> Source: [sk38892](https://support.checkpoint.com/results/sk/sk38892)

# sk38892 - How can I troubleshoot Cisco to Check Point VPN

| Property | Value |
|----------|-------|
| Solution ID | sk38892 |
| Date Created | 2009-04-14 |
| Last Modified | 2017-01-22 |
| Technical Level | General |

## Solution

When troubleshooting Cisco to Check Point VPN's, it is often necessary to verify and collect debug information from the Cisco side. Cisco IOS provides debug functionality to collect this information. The Nokia GTAC will sometimes request the Cisco IOS VPN debugs as well as configuration information.

Cisco IOS configuration is best collected as the output of the **show tech-support** command - this will strip out sensitive password information.The Cisco IOS VPN debug commands which are most useful are:

> <br />
>
> **debug crypto map**
>
> **debug crypto engine**
>
> **debug crypto ipsec**
>
> **debug crypto isakmp**
>
> **debug ike all**
>
> **debug ipsec all
> <br />
> <br />
> show ike
> <br />
> <br />
> show ipsec
> <br />
> <br />** **show ipsec full**   
>
> **show statistic ike
> <br />
> <br />
> show statistic ipsec**
>
<br />

Another useful command is

> <br />
>
> **sh crypto isakmp sa**
>
<br />

which will show you the remote side's encryption domain, IKE and IPSEC encryption method, and whether the remote side is trying to tunnel per subnet or host.

It is important to match up both sides of an IPSEC VPN. The above commands should help you do that.

Refer to [KB1353464](https://supportcenter.checkpoint.com/supportcenter/portal/role/supportcenterUser/page/default.psml/media-type/html?action=portlets.SCArticleAction&eventSubmit_doGoviewarticle=&alternateid=kb1353464) to collect debug information from the Check Point side of the VPN.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content