Description

This article provides instructions on how to configure a log file, called kmd-logs, which contains only VPN status (KMD) messages. This is helpful for troubleshooting a VPN that is down or not active on SRX Series devices.

Symptoms

VPN is not active. How do I capture VPN daemon (KMD) messages in order to troubleshoot the problem faster?

Solution

A VPN issue can be resolved faster by capturing and reviewing the logs on the responder VPN device. The responder is the "receiver" side of the VPN that is receiving the tunnel setup requests. The initiator is the side of the VPN from which the initial IKE session is generated. In the case of a Remote Access IPsec VPN (which is a VPN between a Juniper VPN device and a PC client running the IPsec software), the initiator is always the PC and the responder is the Juniper VPN device.

On the responder VPN device, perform the following actions:

VPN status messages are written to the daemon facility at the "info" level. If your configuration is using the default system syslog configuration, which is "critical," the "info" VPN status messages will not be captured and viewable with show system syslog .

Therefore, perform these steps on the responder side to capture the "info" VPN status messages.

  1. First, configure a new syslog file, kmd-logs , which matches on the uppercase text KMD. 

# set system syslog file kmd-logs daemon info
# set system syslog file kmd-logs match KMD
# commit

Note: The filename is kmd-logs ; it is important that you do not name the file kmd , because the IKE debugs are written to the file kmd .

  1. Then attempt to bring the VPN tunnel up again (so that the VPN status messages are logged to kmd-logs ).

  2. View the VPN status messages with the following command: 

> show log kmd-logs

The file kmd-logs is written to the /var/log directory. 

Example VPN status message 

Jul 10 16:14:00  210-2 kmd[52472]: IKE Phase-2: Failed to match the peer proxy IDs [p2_remote_proxy_id=ipv4_subnet(any:0,[0..7]=192.168.2.0/24), p2_local_proxy_id=ipv4_subnet(any:0,[0..7]=10.10.10.0/24)] for local ip: 10.10.10.1, remote peer ip:192.168.2.2
 

To enable VPN (IKE/IPsec) traceoptions for specific Security Associations (SAs), refer to KB19943 - How to enable VPN (IKE/IPsec) traceoptions for specific SAs (Security Associations) [juniper.net] .

For information on how to analyze these IKE/IPsec messages, refer to:

Modification History

2020-03-20: Article reviewed for accuracy; no changes required

2020-05-05: Fixed broken link

2021-01-20: Added link to article on per-tunnel debug and responder/initiator differentiation

2022-02-27: Fixed broken link

Related Information