Downloads |
Table Of Contents
Prerequisites for IP Security VPN Monitoring
Restrictions for IP Security VPN Monitoring
Information About IPSec VPN Monitoring
Summary Listing of Crypto Session Status
Syslog Notification for Crypto Session Up or Down Status
IKE and IPSec Security Exchange Clear Command
How to Configure IP Security VPN Monitoring
Adding the Description of an IKE Peer
Configuration Examples for IP Security VPN Monitoring
show crypto session Command Output: Examples
IP Security VPN Monitoring
The IP Security VPN Monitoring feature provides VPN session monitoring enhancements that will allow you to troubleshoot the Virtual Private Network (VPN) and monitor the end-user interface. Session monitoring enhancements include the following:
•
Ability to specify an Internet Key Exchange (IKE) peer description in the configuration file
•
•
•
Feature History for IP Security VPN Monitoring
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•
•
•
•
•
Prerequisites for IP Security VPN Monitoring
•
•
Restrictions for IP Security VPN Monitoring
•
Information About IPSec VPN Monitoring
To troubleshoot the IPSec VPN and monitor the end-user interface, you should understand the following concepts:
•
•
•
Background: Crypto Sessions
A crypto session is a set of IPSec connections (flows) between two crypto endpoints. If the two crypto endpoints use IKE as the keying protocol, they are IKE peers to each other. Typically, a crypto session consists of one IKE security association (for control traffic) and at least two IPSec security associations (for data traffic—one per each direction). There may be duplicated IKE security associations (SAs) and IPSec SAs or duplicated IKE SAs or IPSec SAs for the same session in the duration of rekeying or because of simultaneous setup requests from both sides.
Per-IKE Peer Description
The Per-IKE Peer Description function allows you to enter a description of your choosing for an IKE peer. (Before Cisco IOS Release 12.3(4)T, you could use only the IP address or fully qualified domain name [FQDN] to identify the peer; there was no way to configure a description string.) The unique peer description, which can include up to 80 characters, can be used whenever you are referencing that particular IKE peer. To add the peer description, use the description command.
Note
The primary application of this description field is for monitoring purposes (for example, when using show commands or for logging [syslog messages]). The description field is purely informational (for example, it cannot act as a substitute for the peer address or FQDN when defining crypto maps).
Summary Listing of Crypto Session Status
You can get a list of all the active VPN sessions by entering the show crypto session command. The listing will include the following:
•
•
•
•
Multiple IKE or IPSec SAs may be established for the same peer (for the same session), in which case IKE peer descriptions will be repeated with different values for the IKE SAs that are associated with the peer and for the IPSec SAs that are serving the flows of the session.
You can also use the show crypto session detail variant of this command to obtain more detailed information about the sessions.
Syslog Notification for Crypto Session Up or Down Status
The Syslog Notification for Crypto Session Up or Down Status function provides syslog notification every time the crypto session comes up or goes down.
The following is a sample syslog notification showing that a crypto session is up:
%CRYPTO-5-SESSION_STATUS: Crypto session is UP. Peer 10.6.6.1:500 fvrf=name10 ivrf=name20 Description: SJC24-2-VPN-Gateway Id: 10.5.5.2The following is a sample syslog notification showing that a crypto session is down:
%CRYPTO-5-SESSION_STATUS: Crypto session is DOWN. Peer 10.6.6.1:500 fvrf=name10 ivrf=name20 Description: SJC24-2-VPN-Gateway Id: 10.5.5.2IKE and IPSec Security Exchange Clear Command
In previous IOS versions, there was no single command to clear both IKE and IPSec connections (that is, SAs). Instead, you had to use the clear crypto isakmp command to clear IKE and the clear crypto ipsec command to clear IPSec. The new clear crypto session command allows you to clear both IKE and IPSec with a single command. To clear a specific crypto session or a subset of all the sessions (for example, a single tunnel to one remote site), you need to provide session-specific parameters, such as a local or remote IP address, a local or remote port, a front door VPN routing and forwarding (FVRF) name, or an inside VRF (IVRF) name. Typically, the remote IP address will be used to specify a single tunnel to be deleted.
If a local IP address is provided as a parameter when you use the clear crypto session command, all the sessions (and their IKE SAs and IPSec SAs) that share the IP address as a local crypto endpoint (IKE local address) will be cleared. If you do not provide a parameter when you use the clear crypto session command, all IPSec SAs and IKE SAs that are in the router will be deleted.
How to Configure IP Security VPN Monitoring
See the following sections for configuration tasks for this feature. Each task in the list is identified as either required or optional.
•
•
•
Adding the Description of an IKE Peer
To add the description of an IKE peer to an IPSec VPN session, perform the following steps.
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Verifying Peer Descriptions
To verify peer descriptions, use the show crypto isakmp peer command.
SUMMARY STEPS
1.
2.
DETAILED STEPS
Examples
The following output example verifies that the description "connection from site A" has been added for IKE peer 10.2.2.9:
Router# show crypto isakmp peerPeer: 10.2.2.9 Port: 500Description: connection from site Aflags: PEER_POLICYWhen the peer at address 10.2.2.9 connects and the session comes up, the syslog status will be shown as follows:
%CRYPTO-5-SESSION_STATUS: Crypto tunnel is UP. Peer 10.2.2.9:500 Description: connection from site A Id: ezvpnClearing a Crypto Session
To clear a crypto session, use the clear crypto session command from the router command line. No configuration statements are required in the configuration file to use this command.
SUMMARY STEPS
1.
2.
DETAILED STEPS
Configuration Examples for IP Security VPN Monitoring
This section provides the following configuration example:
•
show crypto session Command Output: Examples
The following is sample output for the show crypto session output without the detail keyword:
Router# show crypto sessionCrypto session current statusInterface: FastEthernet0/1Session status: UP-ACTIVEPeer: 172.0.0.2/500IKE SA: local 172.0.0.1/500 remote 172.0.0.2/500 ActiveIPSEC FLOW: permit ip 10.10.10.0/255.255.255.0 10.30.30.0/255.255.255.0Active SAs: 2, origin: crypto mapThe following is sample output using the show crypto session command and the detail keyword:
Router# show crypto session detailInterface: Tunnel0Session status: UP-ACTIVEPeer: 10.1.1.3 port 500 fvrf: (none) ivrf: (none)Desc: this is my peer at 10.1.1.3:500 GreenPhase1_id: 10.1.1.3IKE SA: local 10.1.1.4/500 remote 10.1.1.3/500 ActiveCapabilities:(none) connid:3 lifetime:22:03:24IPSEC FLOW: permit 47 host 10.1.1.4 host 10.1.1.3Active SAs: 0, origin: crypto mapInbound: #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0IPSEC FLOW: permit ip host 10.1.1.4 host 10.1.1.3Active SAs: 4, origin: crypto mapInbound: #pkts dec'ed 4 drop 0 life (KB/Sec) 4605665/2949Outbound: #pkts enc'ed 4 drop 1 life (KB/Sec) 4605665/2949Additional References
The following sections provide references related to IP Security VPN Monitoring.
Related Documents
IP security, encryption, and IKE
"IP Security and Encryption" section of the Cisco IOS Security Configuration Guide
Security commands
Cisco IOS Security Command Reference, Release 12.3 T
Standards
MIBs
RFCs
Technical Assistance
Command Reference
This section documents new commands. All other commands used with this feature are documented in the Cisco IOS Release 12.3 T command reference publications.
New Commands
•
•
•
•
clear crypto session
To delete crypto sessions (IP Security [IPSec] and Internet Key Exchange [IKE] security associations [SAs]), use the clear crypto session command in privileged EXEC mode.
clear crypto session [local ip-address [port local-port]] [remote ip-address [port remote-port]] | [fvrf vrf-name] [ivrf vrf-name]
Syntax Description
Defaults
If the clear crypto session command is entered without any keywords, all existing sessions will be deleted. The IPSec SAs will be deleted first, then the IKE SAs. Port default values are 500.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
To clear a specific crypto session or a subset of all the sessions, you need to provide session-specific parameters, such as a local or remote IP address, a local or remote port, a FVRF name, or an IVRF name.
If a local IP address is provided as a parameter when you use the clear crypto session command, all the sessions (and their IKE SAs and IPSec SAs) that share the IP address as a local crypto endpoint (IKE local address) will be deleted.
Examples
The following example shows that all crypto sessions will be deleted:
Router# clear crypto sessionThe following example shows that the crypto session of the FVRF named "blue" will be deleted:
Router# clear crypto session fvrf blueThe following example shows that the crypto sessions of the FVRF "blue" and the IVRF session "green" will be deleted:
Router# clear crytpo session fvrf blue ivrf greenThe following example shows that the crypto sessions of the local endpoint 10.1.1.1 and remote endpoint 10.2.2.2 will be deleted. The local endpoint port is 5, and the remote endpoint port is 10.
Router# clear crypto session local 10.1.1.1 port 5 remote 10.2.2.2 port 10Related Commands
description (isakmp peer)
To add the description of an Internet Key Exchange (IKE) peer, use the description command in ISAKMP peer configuration mode. To delete the description, use the no form of this command.
description line-of-description
no description line-of-description
Syntax Description
Defaults
No default behavior or values
Command Modes
ISAKMP peer configuration
Command History
Usage Guidelines
IKE peers that "sit" behind a Network Address Translation (NAT) device cannot be uniquely identified; therefore, they have to share the same peer description.
