-
Cisco IOS Security Command Reference
-
Introduction
-
aaa accounting through aaa local authentication attempts max-fail
-
aaa nas Cisco-nas-port-use-async-info through alert-severity
-
all (profile map configuration) through browser-proxy
-
ca trust-point through clear eou
-
clear ip access-list counters through crl-cache none
-
crypto aaa attribute list through crypto ipsec transform-set
-
crypto isakmp aggressive-mode disable through crypto mib ipsec flowmib history tunnel size
-
crypto pki authenticate through ctype
-
database archive through dns
-
dnsix-dmdp retries through dynamic
-
E
-
F through H
-
icmp idle-timeout through ip http ezvpn
-
ip inspect through ip security strip
-
ip source-track through issuer-name
-
K through L
-
mac access-group through max-users (WebVPN)
-
message retry count through outgoing
-
parameter through port-misuse
-
ppp accounting through quit
-
radius attribute nas-port-type through rate-limit (firewall)
-
reauthentication time through rsa-pubkey
-
sa ipsec through sessions maximum
-
set aggressive-mode client-endpoint through show class-map type urlfilter
-
show crypto ace redundancy through show crypto vlan
-
show diameter peer through show object-group
-
show parameter-map type inspect through show users
-
show vlan group through switchport port-security violation
-
tacacs-server administration through tms-class
-
traffic-export through zone security
-
Table Of Contents
show crypto call admission statistics
show crypto engine accelerator logs
show crypto engine accelerator ring
show crypto engine accelerator sa-database
show crypto engine accelerator statistic
show crypto ipsec client ezvpn
show crypto ipsec default transform-set
show crypto ipsec security-association lifetime
show crypto ipsec transform-set
show crypto isakmp default policy
show crypto key pubkey-chain rsa
show crypto mib ipsec flowmib endpoint
show crypto mib ipsec flowmib failure
show crypto mib ipsec flowmib global
show crypto mib ipsec flowmib history
show crypto mib ipsec flowmib history failure size
show crypto mib ipsec flowmib history tunnel size
show crypto mib ipsec flowmib spi
show crypto mib ipsec flowmib tunnel
show crypto mib ipsec flowmib version
show crypto mib isakmp flowmib failure
show crypto mib isakmp flowmib global
show crypto mib isakmp flowmib history
show crypto mib isakmp flowmib peer
show crypto mib isakmp flowmib tunnel
show crypto pki certificates storage
show crypto pki server certificates
show crypto pki server requests
show crypto ace redundancy
To display information about a Blade Failure Group, use the show crypto ace redundancy command in privileged EXEC mode.
show crypto ace redundancy
Defaults
No default behavior or values.
Command Modes
Privileged EXEC
Command History
Examples
The following example shows information about a Blade Failure Group that has a group ID of 1 and consists of two IPSec VPN SPAs—one IPSec VPN SPA is in slot 3, subslot 0 and one IPSec VPN SPA is in slot 5, subslot 0:
Router# show crypto ace redundancy--------------------------------------LC Redundancy Group ID :1Pending Configuration Transactions:0Current State :OPERATIONALNumber of blades in the group :2Slots--------------------------------------Slot:3 Subslot:0Slot state:0x36BootedReceived partner configCompleted Bulk SynchronizationCrypto Engine in ServiceRebooted 22 timesInitialization Timer not runningSlot:5 Subslot:0Slot state:0x36BootedReceived partner configCompleted Bulk SynchronizationCrypto Engine in ServiceRebooted 24 timesInitialization Timer not runningACE B2B Group State:OPERATIONAL Event:BULK DONEACE B2B Group State:CREATED Event:CONFIG_DOWNLOAD_DONEACE B2B Group State:DELETED Event:CONFIG_DELETEACE B2B Group State:OPERATIONAL Event:BULK DONEACE B2B Group State:CREATED Event:CONFIG_DOWNLOAD_DONEACE B2B Group State:DELETED Event:CONFIG_DELETEACE B2B Group State:OPERATIONAL Event:CONFIG_DOWNLOAD_DONEACE B2B Group State:DELETED Event:CONFIG_ADDACE B2B Group State:CREATED Event:UNDEFINED B2B HA EVENTACE B2B Group State:CREATED Event:CONFIG_DOWNLOAD_DONERelated Commands
show crypto ca certificates
Note
This command was replaced by the show crypto pki certificates command effective with Cisco IOS Release 12.3(7)T.
To display information about your certificate, the certification authority certificate, and any registration authority certificates, use the show crypto ca certificates command in EXEC mode.
show crypto ca certificates
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
Usage Guidelines
This command shows information about the following certificates:
•
•
•
Examples
The following is sample output from the show crypto ca certificates command after you authenticated the CA by requesting the CA's certificate and public key with the crypto pki authenticate command:
CA CertificateStatus: AvailableCertificate Serial Number: 3051DF7123BEE31B8341DFE4B3A338E5FKey Usage: Not SetThe CA certificate might show Key Usage as "Not Set."
The following is sample output from the show crypto ca certificates command, and shows the router's certificate and the CA's certificate. In this example, a single, general purpose RSA key pair was previously generated, and a certificate was requested but not received for that key pair.
CertificateSubject NameName: myrouter.example.comIP Address: 10.0.0.1Serial Number: 04806682Status: PendingKey Usage: General PurposeFingerprint: 428125BD A3419600 3F6C7831 6CD8FA95 00000000CA CertificateStatus: AvailableCertificate Serial Number: 3051DF7123BEE31B8341DFE4B3A338E5FKey Usage: Not SetNote that in the previous sample, the router's certificate Status shows "Pending." After the router receives its certificate from the CA, the Status field changes to "Available" in the show output.
The following is sample output from the show crypto ca certificates command, and shows two router's certificates and the CA's certificate. In this example, special usage RSA key pairs were previously generated, and a certificate was requested and received for each key pair.
CertificateSubject NameName: myrouter.example.comIP Address: 10.0.0.1Status: AvailableCertificate Serial Number: 428125BDA34196003F6C78316CD8FA95Key Usage: SignatureCertificateSubject NameName: myrouter.example.comIP Address: 10.0.0.1Status: AvailableCertificate Serial Number: AB352356AFCD0395E333CCFD7CD33897Key Usage: EncryptionCA CertificateStatus: AvailableCertificate Serial Number: 3051DF7123BEE31B8341DFE4B3A338E5FKey Usage: Not SetThe following is sample output from the show crypto ca certificates command when the CA supports an RA. In this example, the CA and RA certificates were previously requested with the crypto ca authenticate command.
