Troubleshooting IPSec connections

Enable Logging

In case IPSec log files are required to troubleshoot connection issues or for other reasons, it can be enabled in the ipsec.conf file.

Note: Logging for the IPSec service is by default disabled.

1. Login to the shell as root user
   
2. Edit the ipsec.conf file
   

root@ng-east:~#vi /etc/ipsec/ipsec.conf

3. Change the logfile value
   

Original value: logfile=/dev/null
New value: logfile=/var/log/pluto.log

TCPDump

It can sometimes be beneficial to get a TCPDump for example to ensure that the traffic is going through the tunnel as expected. This can be performed on the node.

1. Login to the shell as root user
   
2. Start the tcpdump for IPSec
   

Format:

tcpdump -n -i  esp or udp port 500 or udp port 4500

Example:

root@nodegrid: # tcpdump -n -i eth1 esp or udp port 500 or udp port 4500
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes
06:04:39.591780 IP 100.0.1.10 > 100.0.2.11: ESP(spi=0x6416c1f2,seq=0x7), length 132
06:04:40.591634 IP 100.0.2.11 > 100.0.1.10: ESP(spi=0x153683f0,seq=0x8), length 132
06:04:40.591948 IP 100.0.1.10 > 100.0.2.11: ESP(spi=0x6416c1f2,seq=0x8), length 132
^C
16 packets captured
16 packets received by filter
0 packets dropped by kernel

Note: All other tcpdump functions are available as normal and can be used as needed.