Mobile Access VPN connections are handled by the cvpnd (Check Point VPN Daemon) process. To debug connection establishment issues, the logging level for this daemon must be increased. This is achieved by editing its Apache-style configuration file located at $CVPNDIR/conf/httpd.conf. Changing the LogLevel directive from its default (e.g., warn) to debug enables verbose logging. The changes are then applied by restarting the Mobile Access daemon using the cvpnrestart command. The resulting detailed logs can be found in $CVPNDIR/log/cvpnd.elg, providing insight into the tunnel establishment process.

A. run vpn debug truncon

This command enables debugging for the IKE daemon (vpnd) and is used specifically for troubleshooting IPsec Site-to-Site VPN tunnels, not Mobile Access SSL VPN.

B. in the file $VPNDIR/conf/httpd conf change the line Loglevel To LogLevel debug and run vpn restart

This option refers to the incorrect directory ($VPNDIR) and daemon (vpnd), which are associated with IPsec VPN, not the Mobile Access (cvpnd) daemon.

D. run fw ctl zdebug -m sslvpn all

fw ctl zdebug is a low-level kernel debug utility. While it can be used for advanced troubleshooting of packet flow, it is not the primary or standard method for debugging application-level SSL VPN tunnel establishment logic, which is handled by the cvpnd user-space process.

---

1. Check Point Support Center, SK Article sk65395: "How to debug Mobile Access blade". This document explicitly outlines the procedure for debugging the cvpnd daemon. It states: "To enable debugs for CVPND daemon, edit the $CVPNDIR/conf/httpd.conf file... Change the line LogLevel warn to LogLevel debug... Save the changes and restart the CVPND daemon: [Expert@HostName]# cvpnrestart". This directly validates option C.

2. Check Point Support Center, SK Article sk112334: "Mobile Access Debugging". This article provides a comprehensive guide to debugging Mobile Access. In the "CVPND" section, it confirms that cvpnd is the main Mobile Access process and that its logs are controlled via the $CVPNDIR/conf/httpd.conf file, reinforcing the method described in option C.

3. Check Point Support Center, SK Article sk104498: "How to debug VPN". This article details various VPN debugging commands. It lists vpn debug truncon under the "Site-to-Site VPN debug" section, confirming that this command (Option A) is not for Mobile Access. It also clarifies that the $VPNDIR directory and vpn commands (Option B) pertain to the IKE daemon for IPsec.