CA CertificateStatus: AvailableCertificate Serial Number: 3051DF7123BEE31B8341DFE4B3A338E5FKey Usage: Not SetRA Signature CertificateStatus: AvailableCertificate Serial Number: 34BCF8A0Key Usage: SignatureRA KeyEncipher CertificateStatus: AvailableCertificate Serial Number: 34BCF89FKey Usage: EncryptionRelated Commands
show crypto ca crls
Note
To display the current certificate revocation list (CRL) on router, use the show crypto ca crls command in EXEC mode.
show crypto ca crls
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
Examples
The following is sample output of the show crypto ca crls command:
Router# show crypto ca crlsCRL Issuer Name:OU = sjvpn, O = cisco, C = usLastUpdate: 16:17:34 PST Jan 10 2002NextUpdate: 17:17:34 PST Jan 11 2002Retrieved from CRL Distribution Point:LDAP: CN = CRL1, OU = sjvpn, O = cisco, C = usRelated Commands
crypto pki crl request
Requests that a new CRL be obtained immediately from the CA.
show crypto ca roots
The show crypto ca roots command is replaced by the show crypto ca trustpoints command. See the show crypto ca trustpoints command for more information.
show crypto ca timers
Note
To display the status of the managed timers that are maintained by Cisco IOS for public key infrastructure (PKI), use the show crypto ca timers command in EXEC mode.
show crypto ca timers
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
12.2(8)T
This command was introduced.
12.2(18)SXD
This command was integrated into Cisco IOS Release 12.2(18)SXD.
Usage Guidelines
For each timer, this command displays the time remaining before the timer expires. It also associates trustpoint certification authorities (CAs), except for certificate revocation list (CRL) timers, by displaying the CRL distribution point.
Examples
The following example is sample output for the show crypto ca timers command:
Router# show crypto ca timersPKI Timers| 4d15:13:33.144| 4d15:13:33.144 CRL http://msca-root.cisco.com/CertEnroll/msca-root.crl|328d11:56:48.372 RENEW msroot| 6:43.201 POLL verisignRelated Commands
auto-enroll
Enables autoenrollment.
crypto pki trustpoint
Declares the CA that your router should use.
show crypto ca trustpoints
Note
To display the trustpoints that are configured in the router, use the show crypto pki trustpoints command in privileged EXEC or user EXEC mode.
show crypto ca trustpoints
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
User EXECCommand History
Usage Guidelines
This command replaces the show crypto ca roots command. If you enter the show crypto ca roots command, the output will be written back as the show crypto pki trustpoints command.
Examples
The following is sample output from the show crypto ca trustpoints command:
Router# show crypto ca trustpointsTrustpoint bo:Subject Name:CN = bomborra Certificate ManagerO = cisco.comC = USSerial Number:01Certificate configured.CEP URL:http://bomborraCRL query url:ldap://bomborraRelated Commands
show crypto call admission statistics
To monitor Crypto Call Admission Control (CAC) statistics, use the show crypto call admission statistics command in user EXEC or privileged EXEC mode.
show crypto call admission statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
User EXEC
Privileged EXECCommand History
Usage Guidelines
Enter this command to display information about the Crypto CAC configuration parameters and their history, including statistics regarding the current security association (SA) count, SAs being negotiated, total new SA requests, the number of Internet Key Exchange (IKE) SA requests accepted and rejected, and details regarding why requests were rejected.
Examples
The following example shows sample output from the show crypto call admission statistics command:
Router# show crypto call admission statisticsCrypto Call Admission Control Statistics-----------------------------------------------------------System Resource Limit: 0 Max IKE SAs 0Total IKE SA Count: 0 active: 0 negotiating: 0Incoming IKE Requests: 0 accepted: 0 rejected: 0Outgoing IKE Requests: 0 accepted: 0 rejected: 0Rejected IKE Requests: 0 rsrc low: 0 SA limit: 0Table 82 describes the significant fields shown in the display.
Related Commands
clear crypto call admission statistics
Clears the counters that track the number of accepted and rejected IKE SA requests.
show crypto ctcp
To display information about a Cisco Tunnel Control Protocol (cTCP) session, use the show crypto ctcp command in privileged EXEC mode.
show crypto ctcp [peer ip-address] [detail]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Examples
The following show command output displays detailed information about a specific peer:
Router# show crypto ctcp peer 10.76.235.21 detailRemote Local VRF Status10.76.235.21:3519 10.76.248.239:10000 CTCP_ACK_RLocalSeq#6807392F RemoteSeq#010116C7Table 83 provides information about significant fields in the display.
Related Commands
show crypto datapath
To display the counters that help troubleshoot an encrypted data path, use the show crypto datapath command in privileged EXEC mode.
show crypto datapath {ipv4 | ipv6} {realtime | snapshot} {all | non-zero} [error | internal | punt | success]
Syntax Description
Command Default
The command defaults are:
•
•
•
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use the show crypto datapath counters command to troubleshoot an encrypted data path.
Note
You must specify the IP version used in the network. You can display all counters, only the counters that have recorded events, or one of these specific counters:
•
•
•
•
You must also choose the display timeframe for the counters:
•
•
Examples
The following example shows output from the show crypto datapath command. In this example, the snapshot option is specified for the timeframe, and only counters that have recorded events are displayed. The output of this command is intended for use by Cisco TAC engineers.
Router# show crypto datapath ipv4 snapshot non-zeroSuccess Statistics: Snapshot at 21:34:30 PST Mar 4 2006crypto check input core2nd round ok: 245 1st round ok: 118post crypto ip encryptpost encrypt ipflowok: 230crypto ceal post encrypt switchpost encrypt ipflowok-2: 230Error Statistics: Snapshot at 21:34:30 PST Mar 4 2006Punt Statistics: Snapshot at 21:34:30 PST Mar 4 2006crypto ceal post decrypt switchfs to ps: 245Internal Statistics: Snapshot at 21:34:30 PST Mar 4 2006crypto check inputcheck input core not con 378 check input core consume 623crypto check input corecame back from ce: 245 deny pak: 15crypto ipsec les fsnot esp or ah: 1113post crypto ip decryptdecrypt switch: 245crypto decrypt ipsec sa checkcheck ident success: 245crypto ceal post decrypt switchfs: 245crypto ceal post decrypt fsles ip turbo fs: 245 tunnel ip les fs: 245crypto ceal post decrypt psproc inline: 245crypto ceal punt to process inlinecoalesce: 245 simple enq: 245crypto ceal post encrypt switchps: 230crypto ceal post encrypt psps coalesce: 230 simple enq: 230crypto engine ps vecip encrypt: 230crypto send epa packetsucast next hop: 230 ip ps send: 230Related Commands
show crypto debug-condition
To display crypto debug conditions that have already been enabled in the router, use the show crypto debug-condition command in privileged EXEC mode.
show crypto debug-condition {[peer] [connid] [spi] [fvrf] [gdoi-group groupname]
[isakmp profile profile-name] [ivrf] [local ip-address] [unmatched] [username username]}Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
You can specify as many filter values as specified via the debug crypto condition command. (You cannot specify a filter value that you did not use in the debug crypto condition command.)
