SRX

Is it possible using IKE traceoptions or IKE debug to see which proposal options a peer is attempting to negotiate phase1 with?

I'd like to have someone configure an ASA with "random" proposals and see if I can debug/trace what those are and create the appropriate config. Unless I'm missing something though, flag all and/or ike debug do not show this.

Hello, if you have configured traceoptions, you can check log kmd.(show log kmd).

I've done this, and debug. But it doesn't actually show which proposal the peer sent, just that there is a mismatch.

You can pump up the debug level:

Non-traceoptions way (if you have a new enough JUNOS, I don't remember when this became possible):

> request security ike debug-enable level 15 local <local> remote <remote>

This dumps into kmd log.

Using traceoptions:

# set security ike traceoptions file ike-debug size 10m files 2
# set security ike traceoptions flag all
# set security ike traceoptions level 15

This will put the logs into the ike-debug file and keep it separate from kmd.