> Source: [sk62482](https://support.checkpoint.com/results/sk/sk62482) # sk62482 - How to debug VPN issues on Spark Firewall | Property | Value | |----------|-------| | Solution ID | sk62482 | | Date Created | 2011-04-18 | | Last Modified | 2026-05-24 | | Technical Level | General | | Products | Spark Firewall (Locally Managed) | | Versions | R82.00.X, R81.10.X | | Platform | 1570R, 1575R, 1500, 1900, 2000, 1600, 1800, 1595R, 2500, 910 | ## Solution Follow the VPN debug procedure for your version. VPN Debug procedure on Quantum Spark versions R81.10.x and Higher ----------------------------------------------------------------- Show / Hide this section For information about the R81.10.x versions, refer to [sk179615: Quantum Spark Appliances - Releases R81.10.X](https://support.checkpoint.com/results/sk/sk179615). There are two possible procedures - simplified and advanced. ### Simplified Debug: {#Toggle_R81_10_x} Use the simplified debug for simple issues. For example, a Site-to-Site VPN tunnel does not start. > Show / Hide this section > 1. Connect to WebUI and log in. > > 2. From the left navigation panel, click the **Device** view. > > 3. In the **System** section, click the **Tools** page. > > 4. Start the traffic capture: > > 1. Click the **Tcpdump Tool** button. > > 2. In the top left field, leave the default option **All Interfaces**. > > 3. In the bottom left corner, click the **Start** button. > > 4. In the top right corner, click **x** to close to close the **Tcpdump Tool** window. > > 5. Start the VPN debug: > > 1. Click the **VPN Debug Tool** button. > > 2. Click the **Start Debugging** button. > > **Important** - Do **not** close this popup window. > 6. Replicate the issue or wait for the issue to occur. > > **Make sure the problem was replicated.** > 7. Stop the VPN debug: > > 1. Click the **Stop Debugging** button. > > 2. Click the **Download File** button. > > 3. Your web browser downloads the file with this name: > > `vpn_.tgz` > > Example for 2023 Feb 05 at 11h 39m: > > `vpn_20230251139.tgz` > 4. In the top right corner, click **x** to close the **VPN Debug Tool** window. > > 8. Stop the traffic capture: > > 1. On the **Tools** page, click the **Tcpdump Tool** button. > > 2. In the bottom left corner, click the **Stop** button. > > 3. In the bottom left corner, click the **Download File** button. > > 4. Your web browser downloads the file with this name: > > `pkt_cap_.cap` > > Example for 2023 Feb 05 at 11h 39m: > > `pkt_cap_20230251139.cap` > 5. In the top right corner, click **x** to close to close the **Tcpdump Tool** window. > > 9. In WebUI, generate the CPInfo File: > > 1. From the left navigation panel, click the **Device** view. > > 2. In the **System** section, click the **Tools** page. > > 3. Click the **Generate CPInfo File** button. > > 4. Click the **Download CPInfo File** button. > > 5. Your web browser downloads the file with this name: > > `R_.cpinfo.gz` > > Example from R81.10.00 Build 05996001092 on Feb 05 at 11h 46m: > > `R81.10.0005996001092_02051146.cpinfo.gz` > 10. Send these files to [Check Point Support](https://www.checkpoint.com/support-services/contact-support/) from your computer (default folder for downloads): > > |---|------------------------------------------|---------------------------------------------------------------------------------------------------------| > | # | File | Description | > | A | `vpn_.tgz` | VPN debug that contains these files: * `ike.elg` ( debug) * `iked.elg` ( debug) * `ikev2.xmll` ( debug) | > | B | `pkt_cap_.cap` | Traffic capture | > | C | `R_.cpinfo.gz` | CPinfo file | ### Advanced Debug: Use the advanced debug for complicated issues. For example, only some traffic is encrypted. > Show / Hide this section > 1. Connect to the command line on the Quantum Spark Appliance. > > 2. Log in to the Expert mode: > > `expert` > 3. In CLI, start the VPN debug and redirect the output to a specific file: > > 1. `sfwd_stop` > > 2. `fw -d sfwd >& /storage/sfwd_vpn_dbg.elg &` > > 3. `sleep 5` > > 4. `fw debug sfwd on TDERROR_ALL_VPN=5` > > 5. `fw debug sfwd on TDERROR_ALL_SFWD=5` > > 4. In CLI, start the IKE debug: > > `vpn debug trunc ALL=5` > 5. In WebUI, start the traffic capture: > > 1. From the left navigation panel, click the **Device** view. > > 2. In the **System** section, click the **Tools** page. > > 3. Click the **Tcpdump Tool** button. > > 4. In the top left field, leave the default option **All Interfaces**. > > 5. In the bottom left corner, click the **Start** button. > > 6. Replicate the issue, or wait for the issue to occur. > > **Make sure the problem was replicated.