Examples
The following example shows how to display debug messages when the peer IP address is 10.1.1.1, 10.1.1.2, or 10.1.1.3 and when the connection ID 2000 of crypto engine 0 is used. This example also shows how to enable global debug crypto CLIs and enable the show crypto debug-condition command to verify conditional settings.
Router# debug crypto condition connid 2000 engine-id 1Router# debug crypto condition peer ipv4 10.1.1.1Router# debug crypto condition peer ipv4 10.1.1.2Router# debug crypto condition peer ipv4 10.1.1.3Router# debug crypto condition unmatched! Verify crypto conditional settings.Router# show crypto debug-conditionCrypto conditional debug currently is turned ONIKE debug context unmatched flag:ONIPsec debug context unmatched flag:ONCrypto Engine debug context unmatched flag:ONIKE peer IP address filters:10.1.1.1 10.1.1.2 10.1.1.3Connection-id filters:[connid:engine_id]2000:1,! Enable global crypto CLIs to start conditional debugging.Router# debug crypto isakmpRouter# debug crypto ipsecRouter# debug crypto engineThe following example shows how to disable all crypto conditional settings via the reset keyword:
Router# debug crypto condition reset! Verify that all crypto conditional settings have been disabled.Router# show crypto debug-conditionCrypto conditional debug currently is turned OFFIKE debug context unmatched flag:OFFIPsec debug context unmatched flag:OFFCrypto Engine debug context unmatched flag:OFFRelated Commands
show crypto dynamic-map
To display a dynamic crypto map set, use the show crypto dynamic-map command in EXEC mode.
show crypto dynamic-map [tag map-name]
Syntax Description
Command Modes
EXEC
Command History
Usage Guidelines
Use the show crypto dynamic-map command to view a dynamic crypto map set.
Examples
The following is sample output for the show crypto dynamic-map command:
Router# show crypto dynamic-mapCrypto Map Template"vpn1" 1ISAKMP Profile: vpn1-raNo matching address list set.Security association lifetime: 4608000 kilobytes/3600 secondsPFS (Y/N): NTransform sets={vpn1,The following partial configuration was in effect when the above show crypto dynamic-map command was issued:
crypto dynamic-map vpn1 1set transform-set vpn1set isakmp-profile vpn1-rareverse-routeRelated Commands
show crypto eli
To display how many IKE-SAs and IPSec sessions are active and how many Diffie-Hellman keys are in use for each hardware crypto engine, use the show crypto eli in user EXEC or privileged EXEC mode.
show crypto eli
Syntax Description
This command has no arguments or keywords.
Command Modes
User EXEC (<)
Privileged EXEC (#)Command History
Usage Guidelines
Use this command to obtain a snapshot of how many Internet Key Exchange (IKE) and IP Security (IPSec) sessions are active and how many Diffie-Hellman keys are in use for each hardware crypto engine. The show crypto eli command also allows you to see how far an ISA is from reaching its maximum limit.
Note
(The eli component of the command calls the Encryption Layer Interface.)
Examples
The following is sample output for the show crypto eli command:
Router# show crypto eliEncryption Layer : ACTIVENumber of crypto engines = 2.Slot-3 crypto engine details.Capability-IPSec :No-IPPCP, 3DES, NoRSAIKE-Session : 0 active, 2029 max, 0 failedDH-Key : 0 active, 1014 max, 0 failedIPSec-Session : 0 active, 4059 max, 0 failedSlot-5 crypto engine details.Capability-IPSec :No-IPPCP, 3DES, NoRSAIKE-Session : 0 active, 2029 max, 0 failedDH-Key : 0 active, 1014 max, 0 failedIPSec-Session : 0 active, 4059 max, 0 failedThe following is sample output for the show crypto eli command for the IPSec VPN SPA:
Router# show crypto eli>>Hardware Encryption : ACTIVE>> Number of hardware crypto engines = 2>>>> CryptoEngine SPA-IPSEC-2G[3/0] details: state = Active>> Capability :>> IPSEC: DES, 3DES, AES, RSA>>>> IKE-Session : 0 active, 16383 max, 0 failed>> DH : 0 active, 9999 max, 0 failed>> IPSec-Session : 0 active, 65534 max, 0 failed>>>> CryptoEngine SPA-IPSEC-2G[3/1] details: state = Active>> Capability :>> IPSEC: DES, 3DES, AES, RSA>>>> IKE-Session : 1 active, 16383 max, 0 failed>> DH : 0 active, 9999 max, 0 failed>> IPSec-Session : 2 active, 65534 max, 0 failedTable 84 describes significant fields shown in the display.
show crypto eng qos
To monitor and maintain low latency queueing (LLQ) for IPSec encryption engines, use the show crypto eng qos command in privileged EXEC mode.
show crypto eng qos
Syntax Description
This command has no keywords or arguments.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use the show crypto eng qos command to determine if QoS is enabled on LLQ for IPSec encryption engines.
Examples
The following example shows how to determine if LLQ for IPSec encryption engines is enabled:
Router# show crypto eng qoscrypto engine name: Multi-ISA Using VAM2crypto engine type: hardwareslot: 5queuing: enabledvisible bandwidth: 30000 kbpsllq size: 0default queue size/max: 0/64interface table size: 32FastEthernet0/0 (3), iftype 1, ctable size 16, input filter:ipprecedence 5class voice (1/3), match ip precedence 5bandwidth 500 kbps, max token 100000IN match pkt/byte 0/0, police drop 0OUT match pkt/byte 0/0, police drop 0class default, match pkt/byte 0/0, qdrop 0crypto engine bandwidth:total 30000 kbps, allocated 500 kbpsThe field descriptions in the above display are self-explanatory.
show crypto engine
To display a summary of the configuration information for the crypto engines, use the
show crypto engine command in privileged EXEC mode.show crypto engine [accelerator | brief | configuration | connections | qos]
Syntax Description
Command Modes
Privileged EXEC
Command History
Usage Guidelines
This command displays all crypto engines and displays the AIM-VPN product name.
If a hardware crypto engine does not support native Group Domain of Interpretation (GDOI) header preservation, the show crypto engine connections active output for Group Encrypted Transport VPN (GET VPN) IP security (IPsec) connections displays a bogus IP address of 0.0.0.0 (see the show crypto engine connections active example below).
