Viewing and Managing Connections

Now that I've discussed how to build some basic types of L2L connections, I'll focus on how to view and manage these connections using some basic show, clear, and debug commands in the following two sections.

Viewing IPsec Data SAs

To view your ISAKMP/IKE Phase 2 data SAs, use the following show command:

Router# show crypto ipsec sa [map crypto_map_name | address |
 identity | interface interface_type_and_#]

If you don't enter any optional parameters, all data SAs are displayed. The address parameter sorts the SAs based on the peers' IP addresses. The identity parameter displays a summarized view. You can qualify what data SAs are displayed with additional parameters: the map parameter allows you to restrict the SAs displayed to the crypto map specified, whereas the interface parameter restricts the displayed SAs to those terminated on the specified interface. The detail parameter also will display send and receive error counter statistics.

Example 17-11 illustrates the use of this command. In this example, the local ident and remote ident specifies the traffic to be protected based on the crypto ACL. The current peer specifies the remote peer's address. The first two #pkts lines specify the number of IPsec packets encapsulated and deencapsulated, encrypted and decrypted, hashed and verified. Below this are the inbound and outbound SAs. Because only ESP is used for the data connections, only two SAs are seen (inbound esp sas and outbound esp sas). In both cases, the SAs are protected by AES-128 and MD5. AH and PCP (compression) are not used and thus no SAs for these exist.

Example 17-11. Using the show crypto ipsec sa Command

r3640# show crypto ipsec sa
interface: Ethernet0/0
 Crypto map tag: mymap, local addr
 protected vrf: (none)
 local ident (addr/mask/prot/port): (
 remote ident (addr/mask/prot/port): (
 current_peer port 500
 PERMIT, flags={origin_is_acl,}
 #pkts encaps: 5, #pkts encrypt: 5, #pkts digest: 5
 #pkts decaps: 5, #pkts decrypt: 5, #pkts verify: 5
 #pkts compressed: 0, #pkts decompressed: 0
 #pkts not compressed: 0, #pkts compr. failed: 0
 #pkts not decompressed: 0, #pkts decompress failed: 0
 #send errors 0, #recv errors 0

 local crypto endpt.:, remote crypto endpt.:
 path mtu 1500, ip mtu 1500
 current outbound spi: 0xED39B285(3979981445)

 inbound esp sas:
 spi: 0x5B5A20FC(1532633340)
 transform: esp-aes esp-md5-hmac ,
 in use settings ={Tunnel, }
 conn id: 3001, flow_id: SW:1, crypto map: mymap
 sa timing: remaining key lifetime (k/sec): (4458063/3572)
 IV size: 16 bytes
 replay detection support: Y
 Status: ACTIVE
 inbound ah sas:
 inbound pcp sas:
 outbound esp sas:
 spi: 0xED39B285(3979981445)
 transform: esp-aes esp-md5-hmac ,
 in use settings ={Tunnel, }
 conn id: 3002, flow_id: SW:2, crypto map: mymap
 sa timing: remaining key lifetime (k/sec): (4458063/3570)
 IV size: 16 bytes
 replay detection support: Y
 Status: ACTIVE
 outbound ah sas:
 outbound pcp sas:


Managing IPsec Data SAs

Whenever you make changes to things such as crypto ACLs, transform sets, and other information related to an entry or entries in a crypto map, any existing data SAs built with this information are not updated automatically; you either have to wait for the data SA to expire, or tear them down manually to be rebuilt with the updated information. To tear down a data SA or SAs manually, use the following command:

Router# clear crypto sa [peer IP_address | map crypto_map_name |
 spi IP_address protocol SPI_# | counters]

If you don't specify any optional parameters, all data SAs are cleared on the router. To clear data SAs used with a specific remote peer, enter the peer parameter. To clear all data SAs associated with a particular crypto map, use the map parameter. To remove a specific SA based on a peer's IP address, data encapsulation protocol (AH or ESP), and SPI number, use the spi parameter. The counters parameter resets the statistical counters displayed in the show crypto ipsec sa command, like the #pkts information shown previously in Example 17-11.

The main debug command used to troubleshoot the setup of data SAs is debug crypto ipsec I'll discuss this command in more depth in Chapter 19, "Troubleshooting Router Connections."

Part I: VPNs

Overview of VPNs

VPN Technologies




Part II: Concentrators

Concentrator Product Information

Concentrator Remote Access Connections with IPsec

Concentrator Remote Access Connections with PPTP, L2TP, and WebVPN

Concentrator Site-to-Site Connections

Concentrator Management

Verifying and Troubleshooting Concentrator Connections

Part III: Clients

Cisco VPN Software Client

Windows Software Client

3002 Hardware Client

Part IV: IOS Routers

Router Product Information

Router ISAKMP/IKE Phase 1 Connectivity

Router Site-to-Site Connections

Router Remote Access Connections

Troubleshooting Router Connections

Part V: PIX Firewalls

PIX and ASA Product Information

PIX and ASA Site-to-Site Connections

PIX and ASA Remote Access Connections

Troubleshooting PIX and ASA Connections

Part VI: Case Study

Case Study


The Complete Cisco VPN Configuration Guide
The Complete Cisco VPN Configuration Guide
ISBN: 1587052040
EAN: 2147483647
Year: 2006
Pages: 178
Authors: Richard Deal © 2008-2020.
If you may any questions please contact us: