Filter
Top Products
Crypto Show Commands
14-118 Configuring the VPN
Crypto Show Commands
show crypto ipsec sa
ThiscommanddisplayscurrentSecurityAssociations(SAs)settings.
Syntax
show crypto ipsec sa [map map-name | address]
Mode
EXECorGlobalconfiguration:XSR> or XSR(config)#
Sample Output
ThefollowingissampleoutputwhenNATisnot presentbetweenthecryptoendpoints.Thefirst
sectionistheinboundSA,andthesecondsection,theoutboundSA.TheUDPportfollowthethe
IPaddressforcryptoendpointswhenaNATispresent.
XSR#show crypto ipsec sa
10.1.1.2/32, UDP, 1701 ==> 10.2.1.34/32, UDP, 1701 : 71 packets
ESP: SPI=f5ae2b52, Transform=3DES/HMAC-SHA, Life=3575S/249929KB
Local crypto endpt.=10.2.1.34, Remote crypto endpt.=10.1.1.2
Encapsulation=Transport
10.2.1.34/32, UDP, 1701 ==> 10.1.1.2/32, UDP, 1701 : 36 packets
ESP: SPI=5419ec15, Transform=3DES/HMAC-SHA, Life=3575S/249933KB
Local crypto endpt.=10.2.1.34, Remote crypto endpt.=10.1.1.2
Encapsulation=Transport
ThefollowingissampleoutputwhenNATispresentbetweenthecryptoendpoints.Notethat
UDP‐Encapsdisplays,indicatingthatencapsulationisenabledwithaNATpresent.
10.2.1.10/32, UDP, 1701 ==> 10.2.1.34/32, UDP, 1701 : 52 packets
ESP: SPI=40d5e065, Transform=3DES/HMAC-SHA, Life=3589S/249932KB
Local crypto endpt.=10.2.1.34:4500, Remote crypto endpt.=10.2.1.10:41108
Encapsulation=Transport UDP-Encaps
10.2.1.34/32, UDP, 1701 ==> 10.2.1.10/32, UDP, 1701 : 32 packets
ESP: SPI=5c0f6fb5, Transform=3DES/HMAC-SHA, Life=3589S/249934KB
Local crypto endpt.=10.2.1.34:4500, Remote crypto endpt.=10.2.1.10:41108
Encapsulation=Transport UDP-Encaps
Parameter Description
map-name
ShowsanyexistingSAscreatedforthecryptomapsetnamedmap‐name.
address
ShowsallexistingSAs,sortedbythedestinationaddress(eitherthelocaladdress
ortheaddressoftheIPSecremotepeer)andthenbyprotocol(AHorESP).
10.2.1.10/32,UDP,1701 IPaddress,protocol,andprotocolportnumberofthe
sourceACLentryassociatedwiththisSA.
10.2.1.34/32,UDP,1701 IPaddress,protocol,andprotocolportnumberofthe
destinationACLentryassociatedwiththisSA.
52packets NumberofpacketsprocessedbythisSA.