Examples
The following example of the show crypto engine command and the brief keyword shows typical crypto engine summary information:
Router# show crypto engine briefcrypto engine name: Virtual Private Network (VPN) Modulecrypto engine type: hardwareState: EnabledLocation: aim 0VPN Module in slot: 0Product Name: AIM-VPN/SSL-3Software Serial #: 55AADevice ID: 001F - revision 0000Vendor ID: 0000Revision No: 0x001F0000VSK revision: 0Boot version: 255DPU version: 0HSP version: 3.3(18) (PRODUCTION)Time running: 23:39:30Compression: YesDES: Yes3 DES: YesAES CBC: Yes (128,192,256)AES CNTR: NoMaximum buffer length: 4096Maximum DH index: 3500Maximum SA index: 3500Maximum Flow index: 7000Maximum RSA key size: 2048crypto engine name: Cisco VPN Software Implementationcrypto engine type: softwareserial number: CAD4FCE1crypto engine state: installedcrypto engine in slot: N/AThe following example of the show crypto engine command shows IPv6 information:
Router# show crypto engine connectionsID Interface Type Algorithm Encrypt Decrypt IP-Address1 Et2/0 IPsec MD5 0 46 FE80::A8BB:CCFF:FE01:2C022 Et2/0 IPsec MD5 41 0 FE80::A8BB:CCFF:FE01:2C025 Tu0 IPsec SHA+DES 0 0 3FFE:2002::A8BB:CCFF:FE01:2C026 Tu0 IPsec SHA+DES 0 0 3FFE:2002::A8BB:CCFF:FE01:2C021001 Tu0 IKE SHA+DES 0 0 3FFE:2002::A8BB:CCFF:FE01:2C02The following show crypto engine command output displays information for a situation in which a hardware crypto engine does not support native GDOI:
Router# show crypto engine connections activeCrypto Engine ConnectionsID Interface Type Algorithm Encrypt Decrypt IP-Address1079 Se0/0/0.10 IPsec AES+SHA 0 0 0.0.0.01080 Se0/0/0.10 IPsec AES+SHA 0 0 0.0.0.04364 <none> IKE SHA+3DES 0 04381 <none> IKE SHA+3DES 0 0Table 85 describes significant fields shown in the display.
Related Commands
crypto engine accelerator
Enables the use of the onboard hardware accelerator for IPSec encryption.
show crypto engine accelerator logs
To display information about the last 32 CryptoGraphics eXtensions (CGX) Library packet processing commands and associated parameters sent from the VPN module driver to the VPN module hardware, use the show crypto engine accelerator logs command in privileged EXEC mode.
show crypto engine accelerator logs
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
12.1(1)XC
This command was introduced on the Cisco 1720 and Cisco 1750 platforms.
12.1(2)T
This command was integrated into Cisco IOS Release 12.1(2)T.
Usage Guidelines
Use this command when encrypted traffic is sent to the router and a problem with the encryption module is suspected. Use the debug crypto engine accelerator logs command to enable command logging before using this command.
Note
Examples
The following is sample output for the show crypto engine accelerator logs command:
Router# show crypto engine accelerator logsContents of packet log (current index = 20):tag = 0x5B02, cmd = 0x5000param[0] = 0x000E, param[1] = 0x57E8param[2] = 0x0008, param[3] = 0x0000param[4] = 0x0078, param[5] = 0x0004param[6] = 0x142C, param[7] = 0x142Cparam[8] = 0x0078, param[9] = 0x000Ctag = 0x5B03, cmd = 0x4100param[0] = 0x000E, param[1] = 0x583Cparam[2] = 0x0034, param[3] = 0x0040param[4] = 0x00B0, param[5] = 0x0004param[6] = 0x1400, param[7] = 0x1400param[8] = 0x0020, param[9] = 0x000Ctag = 0x5C00, cmd = 0x4100param[0] = 0x000E, param[1] = 0x57BCparam[2] = 0x0034, param[3] = 0x0040param[4] = 0x00B0, param[5] = 0x0004param[6] = 0x1400, param[7] = 0x1400param[8] = 0x0020, param[9] = 0x000C...tag = 0x5A01, cmd = 0x4100param[0] = 0x000E, param[1] = 0x593Cparam[2] = 0x0034, param[3] = 0x0040param[4] = 0x00B0, param[5] = 0x0004param[6] = 0x1400, param[7] = 0x1400param[8] = 0x0020, param[9] = 0x000CContents of cgx log (current index = 12):cmd = 0x0074 ret = 0x0000param[0] = 0x0010, param[1] = 0x028Eparam[2] = 0x0039, param[3] = 0x0D1Eparam[4] = 0x0100, param[5] = 0x0000param[6] = 0x0000, param[7] = 0x0000param[8] = 0x0000, param[9] = 0x0000cmd = 0x0062 ret = 0x0000param[0] = 0x0035, param[1] = 0x1BE0param[2] = 0x0100, param[3] = 0x0222param[4] = 0x0258, param[5] = 0x0000param[6] = 0x0000, param[7] = 0x0000param[8] = 0x0000, param[9] = 0x0000cmd = 0x0063 ret = 0x0000param[0] = 0x0222, param[1] = 0x0258param[2] = 0x0000, param[3] = 0x0000param[4] = 0x0000, param[5] = 0x0000param[6] = 0x0000, param[7] = 0x020Aparam[8] = 0x002D, param[9] = 0x0000...cmd = 0x0065 ret = 0x0000param[0] = 0x0222, param[1] = 0x0258param[2] = 0x0010, param[3] = 0x028Eparam[4] = 0x00A0, param[5] = 0x0008param[6] = 0x0001, param[7] = 0x0000param[8] = 0x0000, param[9] = 0x0000Related Commands
debug crypto engine acclerator logs
Enables logging of commands and associated parameters sent from the VPN module driver to the VPN module hardware using a debug flag.
show crypto engine accelerator ring
To display the contents and status of the control command, transmit packets, and receive packet rings used by the hardware accelerator crypto engine, use the show crypto engine accelerator ring command in privileged EXEC mode.
show crypto engine accelerator ring [control | packet | pool]
Syntax Description
Command Modes
Privileged EXEC
Command History
Usage Guidelines
This command displays the command ring information.
If there were valid data in any of the rings, the ring entry would be printed.
Examples
The following example shows the command ring information:
Router# show crypto engine accelerator ring packetPPQ RING:cmd ring:head = 10 tail =10result ring:head = 10 tail =10destination ring:head = 10 tail =10source ring:head = 10 tail =10free ring:head = 0 tail =25500000000 071A96C500000000 071A96C500000001 071A946500000001 071A946500000002 071A920500000002 071A9205...Related Commands
show crypto engine accelerator sa-database
To display active (in-use) entries in the platform-specific virtual private network (VPN) module database, use the show crypto engine accelerator sa-database command in privileged EXEC mode.
show crypto engine accelerator sa-database
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
12.1(1)XC
This command was introduced on the Cisco 1720 and Cisco 1750 platforms.
12.1(2)T
This command was integrated into Cisco IOS Release 12.1(2)T.
Usage Guidelines
Use this command when encrypted traffic is sent to the router and a problem with the encryption module is suspected.
