Troubleshooting IPsec Tunnels with NSX-T Edge CLI

Building a cloud with VMware vCloud Director or using NSX-T can sometimes lead to issues with IPsec tunnels. When this happens, the generic error codes displayed by the NSX-T UI can be confusing and make it difficult to diagnose the problem. However, the NSX Edge CLI provides more detailed information about the negotiation process, allowing you to troubleshoot issues more effectively.

In this blog post, we will explore how to use the NSX Edge CLI to enable deep logging for specific sessions, view IKE-negotiation logs, and filter VPN service entries. We will also discuss how to set up a Kubernetes cluster for NSX applications and how to use the integrated load balancer in NSX-T.

Enabling Deep Logging for Specific Sessions

To enable deep logging for specific sessions, you must first connect via SSH to the Edge that is hosting the Service Router of the session you want to troubleshoot. You can do this by searching for the session in the GUI and then clicking on the corresponding Tier-1 Gateway. From there, you can connect as the NSXCLI-User (admin is the default) and check the ipsecvpn-service with:

`show running-config ipsecvpn-service`

If the service is running without any errors, you can further investigate the sessions with these commands:

`show running-config ipsecvpn-session`

`show running-config ipsecvpn-session `

Viewing IKE-Negotiation Logs

To view the IKE-negotiation logs, you must enable inspection for specific sessions. You can do this by using the following command:

`set session-inspection enable`

Then, to view the logs for a specific session, use the following command:

`show running-config ipsecvpn-session `

Filtering VPN Service Entries

To filter VPN service entries, you can use the `follow` key when using the `show running-config` command. For example, to view all VPN service entries for a specific session, use the following command:

`show running-config ipsecvpn-session follow`

You can also append the pipe and `find` key to filter the entries of the VPN service. For example, to view only the successful VPN service entries for a specific session, use the following command:

`show running-config ipsecvpn-session follow | find “successful”‘

Stopping Deep Logging

To stop deep logging, you can use the `set` command with the `debug-level` option set to `off`. For example:

`set debug-level off`

Setting Up a Kubernetes Cluster for NSX Applications

VMware has deprecated the old NSX-T 3 way of setting SSL certificates for the management cluster using the cluster/api-certificate API call. Instead, you can use the `set-cluster-ssl-certificate` command to set the SSL certificate for the management cluster. For example:

`set-cluster-ssl-certificate –cluster –certificate `

Using the NSX-T Integrated Load Balancer

The NSX-T integrated load balancer is a great way to quickly and cheaply integrate a highly-available load balancer solution into your environment. To configure the load balancer, you can use the `set` command with the `load-balance` option set to `on`. For example:

`set load-balance on`

Conclusion

In this blog post, we have explored how to use the NSX Edge CLI to troubleshoot IPsec tunnels and view IKE-negotiation logs. We have also discussed how to set up a Kubernetes cluster for NSX applications and how to use the integrated load balancer in NSX-T. By using these tools and techniques, you can more effectively troubleshoot issues in your cloud environment and improve the overall performance of your network and applications.