** > 7. In WebUI, stop the traffic capture: > > 1. In the bottom left corner, click the **Stop** button. > > 2. In the bottom left corner, click the **Download File** button. > > 3. Your web browser downloads the file with this name: > > `pkt_cap_.cap` > > Example for 2023 Feb 05 at 11h 39m: *pkt_cap_20230251139.cap* > 4. Close the **TCPDUMP TOOL** window. > > 8. In CLI, stop the VPN debug and restart the SFWD in normal mode: > > 1. `fw debug sfwd off` > > 2. `vpn debug ikeoff` > > 3. `ps -ef | grep '[f]w -d sfwd' | awk '{print $2}' | xargs kill` > 4. `sfwd_restart` > 9. In WebUI, generate the CPInfo File: > > 1. From the left navigation panel, click the **Device** view. > > 2. In the **System** section, click the **Tools** page. > > 3. Click the **Generate CPInfo File** button. > > 4. Click the **Download CPInfo File** button. > > 5. Your web browser downloads the file with this name: > > `R._.cpinfo.gz` > > Example from R81.10 Build 05996001092 on Feb 05 at 11h 46m: *R81.10.05996001092_02051146.cpinfo.gz* > 10. Send these files to [Check Point Support](https://www.checkpoint.com/support-services/contact-support/): > > **Important** - To copy files to and from a Quantum Spark (SMB) Appliance over SCP, follow [sk52763](https://support.checkpoint.com/results/sk/sk52763). > * In versions R81.10.10 and higher: > > |---|-------------------------------------------|-----------------|----------------------------------------------| > | # | File | Description | Location | > | A | `/storage/sfwd_vpn_dbg.elg` | VPN main debug | Appliance | > | B | `$FWDIR/log/ike?.elg*` | IKEv1 debug | Appliance | > | C | `$FWDIR/log/iked?.elg*` | IKEv1 debug | Appliance | > | D | `$FWDIR/log/ikev2.xmll*` | IKEv2 debug | Appliance | > | E | `pkt_cap_.cap` | Traffic capture | Your computer (default folder for downloads) | > | F | `R._.cpinfo.gz` | CPinfo file | Your computer (default folder for downloads) | > > * In versions R81.10.00 - R81.10.08: > > |---|-------------------------------------------|-----------------|----------------------------------------------| > | # | File | Description | Location | > | A | `/storage/sfwd_vpn_dbg.elg` | VPN main debug | Appliance | > | B | `$FWDIR/log/legacy_ike.elg*` | IKEv1 debug | Appliance | > | C | `??$FWDIR/log/legacy_ikev2.xmll*?` | IKEv2 debug | Appliance | > | D | `pkt_cap_.cap` | Traffic capture | Your computer (default folder for downloads) | > | E | `R._.cpinfo.gz` | CPinfo file | Your computer (default folder for downloads) | VPN Debug procedure on Quantum Spark versions R80.20.x ------------------------------------------------------ Show / Hide this section For information about the R80.20.x versions, refer to [sk165734: Quantum Spark Appliances - Releases R80.20.X](https://support.checkpoint.com/results/sk/sk165734). 1. Connect to the command line on the Quantum Spark (SMB) Appliance. 2. Log in to the Expert mode: `expert` 3. In CLI, start the VPN debug and redirect the output to a specific file: 1. `sfwd_stop` 2. `fw -d sfwd >& /storage/sfwd_vpn_dbg.elg &` 3. `sleep 5` 4. `fw debug sfwd on TDERROR_ALL_VPN=5` 5. `fw debug sfwd on TDERROR_ALL_SFWD=5` 4. In CLI, start the IKE debug: `vpn debug trunc` 5. In WebUI, start the traffic capture: 1. From the left navigation panel, click the **Device** view. 2. In the **System** section, click the **Tools** page. 3. Click the **Tcpdump Tool** button. 4. In the top left field, leave the default option **All Interfaces**. 5. In the bottom left corner, click the **Start** button. 6. Replicate the issue, or wait for the issue to occur. **Make sure the problem was replicated.** 7. In WebUI, stop the traffic capture: 1. In the bottom left corner, click the **Stop** button. 2. In the bottom left corner, click the **Download File** button. 