Note
Examples
The following is sample output for the show crypto engine accelerator sa-database command:
Router# show crypto engine accelerator sa-databaseFlow SummaryIndex Algorithms005 tunnel inbound esp-md5-hmac esp-des ah-sha-hmac006 tunnel outbound esp-md5-hmac esp-des ah-sha-hmac007 tunnel inbound esp-md5-hmac esp-des ah-sha-hmac008 tunnel outbound esp-md5-hmac esp-des ah-sha-hmac009 tunnel inbound esp-md5-hmac esp-des ah-sha-hmac010 tunnel outbound esp-md5-hmac esp-des ah-sha-hmacSA Summary:Index DH-Index Algorithms003 001(deleted) DES SHA004 002(deleted) DES SHADH SummaryIndex Group ConfigRelated Commands
debug crypto engine acclerator logs
Enables logging of commands and associated parameters sent from the VPN module driver to the VPN module hardware using a debug flag.
show crypto engine accelerator statistic
To display IP Security (IPsec) encryption statistics and error counters for the onboard hardware accelerator of the router or the IPsec Virtual Private Network (VPN) Shared Port Adapter (SPA), use the show crypto engine accelerator statistic command in privileged EXEC mode.
show crypto engine accelerator statistic
IPsec VPN SPA (SPA-IPSEC-2G) and VSPA (WS-IPSEC-3G)
show crypto engine accelerator statistic [slot slot/subslot | all] [coreutil | detail]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
No specific usage guidelines apply to the hardware accelerators.
IPsec VPN SPA and VSPA
Enter the slot keyword to display platform statistics for the corresponding SPA. This output will not include network interface controller statistics.
Enter the all keyword to display platform statistics for all IPsec VPN SPAs and VSPAs on the router. This output will not include network interface controller statistics.
Enter the detail keyword to display platform statistics for the SPA and network interface controller statistics. Note that the controller statistics contain L2 counters.
VSPA
Enter the coreutil keyword to display VPN core utilization statistics. This output will not include network interface controller statistics.
Tip
Examples
Hardware VPN Module
The following example displays compression statistics for a hardware VPN module:
Router# show crypto engine accelerator statisticDevice: AIM-VPN/SSL-3Location: AIM Slot: 0Virtual Private Network (VPN) Module in slot : 0Statistics for Hardware VPN Module since the last clearof counters 85319 seconds ago560 packets in 560 packets out95600 bytes in 124720 bytes out0 paks/sec in 0 paks/sec out0 Kbits/sec in 0 Kbits/sec out0 packets decrypted 560 packets encrypted0 bytes before decrypt 124720 bytes encrypted0 bytes decrypted 95600 bytes after encrypt0 packets decompressed 0 packets compressed0 bytes before decomp 0 bytes before comp0 bytes after decomp 0 bytes after comp0 packets bypass decompr 0 packets bypass compres0 bytes bypass decompres 0 bytes bypass compressi0 packets not decompress 0 packets not compressed0 bytes not decompressed 0 bytes not compressed1.0:1 compression ratio 1.0:1 overall10426 commands out 10426 commands acknowledgedLast 5 minutes:0 packets in 0 packets out0 paks/sec in 0 paks/sec out0 bits/sec in 0 bits/sec out0 bytes decrypted 0 bytes encrypted0 Kbits/sec decrypted 0 Kbits/sec encrypted1.0:1 compression ratio 1.0:1 overallErrors:ppq full errors : 0 ppq rx errors : 0cmdq full errors : 0 cmdq rx errors : 0ppq down errors : 0 cmdq down errors : 0no buffer : 0 replay errors : 0dest overflow : 0 authentication errors : 0Other error : 0 Raw Input Underrun : 0IPSEC Unsupported Option: 0 IPV4 Header Length : 0ESP Pad Length : 0 IPSEC Decompression : 0AH ESP seq mismatch : 0 AH Header Length : 0AH ICV Incorrect : 0 IPCOMP CPI Mismatch : 0IPSEC ESP Modulo : 0 Unexpected IPV6 Extensio: 0Unexpected Protocol : 0 Dest Buf overflow : 0IPSEC Pkt is fragment : 0 IPSEC Pkt src count : 0Invalid IP Version : 0 Unwrappable : 0SSL Output overrun : 0 SSL Decompress failure : 0SSL BAD Decomp History : 0 SSL Version Mismatch : 0SSL Input overrun : 0 SSL Conn Modulo : 0SSL Input Underrun : 0 SSL Connection closed : 0SSL Unrecognised content: 0 SSL record header length: 0PPTP Duplicate packet : 0 PPTP Exceed max missed p: 0RNG self test fail : 0 DF Bit set : 0Hash Miscompare : 0 Unwrappable object : 0Missing attribute : 0 Invalid attrribute value: 0Bad Attribute : 0 Verification Fail : 0Decrypt Failure : 0 Invalid Packet : 0Invalid Key : 0 Input Overrun : 0Input Underrun : 0 Output buffer overrun : 0Bad handle value : 0 Invalid parameter : 0Bad function code : 0 Out of handles : 0Access denied : 0 Out of memory : 0NR overflow : 0 pkts dropped : 0Warnings:sessions_expired : 0 packets_fragmented : 0general: : 0HSP details:hsp_operations : 10441 hsp_sessioTable 86 describes significant fields shown in the above display.
7200/VSA
The following example is output from a Cisco 7200 with VSA:
Router# show crypto engine accelerator statistic 0Inbound rate: 0pps 0kb/s Outbound rate: 0pps 0kb/sTRAFFIC Transmitted Received-------------------------------------------------------------------------------Message Count: 5 5Message Byte Count: 1212 256Message Overflow: 0Outbound Count: 54 154Outbound Byte Count: 12472 30332Outbound Overflow: 0Inbound Count: 153 153Inbound Byte Count: 26304 19864Inbound Overflow: 0Reassembled Pkt: 0Fragments Dropped: 0IPPE: 0EPPE: 0FIFO: 0RAE: 0Inbound Traffic:-------------------------------------------------------------------------------Decrypted Pkt: 150Passthrough Pkt: 3IKE Pkt: 0SPI Error: 0Policy Violation: 0Outbound Traffic: Route cache Processor-------------------------------------------------------------------------------Encrypted Pkt: 150 0Passthrough Pkt: 0 4Policy Violation: 0Queue Depth:------------------------------------------------------------------------------TXRing Current Queue Depth:High Priority : 0.0 %Medium Priority : 0.0 %Low Priority : 0.0 %VSA RX Exception statistics:Invalid SA : 0 Enc Dec mismatch : 0Next Header mismatch : 0 Pad mismatch : 0MAC mismatch : 0 Anti replay failed : 0Enc Seq num overflow : 0 Dec IPver mismatch : 0Enc IPver mismatch : 0 TTL Decr : 0Selector checks : 0 UDP mismatch : 0IP Parse error : 0 Fragmentation Error : 0IB Selector check : 0 TimeBased Replay Err : 0Misc. Exceptions : 0Table 87 describes significant fields shown in the above display.
