> Source: [sk99053](https://support.checkpoint.com/results/sk/sk99053)

# sk99053 - How to debug Mobile Access Web Applications

| Property | Value |
|----------|-------|
| Solution ID | sk99053 |
| Date Created | 2014-04-02 |
| Last Modified | 2025-07-30 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |

## Solution

Introduction
------------

This article provides the necessary steps for debugging Mobile Access Web Applications.

Relevant debugs
---------------

1. Traffic capture of HTTP traffic from the browser on client machine (using Fiddler web debugger).

2. Debug of Mobile Access Web Server on Mobile Access Gateway (debug of HTTPD daemon).

3. Debug of Mobile Access sessions (debug of CVPND daemon).

4. Traffic capture (Trace Logs) of HTTP traffic between the Mobile Access Gateway and the internal web server published with the Mobile Access blade.

5. Traffic capture between the Mobile Access Gateway and the internal web server.

Debug procedure:
----------------

1.

   ### Client machine:

   1. Install [Fiddler web debugger](http://www.telerik.com/download/fiddler) on the Client machine.

   2. Empty the browser cache before starting the debug.

   3. Configure Fiddler to Decrypt HTTPS Traffic [as described here](http://docs.telerik.com/fiddler/configure-fiddler/tasks/DecryptHTTPS).

   4. Enable the relevant debugs on the Mobile Access Gateway (see **Step II** below).

   5. Replicate the issue while connecting to the internal network **through** Mobile Access Gateway.

   6. Stop all debugs - both on Client machine and on Mobile Access Gateway (see **Step II** below).

   7. Configure Fiddler to Decrypt HTTPS Traffic [as described here](http://docs.telerik.com/fiddler/configure-fiddler/tasks/DecryptHTTPS).

   8. Replicate the issue while connecting to the internal network **without** Mobile Access Gateway.

   9. Stop the debugs on Client machine.

   10. Send the Fiddler output files (from **both** replications) to [Check Point Support](http://www.checkpoint.com/services/contact/index.html) for analysis.

   <br />

   <br />

2.

   ### Mobile Access Gateway

   1. Connect to command line on Mobile Access Gateway.

   2. Log in to Expert mode.

   3. Backup the current *$CVPNDIR/conf/httpd.conf* file:

      ***\[Expert@HostName\]# cp $CVPNDIR/conf/httpd.conf $CVPNDIR/conf/httpd.conf_ORIGINAL***
   4. Edit the current *$CVPNDIR/conf/httpd.conf* file:

      ***\[Expert@HostName\]# vi $CVPNDIR/conf/httpd.conf***
   5. To enable debug of the Mobile Access Web Server on Mobile Access Gateway (debug of HTTPD daemon) - change the following in the *$CVPNDIR/conf/httpd.conf* file:

      Change the first line

      from:
      *LogLevel **emerg***

      to:
      *LogLevel **debug***
   6. To enable traffic capture (Trace Logs) of the HTTP traffic between the Mobile Access Gateway and the internal web server published with the Mobile Access blade - change the following in the *$CVPNDIR/conf/httpd.conf* file:

      * **In R76 / R77 / R77.10 and higher:**

        Change this line

        from:
        *CvpnTraceApache **Off***

        to:
        *CvpnTraceApache **On***   
        ***Note: This step is needed only if this parameter is set to 'Off'. Skip this step if it is set to 'On'.***
      * **In R75.40 / R75.40VS / R75.45 / R75.46 / R75.47:**

        Nothing else needs to be changed.
   7. Save the file and exit from Vi editor.

   8. Reload the Mobile Access with the new settings:

      ***\[Expert@HostName\]# cvpnd_admin policy***

      Note: This will gracefully restart the HTTPD daemon without disconnecting existing sessions.
   9. Check the ***$CVPNDIR/log/httpd.log*** file:

      ***\[Expert@HostName\]# tail -f $CVPNDIR/log/httpd.log***

      If debug outputs are not printed, then restart the Mobile Access:

      ***\[Expert@HostName\]# cvpnrestart***

      Note: This will restart both CVPND daemon and HTTPD daemon - all existing connections will be disconnected!
   10. In **R75.40 and higher** , Trace Logs have to be enabled **per users**, with the usernames that logged into the Mobile Access Portal:

       ***\[Expert@HostName\]# cvpnd_admin debug trace users=*UserName_1* ,*UserName_2* ,*UserName_3*,...***
   11. Start the debug of CVPND daemon:

       ***\[Expert@HostName\]# cvpnd_admin debug set TDERROR_ALL_ALL=5***   

   12. Disable SecureXL (if it is currently enabled):

       ***\[Expert@HostName\]# fwaccel stat***   
       ***\[Expert@HostName\]# fwaccel off***   
       ***\[Expert@HostName\]# fwaccel stat***
   13. Start traffic capture on the Mobile Access Gateway:

       ***\[Expert@HostName\]# fw monitor -e "accept;" -o /var/log/fw_monitor.cap***
   14. Enable the relevant Fiddler debugs on the Client machine (see **Step I** above).

   15. Replicate the issue.

   16. Stop the Fiddler debugs on the Client machine.

   17. Stop traffic capture on the Mobile Access Gateway:

       Press CTRL+C
   18. Enable SecureXL (if it was disabled before):

       ***\[Expert@HostName\]# fwaccel stat***   
       ***\[Expert@HostName\]# fwaccel on***   
       ***\[Expert@HostName\]# fwaccel stat***
   19. Stop the debug of CVPND daemon:

       ***\[Expert@HostName\]# cvpnd_admin debug off***
   20. Restore the original *$CVPNDIR/conf/httpd.conf* file:

       ***\[Expert@HostName\]# cp $CVPNDIR/conf/httpd.conf $CVPNDIR/conf/httpd.conf_DEBUG***
       ***\[Expert@HostName\]# cp $CVPNDIR/conf/httpd.conf_ORIGINAL $CVPNDIR/conf/httpd.conf***
   21. Reload the Mobile Access with the original settings:

       ***\[Expert@HostName\]# cvpnd_admin policy***
       Note: This will gracefully restart the HTTPD daemon without disconnecting existing sessions.
   22. Check the ***$CVPNDIR/log/httpd.log*** file:

       ***\[Expert@HostName\]# tail -f $CVPNDIR/log/httpd.log***

       If debugs output are still being printed, then restart the Mobile Access:

       ***\[Expert@HostName\]# cvpnrestart***
       Note: This will restart both CVPND daemon and HTTPD daemon - all existing connections will be disconnected!
   23. Send the following files from Mobile Access Gateway to [Check Point Support](http://www.checkpoint.com/services/contact/index.html) for analysis:

       * ***/var/log/fw_monitor.cap***

       * ***$CVPNDIR/log/httpd.log\****

       * ***$CVPNDIR/log/cvpnd.elg\****

       * The entire directory ***$CVPNDIR/log/trace_log/***

       * **CPinfo file** from Mobile Access Gateway (use the latest version of CPinfo utility from [sk92739](http://supportcontent.checkpoint.com/solutions?id=sk92739))

       * In addition, **CPinfo file** from the involved Security Management Server / Domain Management Server (use the latest version of CPinfo utility from [sk92739](http://supportcontent.checkpoint.com/solutions?id=sk92739))

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content