3. Your web browser downloads the file with this name: `pkt_cap_.cap` Example for 2022 Aug 30 at 11h 39m: *pkt_cap_202208301139.cap* 4. Close the **TCPDUMP TOOL** window. 8. In CLI, stop the VPN debug and restart the SFWD in normal mode: 1. `fw debug sfwd off` 2. `vpn debug ikeoff` 3. `sfwd_restart` 9. In WebUI, generate the CPInfo File: 1. From the left navigation panel, click the **Device** view. 2. In the **System** section, click the **Tools** page. 3. Click the **Generate CPInfo File** button. 4. Click the **Download CPInfo File** button. 5. Your web browser downloads the file with this name: `R._.cpinfo.gz` Example from R80.20.50 Build 992002773 on Aug 30 at 11h 46m: *R80.20.992002773_08301146.cpinfo.gz* 10. Send these files to [Check Point Support](https://www.checkpoint.com/support-services/contact-support/): **Important** - To copy files to and from a Quantum Spark (SMB) Appliance over SCP, follow [sk52763](https://support.checkpoint.com/results/sk/sk52763). |---|-------------------------------------------|-----------------|----------------------------------------------| | # | File | Description | Location | | A | `/storage/sfwd_vpn_dbg.elg` | VPN main debug | Appliance | | B | `/tmp/log/ike.elg` | IKEv1 debug | Appliance | | C | `/tmp/log/ikev2.xmll` | IKEv2 debug | Appliance | | D | `pkt_cap_.cap` | Traffic capture | Your computer (default folder for downloads) | | E | `R._.cpinfo.gz` | CPinfo file | Your computer (default folder for downloads) | VPN Debug procedure on SMB versions R77.20.x -------------------------------------------- Show / Hide this section For information about the R77.20.x versions, refer to [sk97766: Small and Medium Business Appliances - Releases R77.20.X](https://support.checkpoint.com/results/sk/sk97766). 1. Connect to the command line on the SMB Appliance. 2. Log in to the Expert mode: `expert` 3. In CLI, start the VPN debug and redirect the output to a specific file: 1. `sfwd_stop` 2. `fw -d sfwd >& /storage/sfwd_vpn_dbg.elg &` 3. `sleep 5` 4. `fw debug sfwd on TDERROR_ALL_VPN=5` 5. `fw debug sfwd on TDERROR_ALL_SFWD=5` 4. In CLI, start the IKE debug: `vpn debug trunc` 5. In WebUI, start the traffic capture: 1. From the left navigation panel, click the **Device** view. 2. In the **System** section, click the **Tools** page. 3. Click the **Capture packets** button. 4. From the **Select Network** list, select the applicable option. 5. In the bottom left corner, click the **Start** button. 6. Replicate the issue or wait for the issue to occur. **Make sure the problem was replicated.** 7. In WebUI, stop the traffic capture: 1. In the bottom left corner, click the **Stop** button. 2. In the bottom left corner, click the **Download File** button. 3. Your web browser downloads the file with this name: `pkt_cap_.cap` Example for 2019 Feb 05 at 11h 39m: *pkt_cap_20190251139.cap* 4. Close the traffic capture window. 8. In CLI, stop the VPN debug and restart the SFWD in normal mode: 1. `fw debug sfwd off` 2. `vpn debug ikeoff` 3. `sfwd_restart` 9. In WebUI, generate the CPInfo File: 1. From the left navigation panel, click the **Device** view. 2. In the **System** section, click the **Tools** page. 3. Click the **Generate CPInfo File** button. 4. Click the **Download CPInfo File** button. 5. Your web browser downloads the file with this name: `R._.cpinfo.gz` Example from R77.20.85 Build 990172755 on Feb 05 at 11h 46m: *R77.20.990172755_02051146.cpinfo.gz* 10. Send these files to [Check Point Support](https://www.checkpoint.com/support-services/contact-support/): **Important** - To copy files to and from a Quantum Spark (SMB) Appliance over SCP, follow [sk52763](https://support.checkpoint.com/results/sk/sk52763). |---|-------------------------------------------|-----------------|----------------------------------------------| | # | File | Description | Location | | A | `/storage/sfwd_vpn_dbg.elg` | VPN main debug | Appliance | | B | `/tmp/log/ike.elg` | IKEv1 debug | Appliance | | C | `pkt_cap_.cap` | Traffic capture | Your computer (default folder for downloads) | | D | `R._.cpinfo.gz` | CPinfo file | Your computer (default folder for downloads) | --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content