IPsec VPN SPA and VSPA
The following example shows the platform statistics for the IPsec VPN SPA in slot 1 subslot 0 and also displays the network interface controller statistics (this platform output is from a Catalyst 6500 series with installed IPsec VPN SPA):
Router# show crypto engine accelerator statistic slot 1/0 detailVPN module in slot 1/0Decryption Side Data Path Statistics====================================Packets RX...............: 454260Packets TX...............: 452480IPSec Transport Mode.....: 0IPSec Tunnel Mode........: 452470AH Packets...............: 0ESP Packets..............: 452470GRE Decapsulations.......: 0NAT-T Decapsulations.....: 0Clear....................: 8ICMP.....................: 0Packets Drop.............: 193Authentication Errors....: 0Decryption Errors........: 0Replay Check Failed......: 0Policy Check Failed......: 0Illegal CLear Packet.....: 0GRE Errors...............: 0SPD Errors...............: 0HA Standby Drop..........: 0Hard Life Drop...........: 0Invalid SA...............: 191SPI No Match.............: 0Destination No Match.....: 0Protocol No Match........: 0Reassembly Frag RX.......: 0IPSec Fragments..........: 0IPSec Reasm Done.........: 0Clear Fragments..........: 0Clear Reasm Done.........: 0Datagrams Drop...........: 0Fragments Drop...........: 0Decryption Side Controller Statistics=====================================Frames RX................: 756088Bytes RX.................: 63535848Mcast/Bcast Frames RX....: 2341RX Less 128Bytes.........: 756025RX Less 512Bytes.........: 58RX Less 1KBytes..........: 2RX Less 9KBytes..........: 3RX Frames Drop...........: 0Frames TX................: 452365Bytes TX.................: 38001544Mcast/Bcast Frames TX....: 9TX Less 128Bytes.........: 452343TX Less 512Bytes.........: 22TX Less 1KBytes..........: 0TX Less 9KBytes..........: 0Encryption Side Data Path Statistics====================================Packets RX...............: 756344Packets TX...............: 753880IPSec Transport Mode.....: 0IPSec Tunnel Mode........: 753869GRE Encapsulations.......: 0NAT-T Encapsulations.....: 0LAF prefragmented........: 0Fragmented...............: 0Clear....................: 753904ICMP.....................: 0Packets Drop.............: 123IKE/TED Drop.............: 27Authentication Errors....: 0Encryption Errors........: 0HA Standby Drop..........: 0Hard Life Drop...........: 0Invalid SA...............: 191Reassembly Frag RX.......: 0Clear Fragments..........: 0Clear Reasm Done.........: 0Datagrams Drop...........: 0Fragments Drop...........: 0Encryption Side Controller Statistics=====================================Frames RX................: 454065Bytes RX.................: 6168274/Mcast/Bcast Frames RX....: 1586RX Less 128Bytes.........: 1562RX Less 512Bytes.........: 452503RX Less 1KBytes..........: 0RX Less 9KBytes..........: 0RX Frames Drop...........: 0Frames TX................: 753558Bytes TX.................: 100977246Mcast/Bcast Frames TX....: 2TX Less 128Bytes.........: 3TX Less 512Bytes.........: 753555TX Less 1KBytes..........: 0TX Less 9KBytes..........: 0Table 88 describes significant fields shown in the above display.
VSPA
The following examples show the output when the coreutil keyword is used with the VSPA and the Catalyst 6500 series switch using Cisco IOS Release 12.2(33)SXI and later releases:
Router#: show crypto engine accelerator statistic slot 2/0 coreutilUtilization Percentages for VPN blade in slot 2/0Blade Utilization Percentages==========================Last 5 seconds ---------------------Slowpath ...................... 35 %Inbound ....................... 24 %Outbound ...................... 32 %QoS ........................... 44 %Last 1 minute ----------------------Slowpath ...................... 12 %Inbound ....................... 11 %Outbound ...................... 15 %QoS ........................... 23 %Last 5 minutes ---------------------Slowpath ....................... 8 %Inbound ....................... 11 %Outbound ...................... 11 %QoS ........................... 10 %Router# show crypto engine accelerator statistic all coreutilUtilization Percentages for VPN blade in slot 2/0Blade Utilization Percentages==========================Last 5 seconds ---------------------Slowpath ...................... 35 %Inbound ....................... 24 %Outbound ...................... 32 %QoS ........................... 44 %Last 1 minute ----------------------Slowpath ...................... 12 %Inbound ....................... 11 %Outbound ...................... 15 %QoS ........................... 23 %Last 5 minutes ---------------------Slowpath ....................... 8 %Inbound ....................... 11 %Outbound ...................... 11 %QoS ........................... 10 %Utilization Percentages for VPN blade in slot 2/1Blade Utilization Percentages==========================Last 5 seconds ---------------------Slowpath ...................... 88 %Inbound ....................... 78 %Outbound ...................... 79 %QoS ........................... 32 %Last 1 minute ----------------------Slowpath ...................... 76 %Inbound ....................... 80 %Outbound ...................... 80 %QoS ........................... 13 %Last 5 minutes ---------------------Slowpath ...................... 75 %Inbound ....................... 65 %Outbound ...................... 70 %QoS ........................... 12 %Table 89 describes significant fields shown in the above display.
Related Commands
show crypto gdoi
To display information about a Group Domain of Interpretation (GDOI) configuration, use the show crypto gdoi command in privileged EXEC mode.
show crypto gdoi [group group-name] [gm [acl | rekey | replay] | ks [acl | coop [version] | members | policy | rekey | replay]] [ipsec sa]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Examples
The following output displays information about a configuration for a GDOI group member:
Router# show crypto gdoiGroup InformationGroup Name : diffintGroup Identity : 3333Group Members Registered : 0Group Server : 10.0.5.2Group Name : testGroup Identity : 4444Group Members Registered : 0Group Server : 10.0.5.2The following output displays information about a configuration for a GDOI key server:
Router# show crypto gdoiGroup InformationGroup Name : diffintGroup Identity : 3333Group Members Registered : 1Group Server : LocalGroup Rekey Lifetime : 300 secsGroup RekeyRemaining Lifetime : 84 secsIPSec SA Number : 1IPSec SA Rekey Lifetime : 120 secsProfile Name : gdoi-pSA RekeyRemaining Lifetime : 64 secsaccess-list 120 permit ip host 10.0.1.1 host 192.168.1.1access-list 120 permit ip host 10.0.100.2 host 192.168.1.1Group Member List for Group diffint :Member ID : 10.0.3.1Group Name : testGroup Identity : 4444Group Members Registered : 0Group Server : LocalGroup Rekey Lifetime : 600 secsIPSec SA Number : 1IPSec SA Rekey Lifetime : 120 secsProfile Name : gdoi-paccess-list 120 permit ip host 10.0.1.1 host 192.168.1.1access-list 120 permit ip host 10.0.100.2 host 192.168.1.1show crypto ha
To display all virtual IP (VIP) addresses that are currently in use by IP Security (IPSec) and Internet Key Exchange (IKE), use the show crypto ha command in privileged EXEC mode.
