fortigate-ipsec-40-mr3

L2TP and IPsec (Microsoft VPN) Troubleshooting
Using the FortiGate unit debug commands
To view debug output for IKE and L2TP
1 Start an SSH or Telnet session to your FortiGate unit.
2 Enter the following CLI commands
diagnose debug application ike -1
diagnose debug application l2tp -1
diagnose debug enable
3 Attempt to use the VPN and note the debug output in the SSH or Telnet session.
4 Enter the following command to reset debug settings to default:
diagnose debug reset
To use the packet sniffer
1 Start an SSH or Telnet session to your FortiGate unit.
2 Enter the following CLI command
diagnose sniffer packet any icmp 4
3 Attempt to use the VPN and note the debug output.
4 Enter Ctrl-C to end sniffer operation.
Typical L2TP over IPsec session startup log entries - raw format
2010-01-11 16:39:58 log_id=0101037127 type=event subtype=ipsec pri=notice
vd="root" msg="progress IPsec phase 1" action="negotiate" rem_ip=172.20.120.151
loc_ip=172.20.120.141 rem_port=500 loc_port=500 out_intf="port1"
cookies="5f6da1c0e4bbf680/d6a1009eb1dde780" user="N/A" group="N/A"
xauth_user="N/A" xauth_group="N/A" vpn_tunnel="dialup_p1" status=success
init=remote mode=main dir=outbound stage=1 role=responder result=OK
2010-01-11 16:39:58 log_id=0101037127 type=event subtype=ipsec pri=notice
vd="root" msg="progress IPsec phase 1" action="negotiate" rem_ip=172.20.120.151
loc_ip=172.20.120.141 rem_port=500 loc_port=500 out_intf="port1"
cookies="5f6da1c0e4bbf680/d6a1009eb1dde780" user="N/A" group="N/A"
xauth_user="N/A" xauth_group="N/A" vpn_tunnel="dialup_p1" status=success
init=remote mode=main dir=outbound stage=2 role=responder result=OK
2010-01-11 16:39:58 log_id=0101037127 type=event subtype=ipsec pri=notice
vd="root" msg="progress IPsec phase 1" action="negotiate" rem_ip=172.20.120.151
loc_ip=172.20.120.141 rem_port=500 loc_port=500 out_intf="port1"
cookies="5f6da1c0e4bbf680/d6a1009eb1dde780" user="N/A" group="N/A"
xauth_user="N/A" xauth_group="N/A" vpn_tunnel="dialup_p1" status=success
init=remote mode=main dir=inbound stage=3 role=responder result=DONE
2010-01-11 16:39:58 log_id=0101037127 type=event subtype=ipsec pri=notice
vd="root" msg="progress IPsec phase 1" action="negotiate" rem_ip=172.20.120.151
loc_ip=172.20.120.141 rem_port=500 loc_port=500 out_intf="port1"
cookies="5f6da1c0e4bbf680/d6a1009eb1dde780" user="N/A" group="N/A"
xauth_user="N/A" xauth_group="N/A" vpn_tunnel="dialup_p1_0" status=success
init=remote mode=main dir=outbound stage=3 role=responder result=DONE
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 209
http://docs.fortinet.com/