Use Cases for SD-WAN Capabilities in Cisco Secure Firewall

Troubleshoot Umbrella Auto Tunnels

Updated: February 5, 2026

Overview

Provides troubleshooting information for Cisco Umbrella SASE auto tunnel issues, including verifying DNS resolution, SIG tunnel status, routing, and traffic forwarding to restore secure internet access.

After the deployment, use the following CLI to debug issues related to Umbrella auto tunnels on Secure Firewall Threat Defense.

Note

Proceed with caution when you run debug commands on the threat defense device in production environments.You can set various debug levels on the device that may have verbose outputs.

How to...	CLI Command
Enable conditional debugging for a particular peer	debug crypto condition peer <peer-IP>
Debug the virtual Tunnel interface information	debug vti 255
Debug the IKEv2 protocol related transactions	debug crypto ikev2 protocol 255
Debug the IKEv2 platform related transactions	debug crypto ikev2 platform 255
Debug the common IKE related transactions	debug crypto ike-common 255
Debug the IPSec related transactions	debug crypto ipsec 255

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.