show crypto ha
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Examples
The following output from the show crypto ha command shows all VIP addresses that are being used by IPSec and IKE:
Router# show crypto haIKE VIP: 209.165.201.3stamp: 74 BA 70 27 9C 4F 7F 81 3A 70 13 C9 65 22 E7 76IKE VIP: 255.255.255.253stamp: Not setIKE VIP: 255.255.255.254stamp: Not setIPSec VIP: 209.165.201.3IPSec VIP: 255.255.255.253IPSec VIP: 255.255.255.254show crypto ipsec client ezvpn
To display the Cisco Easy VPN Remote configuration, use the show crypto ipsec client ezvpn command in privileged EXEC mode.
show crypto ipsec client ezvpn
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Examples
The following example shows a typical display from the show crypto ipsec client ezvpn command for an active Virtual Private Network (VPN) connection when the router is in client mode. The last two lines indicate that a configuration URL and configuration version number have been pushed through the Mode-Configuration Exchange by the server to the Easy VPN remote device.
Router# show crypto ipsec client ezvpnTunnel name: hw1Inside interface list: FastEthernet0/0, Serial1/0,Outside interface: Serial0/0Current State: IPSEC_ACTIVELast Event: SOCKET_UPAddress: 192.168.201.0Mask: 255.255.255.224DNS Primary: 192.168.201.1DNS Secondary: 192.168.201.2NBMS/WINS Primary: 192.168.201.3NBMS/WINS Secondary: 192.168.201.4Default Domain: cisco.comConfiguration URL: http://10.8.8.88/easy.cfgConfiguration Version: 10The following example shows a typical display from the show crypto ipsec client ezvpn command for an active VPN connection when the router is in network-extension mode:
Router# show crypto ipsec client ezvpnTunnel name: hw1Inside interface list: FastEthernet0/0, Serial1/0,Outside interface: Serial0/0Current State: IPSEC_ACTIVELast Event: SOCKET_UPAddress: 192.168.202.128Mask: 255.255.255.224Default Domain: cisco.comSplit Tunnel List: 1Address : 192.168.200.225Mask : 255.255.255.224Protocol : 0x0Source Port: 0Dest Port : 0The following example shows a typical display from the show crypto ipsec client ezvpn command for an inactive VPN connection:
Router# show crypto ipsec client ezvpnCurrent State: IDLELast Event: REMOVE INTERFACE CFGRouter#The following example displays information about the outside interface "Virtual-Access1", which is bound to the real interface (Ethernet0/0) on which the user has configured Easy VPN as an outside interface:
Router# show crypto ipsec client ezvpnEasy VPN Remote Phase: 5Tunnel name : ezInside interface list: Ethernet1/0,Outside interface: Virtual-Access1 (bound to Ethernet0/0)Easy VPN connect ACL checking activeConnect : ACL based with access-list 101Current State: CONNECT_REQUIREDLast Event: TRACKED OBJECT UPSave Password: DisallowedCurrent EzVPN Peer: 10.0.0.2Table 90 describes significant fields shown by the show crypto ipsec client ezvpn command:
Related Commands
show crypto ipsec transform
Displays the specific configuration for one or all transformation sets.
show crypto ipsec default transform-set
To display the default IP Security (IPsec) transform sets currently in use by Internet Key Exchange (IKE), use the show crypto ipsec default transform-set command in privileged EXEC mode.
show crypto ipsec default transform-set
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Usage Guidelines
If the default transform sets are in use, the show crypto ipsec default transform-set command displays the two default transform sets each of which defines an Encapsulation Security Protocol (ESP) encryption transform type and an ESP authentication transform type.
Examples
The following example displays the two default transform sets. No user defined transform sets have been configured, the default transform sets have not been disabled, and the crypto engine supports the encryption algorithm.
Router# show crypto ipsec default transform-setTransform set #$!default_transform_set_1: { esp-aes esp-sha-hmac }will negotiate = { Transport, },Transform set #$!default_transform_set_0: { esp-3des esp-sha-hmac }will negotiate = { Transport, },Table 91 show crypto ipsec default transform-set Field Descriptions
The following example shows that when the default transform sets are disabled with the no crypto ipsec default transform-set, the show crypto ipsec default transform-set has no output.
Router(config)# no crypto ipsec default transform-setRouter(config)# exitRouter#Router# show crypto ipsec default transform-setRouter#Related Commands
show crypto ipsec sa
To display the settings used by current security associations (SAs), use the show crypto ipsec sa command in privileged EXEC mode.
show crypto ipsec sa [map map-name | address | identity | interface interface-type interface-number | peer [vrf fvrf-name] address | vrf ivrf-name | ipv6 [interface-type interface-number]] [detail]
IPsec and IKE Stateful Failover Syntax
show crypto ipsec sa [active | standby]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
If no keyword is used, all SAs are displayed. They are sorted first by interface and then by traffic flow (for example, source or destination address, mask, protocol, or port). Within a flow, the SAs are listed by protocol (ESP or AH) and direction (inbound or outbound).