Examples
The following example shows that the description "connection from site A" has been added for an IKE peer:
Router# crypto isakmp peer address 10.2.2.9Router (config-isakmp-peer)# description connection from site ARelated Commands
show crypto isakmp peer
To display peer descriptions, use the show crypto isakmp peer command in privileged EXEC mode.
show crypto isakmp peer
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Examples
The following output example shows information about the peer named "This-is-another-peer-at-10-1-1-3":
Router# show crypto isakmp peerPeer: 10.1.1.3 Port: 500Description: This-is-another-peer-at-10-1-1-3Phase1 id: 10.1.1.3Table 1 describes the significant fields shown in the display.
Table 1 show crypto isakmp peer Field Descriptions
Phase1 id
Internet Key Exchange (IKE) ID
Related Commands
show crypto session
To display status information for active crypto sessions, use the show crypto session command in privileged EXEC mode.
show crypto session [detail] | [local ip-address [port local-port] [remote ip-address [port remote-port]] [detail]] | [fvfr vrf-name] [ivrf vrf-name] [detail]
Syntax Description
Defaults
If the show crypto session command is entered without any keywords, all existing sessions will be displayed. Port default values are 500.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
You can get a list of all the active Virtual Private Network (VPN) sessions and of the IKE and IPSec SAs for each VPN session by entering the show crypto session command. The listing will include the following:
•
•
•
•
Multiple IKE or IPSec SAs may be established for the same peer (for the same session), in which case IKE peer descriptions will be repeated with different values for the IKE SAs that are associated with the peer and for the IPSec SAs that are serving the flows of the session.
Examples
The following example shows active VPN sessions:
Router# show crypto session detailCrypto session current statusCode: C - IKE Configuration mode, D - Dead Peer DetectionK - Keepalives, N - NAT-traversal, X - IKE Extended AuthenticationInterface: Ethernet1/0Session status: UP-NO-IKEPeer: 10.2.80.179/500 fvrf: (none) ivrf: (none)Desc: My-manual-keyed-peerPhase1_id: 10.2.80.179IPSEC FLOW: permit ip host 10.2.80.190 host 10.2.80.179Active SAs: 4, origin: manual-keyed crypto mapInbound: #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0Interface: Ethernet1/2Session status: DOWNPeer: 10.1.1.1/500 fvrf: (none) ivrf: (none)Desc: SJC24-2-VPN-GatewayPhase1_id: 10.1.1.1IPSEC FLOW: permit ip host 10.2.2.3 host 10.2.2.2Active SAs: 0, origin: crypto mapInbound: #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0IPSEC FLOW: permit ip 10.2.0.0/255.255.0.0 10.4.0.0/255.255.0.0Active SAs: 0, origin: crypto mapInbound: #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0Interface: Serial2/0.17Session status: UP-ACTIVEPeer: 10.1.1.5/500 fvrf: (none) ivrf: (none)Desc: (none)Phase1_id: 10.1.1.5IKE SA: local 10.1.1.5/500 remote 10.1.1.5/500 ActiveCapabilities:(none) connid:1 lifetime:00:59:51IPSEC FLOW: permit ip host 10.1.1.5 host 10.1.2.5Active SAs: 2, origin: dynamic crypto mapInbound: #pkts dec'ed 4 drop 0 life (KB/Sec) 20085/171Outbound: #pkts enc'ed 4 drop 0 life (KB/Sec) 20086/171Table 2 describes the significant fields shown in the display.
Table 2 show crypto isakmp peer Field Descriptions
Interface
Interface to which the crypto session is related.
Session status
Current status of the crypto (VPN) sessions. See Table 3 for the status of the IKE SA, IPSec SA, and tunnel as shown in the display.
IKE SA
Information is provided about the IKE SA, such as local and remote address and port, SA status, SA capabilities, crypto engine connection ID, and remaining lifetime of the IKE SA.
IPSEC FLOW
A snapshot of information about the IPSec-protected traffic flow, such as what the flow is (for example, "permit ip host 10.1.1.5 host 10.1.2.5); how many IPSec SAs there are; the origin of the SA, such as manual keyed, dynamic, or static crypto map; the number of encrypted or decrypted packets or dropped packets; and the IPSec SA remaining lifetime in kilobytes per second.
Table 3 provides an explanation of the current status of the VPN sessions shown in the display.
Note
Related Commands
clear crypto session
Deletes crypto sessions (IPSec and IKE SAs).
description
Adds a description for an IKE peer.
show crypto isakmp peer
Displays peer descriptions.
Copyright © 2003 Cisco Systems, Inc. All rights reserved.
