 ver=2 serial=3 203.0.113.2:4500->198.51.100.2:57245 nexthop=203.0.113.3 tun_id=10.100.66.10 tun_id6=::10.0.0.3 status=up dst_mtu=1500 weight=1 bound_if=5 real_if=5 lgwy=static/1 tun=intf mode=dial_inst/3 encap=none/74664 options[123a8]=npu rgwy-chg rport-chg frag-rfc run_state=0 role=primary accept_traffic=1 overlay_id=0 parent=ng-vpn-access index=0 proxyid_num=1 child_num=0 refcnt=6 ilast=2 olast=44301916 ad=/0 stat: rxp=212 txp=0 rxb=16883 txb=0 dpd: mode=on-demand on=1 status=ok idle=20000ms retry=3 count=0 seqno=0 natt: mode=keepalive draft=0 interval=10 remote_port=57245 fec: egress=0 ingress=0 proxyid=ng-vpn-access proto=0 sa=1 ref=2 serial=1 add-route src: 0:0.0.0.0-255.255.255.255:0 dst: 0:10.100.66.10-10.100.66.10:0 SA: ref=3 options=20682 type=00 soft=0 mtu=1422 expire=42922/0B replaywin=2048 seqno=1 esn=0 replaywin_lastseq=000000d4 qat=0 rekey=0 hash_search_len=1 life: type=01 bytes=0/0 timeout=43188/43200 dec: spi=c595e5cb esp=aes key=16 25f56b4270d642a53b3286c776568ad3 ah=sha1 key=20 ee4b56346a0ea6d307110281a4fbb245a610230c enc: spi=7c9076c5 esp=aes key=16 3b57c313c14532d7bea2a5bd4a0f4788 ah=sha1 key=20 1f8cf4a88dd78a7bf2b0db25910d42b7a6a9b30a dec:pkts/bytes=212/16883, enc:pkts/bytes=0/0 npu_flag=00 npu_rgwy=198.51.100.2 npu_lgwy=203.0.113.2 npu_selid=1 dec_npuid=0 enc_npuid=0 ------------------------------------------------------ name=ng-vpn-access_1 ver=2 serial=4 203.0.113.2:4500->198.51.100.3:49205 nexthop=203.0.113.3 tun_id=10.100.66.11 tun_id6=::10.0.0.4 status=up dst_mtu=0 weight=1 bound_if=5 real_if=0 lgwy=static/1 tun=intf mode=dial_inst/3 encap=none/74664 options[123a8]=npu rgwy-chg rport-chg frag-rfc run_state=0 role=primary accept_traffic=1 overlay_id=0 parent=ng-vpn-access index=1 proxyid_num=1 child_num=0 refcnt=6 ilast=0 olast=44301916 ad=/0 stat: rxp=29 txp=0 rxb=2507 txb=0 dpd: mode=on-demand on=1 status=ok idle=20000ms retry=3 count=0 seqno=0 natt: mode=keepalive draft=0 interval=10 remote_port=49205 fec: egress=0 ingress=0 proxyid=ng-vpn-access proto=0 sa=1 ref=2 serial=1 add-route src: 0:0.0.0.0-255.255.255.255:0 dst: 0:10.100.66.11-10.100.66.11:0 SA: ref=3 options=20682 type=00 soft=0 mtu=1280 expire=43178/0B replaywin=2048 seqno=1 esn=0 replaywin_lastseq=0000001d qat=0 rekey=0 hash_search_len=1 life: type=01 bytes=0/0 timeout=43188/43200 dec: spi=c595e5cc esp=aes key=16 4a1c4602a540bb31f4a01f8bd5b9fc58 ah=sha1 key=20 de95405ff86798ef1c9856a2b059ce04d8ceb3ce enc: spi=218a9591 esp=aes key=16 29038591b7a6d67ea92d4035609f3178 ah=sha1 key=20 b11fb40a319f57a948c86d3bb30f9a69f9f0c9ea dec:pkts/bytes=29/2507, enc:pkts/bytes=0/0 npu_flag=00 npu_rgwy=198.51.100.3 npu_lgwy=203.0.113.2 npu_selid=2 dec_npuid=0 enc_npuid=0 ------------------------------------------------------ name=ng-vpn-access ver=2 serial=1 203.0.113.2:0->0.0.0.0:0 nexthop=203.0.113.3 tun_id=10.0.0.1 tun_id6=::10.0.0.1 status=up dst_mtu=0 weight=1 bound_if=5 real_if=0 lgwy=static/1 tun=intf mode=dialup/2 encap=none/552 options[0228]=npu frag-rfc role=primary accept_traffic=1 overlay_id=0 proxyid_num=0 child_num=2 refcnt=4 ilast=44301916 olast=44301916 ad=/0 stat: rxp=357 txp=0 rxb=28890 txb=0 dpd: mode=on-demand on=0 status=ok idle=20000ms retry=3 count=0 seqno=0 natt: mode=none draft=0 interval=0 remote_port=0 fec: egress=0 ingress=0# diagnose vpn tunnel flush ng-vpn-access_0 # diagnose vpn tunnel list list all ipsec tunnel in vd 0 ------------------------------------------------------ name=ng-vpn-access_1 ver=2 serial=4 203.0.113.2:4500->198.51.100.3:49205 nexthop= tun_id=10.100.66.11 tun_id6=::10.0.0.4 status=up dst_mtu=0 weight=1 bound_if=5 real_if=0 lgwy=static/1 tun=intf mode=dial_inst/3 encap=none/74664 options[123a8]=npu rgwy-chg rport-chg frag-rfc run_state=0 role=primary accept_traffic=1 overlay_id=0 parent=ng-vpn-access index=1 proxyid_num=1 child_num=0 refcnt=6 ilast=0 olast=44301940 ad=/0 stat: rxp=74 txp=0 rxb=5784 txb=0 dpd: mode=on-demand on=1 status=ok idle=20000ms retry=3 count=0 seqno=0 natt: mode=keepalive draft=0 interval=10 remote_port=49205 fec: egress=0 ingress=0 proxyid=ng-vpn-access proto=0 sa=1 ref=2 serial=1 add-route src: 0:0.0.0.0-255.255.255.255:0 dst: 0:10.100.66.11-10.100.66.11:0 SA: ref=3 options=20682 type=00 soft=0 mtu=1280 expire=43155/0B replaywin=2048 seqno=1 esn=0 replaywin_lastseq=0000004a qat=0 rekey=0 hash_search_len=1 life: type=01 bytes=0/0 timeout=43188/43200 dec: spi=c595e5cc esp=aes key=16 4a1c4602a540bb31f4a01f8bd5b9fc58 ah=sha1 key=20 de95405ff86798ef1c9856a2b059ce04d8ceb3ce enc: spi=218a9591 esp=aes key=16 29038591b7a6d67ea92d4035609f3178 ah=sha1 key=20 b11fb40a319f57a948c86d3bb30f9a69f9f0c9ea dec:pkts/bytes=74/5784, enc:pkts/bytes=0/0 npu_flag=00 npu_rgwy=198.51.100.3 npu_lgwy=203.0.113.2 npu_selid=2 dec_npuid=0 enc_npuid=0 ------------------------------------------------------ name=ng-vpn-access ver=2 serial=1 203.0.113.2:0->0.0.0.0:0 nexthop= tun_id=10.0.0.1 tun_id6=::10.0.0.1 status=up dst_mtu=0 weight=1 bound_if=5 real_if=0 lgwy=static/1 tun=intf mode=dialup/2 encap=none/552 options[0228]=npu frag-rfc role=primary accept_traffic=1 overlay_id=0 proxyid_num=0 child_num=1 refcnt=3 ilast=44301940 olast=44301940 ad=/0 stat: rxp=412 txp=0 rxb=32977 txb=0 dpd: mode=on-demand on=0 status=ok idle=20000ms retry=3 count=0 seqno=0 natt: mode=none draft=0 interval=0 remote_port=0 fec: egress=0 ingress=0 -
See debug messages while the tunnel is being flushed:
-
diagnose debug application ike -1 -
diagnose debug enable
# diagnose vpn tunnel flush ng-vpn-access_0 ike V=root:0:ng-vpn-access_0: admin flush IPsec SAs ike V=root:0:ng-vpn-access_0: going to be deleted ike V=root:0:ng-vpn-access_0: sent tunnel-down message to EMS: (fct-uid=9A016B5A6E914B42AD4168C066EB04CA, intf=ng-vpn-access_0, addr=10.100.66.10, vdom=root) ike V=root:0:ng-vpn-access_0: flushing ike V=root:0:ng-vpn-access_0: deleting IPsec SA with SPI 4c04e46a ike V=root:0:ng-vpn-access_0:ng-vpn-access: deleted IPsec SA with SPI 4c04e46a, SA count: 0 ike V=root:ng-vpn-access_0: ng-vpn-access:0: del route 10.100.66.10/255.255.255.255 tunnel 10.100.66.10 oif ng-vpn-access(16) metric 15 priority 1 ike V=root:0:ng-vpn-access_0: sending SNMP tunnel DOWN trap for ng-vpn-access ike V=root:0:ng-vpn-access_0: remote selector down event 10.100.66.10 (devidx=16) ike V=root:0:ng-vpn-access_0: user 'tsmith' 10.100.66.10 del ike V=root:0:ng-vpn-access_0:ng-vpn-access: delete ike V=root:0:ng-vpn-access_0: flushed ike V=root:0:ng-vpn-access_0:0:1: send informational ike 0:ng-vpn-access_0:0: enc 00000008010000000706050403020107 ike 0:ng-vpn-access_0:0: out D2AC0DCA7ACF1905BD68AE1C9065DEF72E20250000000000000000502A00003408EDAD27D533547E17DB2EB3A9DC7C5DF2151C08B8E99D56D78075056233ABBB6CCC2E1566 104FFF6C0996E5209103C5 ike V=root:0:ng-vpn-access_0:0: sent IKE msg (INFORMATIONAL): 203.0.113.2:4500->198.51.100.2:61368, len=80, vrf=0, id=d2ac0dca7acf1905/bd68ae1c9065def7, oif=5 ike V=root:0:ng-vpn-access_0: mode-cfg release 10.100.66.10/255.255.255.255 ike V=root:0:ng-vpn-access_0: delete dynamic
-
