This article provides video and text instructions on how to configure a log file, called kmd-logs, which contains only VPN status (KMD) messages. This is helpful for troubleshooting a VPN that is down or not active.

 

 

VPN is not active. How do I capture VPN daemon (KMD) messages in order to troubleshoot the problem faster?

 

 

Go to the KBTV video or text instructions below:

Video format

 

Text format

A VPN issue can be resolved faster by capturing and reviewing the logs on the responder VPN device. The responder is the "receiver" side of the VPN that is receiving the tunnel setup requests. The initiator is the side of the VPN from which the initial IKE session is generated. In the case of a Remote Access IPsec VPN (which is a VPN between a Juniper VPN device and a PC client running the IPsec software), the initiator is always the PC and the responder is the Juniper VPN device.

On the responder VPN device, perform the following actions:

VPN status messages are written to the daemon facility at the "info" level. If your configuration is using the default system syslog configuration, which is "critical," the "info" VPN status messages will not be captured and viewable with show system syslog.

Therefore, perform these steps on the responder side to capture the "info" VPN status messages.

1. First, configure a new syslog file, kmd-logs, which matches on the uppercase text KMD.

# set system syslog file kmd-logs daemon info
# set system syslog file kmd-logs match KMD
# commit

Note: The filename is kmd-logs; it is important that you do not name the file kmd, because the IKE debugs are written to the file kmd.

2. Then attempt to bring the VPN tunnel up again (so that the VPN status messages are logged to kmd-logs).

3. View the VPN status messages with the following command:

> show log kmd-logs

The file kmd-logs is written to the /var/log directory. 

---

Example VPN status message

Jul 10 16:14:00  210-2 kmd[52472]: IKE Phase-2: Failed to match the peer proxy IDs [p2_remote_proxy_id=ipv4_subnet(any:0,[0..7]=192.168.2.0/24), p2_local_proxy_id=ipv4_subnet(any:0,[0..7]=10.10.10.0/24)] for local ip: 2.2.2.1, remote peer ip:2.2.2.2

---

 

To enable VPN (IKE/IPsec) traceoptions only for specific Security Associations (SAs), refer to KB19943 - How to enable VPN (IKE/IPsec) traceoptions for specific SAs (Security Associations).

For information on how to analyze these IKE/IPsec messages, refer to:

• KB10101 - [SRX] How to troubleshoot IKE Phase 1 VPN connection issues

• KB10099 - [SRX] How to troubleshoot IKE Phase 2 VPN connection issues

 

 

2020-03-20: Article reviewed for accuracy; no changes required.

2020-05-05: fixed broken link.

2021-01-20: Added link to article on per-tunnel debug and responder/initiator differentiation