Check if the VPN is passing traffic

show vpn flow

Search the VPN gateway status

show vpn ike-sa gateway <name of the vpn gateway>

To get more information about a session flow, get the session ID from the output you received from the above command

show session id <numerical number of session>

Check session status between source and destination

show session all filter source <IP of source> destination <IP of destination>

To check IKE status, will list all the IKE session communicating on port 500

show session all filter destination destination-port 500

Follow the handshake between both ends of the tunnel

less mp-log ikemgr.log

To clear stale IKE sessions

clear session all filter source <IP of source> destination <IP of destination> destination-port 500

In the GUI create packet capture filter with the firewall A as source and firewall B as destination. Then create another filter with firewall B as source and firewall A as destination. Turn on filtering and go back to CLI to get get global counters. This will inform us if there are any packet errors or dropping in the tunnel

show counter global filter delta yes packet-filter yes

show counter global filter severity drop aspect tunnel category flow

Force VPN tunnel to initiate handshake

test vpn ike-sa gateway <name of the vpn gateway>

test vpn ipsec-sa tunnel <name of the vpn tunnel>

Check status of the VPN tunnel

show vpn ike-sa gateway <name of the vpn gateway>

show vpn ipsec-sa tunnel <name of vpn tunnel>

View logs on the different verbose levels

debug ike gateway <gateway name> on <error|warn|normal|debug|dump>

example: debug ike gateway testGW on debug

to turn off log verbose, run

debug ike gateway <gateway name> off

follow logs in realtime

tail follow yes mp-log ikemgr.log