-
-
Flush all Phase2 tunnel SAs without specifying a name:
diagnose vpn tunnel flush# diagnose vpn tunnel list list all ipsec tunnel in vd 0 ------------------------------------------------------ name=ng-vpn-access ver=2 serial=1 203.0.113.2:0->0.0.0.0:0 nexthop= tun_id=10.0.0.1 tun_id6=::10.0.0.1 status=up dst_mtu=0 weight=1 bound_if=5 real_if=0 lgwy=static/1 tun=intf mode=dialup/2 encap=none/552 options[0228]=npu frag-rfc role=primary accept_traffic=1 overlay_id=0 proxyid_num=0 child_num=0 refcnt=2 ilast=44301952 olast=44301952 ad=/0 stat: rxp=430 txp=0 rxb=34189 txb=0 dpd: mode=on-demand on=0 status=ok idle=20000ms retry=3 count=0 seqno=0 natt: mode=none draft=0 interval=0 remote_port=0 fec: egress=0 ingress=0
-
View the Phase1 gateway:
diagnose vpn ike gateway listvd: root/0 name: ng-vpn-access_0 version: 2 interface: port3 5 addr: 203.0.113.2:4500 -> 198.51.100.2:52368 tun_id: 10.100.66.10/::10.0.0.5 remote_location: 0.0.0.0 network-id: 0 transport: UDP created: 188s ago eap-user: tsmith 2FA: no groups: LDAP-Administrator 4 peer-id: 198.51.100.2 peer-id-auth: no FortiClient UID: 9A016B5A6E914B42AD4168C066EB04CA assigned IPv4 address: 10.100.66.10/255.255.255.255 nat: me peer pending-queue: 0 PPK: no IKE SA: created 1/1 established 1/1 time 5130/5130/5130 ms IPsec SA: created 1/1 established 1/1 time 0/0/0 ms id/spi: 7 e05dcbd4346e9e3f/cf853d169817be83 direction: responder status: established 188-183s ago = 5130ms proposal: aes256-sha256 child: no SK_ei: 41dd4ed657a5588d-8cd005291374945a-251931ff73ebba0f-738b3651faaa843a SK_er: 65bfcdf70d63f4e2-08c7f995aae55c0f-04c98ee186246de3-18c3ddfa159ba747 SK_ai: 96bb92713a04f6c5-6371892639daa541-b07a706cc4b180f9-d3fa04772efc16fd SK_ar: d465e491b24362e0-454f3670cb8dc264-3bad9d1c7f890d90-e9047b00a5ebd7f1 PPK: no message-id sent/recv: 0/29 QKD: no PQC-KEM (IKE): no PQC-KEM (all IPsec): no lifetime/rekey: 86400/85946 DPD sent/recv: 00000000/00000000 peer-id: 198.51.100.2 vd: root/0 name: ng-vpn-access_1 version: 2 interface: port3 5 addr: 203.0.113.2:4500 -> 198.51.100.3:59702 tun_id: 10.100.66.11/::10.0.0.6 remote_location: 0.0.0.0 network-id: 0 transport: UDP created: 138s ago eap-user: tsmith 2FA: no groups: LDAP-Administrator 4 peer-id: 198.51.100.3 peer-id-auth: no FortiClient UID: 9A016B5A6E914B42AD4168C066EB04CA assigned IPv4 address: 10.100.66.11/255.255.255.255 nat: me peer pending-queue: 0 PPK: no IKE SA: created 1/1 established 1/1 time 5130/5130/5130 ms IPsec SA: created 1/1 established 1/1 time 0/0/0 ms id/spi: 8 6d9d6fc4a5f65a09/c02126815c1931cd direction: responder status: established 138-133s ago = 5130ms proposal: aes256-sha256 child: no SK_ei: 888bb8b6ca8a387a-61487120a2243997-e6e7b227ae06600a-e77a9b89fe0158e0 SK_er: 1099088559585d0f-f30e1ffe23a7ac03-3ae7d65a8b8f178f-fc17ad65c018dd99 SK_ai: 55a06b7336ca937f-25d5cc8583e8688a-18b9cddbbdb60336-9f412fd9c5baafa5 SK_ar: e30739bcfc070e6a-e7ef36a3857eb0c6-7d6b4d1acc6d960b-9c72889da9fa93bb PPK: no message-id sent/recv: 0/24 QKD: no PQC-KEM (IKE): no PQC-KEM (all IPsec): no lifetime/rekey: 86400/85996 DPD sent/recv: 00000000/00000000 peer-id: 198.51.100.3
-
Filter a gateway by its local address, and then flush it:
-
diagnose vpn ike gateway filter loc-addr4 203.0.113.2 203.0.113.8 -
diagnose vpn ike gateway clear
-