Hello JRussell, On the Palo Alto firewall, you monitor ikemgr.log while phase-2 is negotiating. For that you would need to setup the ike daemon to 'debug' level and tail follow the log. > debug ike global on debug (make sure you give this command twice to make sure that the daemon logging is set at debug level rather than info level ) ************************************** > debug ike global on debug sw.ikedaemon.debug.global: normal > debug ike global on debug sw.ikedaemon.debug.global: debug ************************************** Once that is done, you can execute the following command: > tail follow yes mp-log ikemgr.log 2014-06-19 14:34:16.194 -0500 ikemgr: panike_daemon phase 1 finished with status 1 2014-06-19 14:34:22.829 -0500 ikemgr: panike_daemon phase 2 started 2014-06-19 14:34:22.829 -0500 pan IKE cfg phase-2 triggered. 2014-06-19 14:34:22.829 -0500 pan IKE cfg phase-2 triggered when not necessary, skipped. 2014-06-19 14:34:22.829 -0500 ikemgr: panike_daemon phase 2 finished 2014-06-20 10:51:19 [INFO]: panike_debug_level_cb 4 => 5 2014-06-20 10:51:20.603 -0500 debug: ifmon_request_put(daemon/panike_sysd_if.c:916): 16 write to pipe: debug_level 2014-06-20 10:51:20.603 -0500 debug: ifmon_request_get(daemon/panike_sysd_if.c:932): 16 read from pipe, msg type 1 . , . . and so forth.... To turn off the debugging: > debug ike global on normal sw.ikedaemon.debug.global: debug The following document helps troubleshooting VPN scenarios: How to Troubleshoot VPN Connectivity Issues Hope that gets your started! Thanks and regards, Kunal Adak
... View more