Examples
The following is sample output for the show crypto ipsec sa command:
Router# show crypto ipsec sainterface: Tunnel1Crypto map tag: Tunnel1-head-0, local addr 10.5.5.2protected vrf: (none)local ident (addr/mask/prot/port): (10.5.5.2/255.255.255.255/47/0)remote ident (addr/mask/prot/port): (10.5.5.1/255.255.255.255/47/0)current_peer 10.5.5.1 port 500PERMIT, flags={origin_is_acl,}#pkts encaps: 492908510, #pkts encrypt: 492908510, #pkts digest: 492908510#pkts decaps: 492908408, #pkts decrypt: 492908408, #pkts verify: 492908408#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0#pkts not decompressed: 0, #pkts decompress failed: 0#send errors 55, #recv errors 0local crypto endpt.: 10.5.5.2, remote crypto endpt.: 10.5.5.1path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/2current outbound spi: 0xDE4EE29D(3729711773)inbound esp sas:spi: 0xC06CA92B(3228346667)transform: esp-3des esp-sha-hmac ,in use settings ={Tunnel, }conn id: 3139, flow_id: VSA:1139, crypto map: Tunnel1-head-0sa timing: remaining key lifetime (k/sec): (3948785/556)IV size: 8 bytesreplay detection support: YStatus: ACTIVEinbound ah sas:spi: 0xC87AB936(3363486006)transform: ah-md5-hmac ,in use settings ={Tunnel, }conn id: 3139, flow_id: VSA:1139, crypto map: Tunnel1-head-0sa timing: remaining key lifetime (k/sec): (3948785/556)replay detection support: YStatus: ACTIVEinbound pcp sas:outbound esp sas:spi: 0xDE4EE29D(3729711773)transform: esp-3des esp-sha-hmac ,in use settings ={Tunnel, }conn id: 3140, flow_id: VSA:1140, crypto map: Tunnel1-head-0sa timing: remaining key lifetime (k/sec): (3948785/556)IV size: 8 bytesreplay detection support: YStatus: ACTIVEoutbound ah sas:spi: 0xAEEDD4F1(2934822129)transform: ah-md5-hmac ,in use settings ={Tunnel, }conn id: 3140, flow_id: VSA:1140, crypto map: Tunnel1-head-0sa timing: remaining key lifetime (k/sec): (3948785/556)replay detection support: YStatus: ACTIVEoutbound pcp sas:The following is sample output for the show crypto ipsec sa identity detail command:
Router# show crypto ipsec sa identity detailinterface: Tunnel1Crypto map tag: Tunnel1-head-0, local addr 10.5.5.2protected vrf: (none)local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)current_peer (none) port 500DENY, flags={ident_is_root,}#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0#pkts not decompressed: 0, #pkts decompress failed: 0#pkts no sa (send) 0, #pkts invalid sa (rcv) 0#pkts encaps failed (send) 0, #pkts decaps failed (rcv) 0#pkts invalid prot (recv) 0, #pkts verify failed: 0#pkts invalid identity (recv) 0, #pkts invalid len (rcv) 0#pkts replay rollover (send): 0, #pkts replay rollover (rcv) 0##pkts replay failed (rcv): 0#pkts internal err (send): 0, #pkts internal err (recv) 0protected vrf: (none)local ident (addr/mask/prot/port): (10.5.5.2/255.255.255.255/47/0)remote ident (addr/mask/prot/port): (10.5.5.1/255.255.255.255/47/0)current_peer 10.5.5.1 port 500PERMIT, flags={origin_is_acl,}#pkts encaps: 492923510, #pkts encrypt: 492923510, #pkts digest: 492923510#pkts decaps: 492923408, #pkts decrypt: 492923408, #pkts verify: 492923408#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0#pkts not decompressed: 0, #pkts decompress failed: 0#pkts no sa (send) 55, #pkts invalid sa (rcv) 0#pkts encaps failed (send) 0, #pkts decaps failed (rcv) 0#pkts invalid prot (recv) 0, #pkts verify failed: 0#pkts invalid identity (recv) 0, #pkts invalid len (rcv) 0#pkts replay rollover (send): 0, #pkts replay rollover (rcv) 0##pkts replay failed (rcv): 0#pkts internal err (send): 0, #pkts internal err (recv) 0Table 92 describes the significant fields shown in the above displays (show crypto ipsec sa and show crypto ipsec sa detail).
show crypto ipsec sa vrf Command Output
The following is sample output for the show crypto ipsec sa vrf command:
Router# show crypto ipsec sa vrf vpn2interface: Ethernet1/2Crypto map tag: ra, local addr. 172.16.1.1protected vrf: vpn2local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)remote ident (addr/mask/prot/port): (10.4.1.4/255.255.255.255/0/0)current_peer: 10.1.1.1:500PERMIT, flags={}#pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0#pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0#pkts not decompressed: 0, #pkts decompress failed: 0#send errors 0, #recv errors 0local crypto endpt.: 172.16.1.1, remote crypto endpt.: 10.1.1.1path mtu 1500, media mtu 1500current outbound spi: 50110CF8inbound esp sas:spi: 0xA3E24AFD(2749516541)transform: esp-3des esp-md5-hmac ,in use settings ={Tunnel, }slot: 0, conn id: 5127, flow_id: 7, crypto map: rasa timing: remaining key lifetime (k/sec): (4603517/3503)IV size: 8 bytesreplay detection support: Yinbound ah sas:inbound pcp sas:outbound esp sas:spi: 0x50110CF8(1343294712)transform: esp-3des esp-md5-hmac ,in use settings ={Tunnel, }slot: 0, conn id: 5128, flow_id: 8, crypto map: rasa timing: remaining key lifetime (k/sec): (4603517/3502)IV size: 8 bytesreplay detection support: Youtbound ah sas:outbound pcp sas:The following configuration was in effect when the preceding show crypto ipsec sa vrf command was issued. The IPsec remote access tunnel was "UP" when this command was issued.
crypto dynamic-map vpn1 1set transform-set vpn1set isakmp-profile vpn1-rareverse-route!crypto dynamic-map vpn2 1set transform-set vpn2set isakmp-profile vpn2-rareverse-route!!crypto map ra 1 ipsec-isakmp dynamic vpn1crypto map ra 2 ipsec-isakmp dynamic vpn2Table 93 describes the significant fields shown in the above show crypto ipsec sa vrf display. Additional fields are self-explanatory or can be found in Table 93.
IPsec and IKE Stateful Failover Examples
The following sample output shows the IPsec SA status of only the active device:
Router# show crypto ipsec sa activeinterface: Ethernet0/0Crypto map tag: to-peer-outside, local addr 10.165.201.3protected vrf: (none)local ident (addr/mask/prot/port): (192.168.0.1/255.255.255.255/0/0)remote ident (addr/mask/prot/port): (172.16.0.1/255.255.255.255/0/0)current_peer 209.165.200.225 port 500PERMIT, flags={origin_is_acl,}#pkts encaps: 3, #pkts encrypt: 3, #pkts digest: 3#pkts decaps: 4, #pkts decrypt: 4, #pkts verify: 4#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0#pkts not decompressed: 0, #pkts decompress failed: 0#send errors 0, #recv errors 0local crypto endpt.: 209.165.201.3, remote crypto endpt.: 209.165.200.225path mtu 1500, media mtu 1500current outbound spi: 0xD42904F0(3559458032)inbound esp sas:spi: 0xD3E9ABD0(3555306448)transform: esp-3des ,in use settings ={Tunnel, }conn id: 2006, flow_id: 6, crypto map: to-peer-outsidesa timing: remaining key lifetime (k/sec): (4586265/3542)HA last key lifetime sent(k): (4586267)ike_cookies: 9263635C CA4B4E99 C14E908E 8EE2D79CIV size: 8 bytesreplay detection support: YStatus: ACTIVETable 94 describes the significant fields shown in the above show crypto ipsec sa active display. Additional fields are self-explanatory or can be found in Table 1 or Table 93.
The following sample output shows the IPsec SA status of only the standby device:
Router# show crypto ipsec sa standbyinterface: Ethernet0/0Crypto map tag: to-peer-outside, local addr 10.165.201.3protected vrf: (none)local ident (addr/mask/prot/port): (192.168.0.1/255.255.255.255/0/0)remote ident (addr/mask/prot/port): (172.16.0.1/255.255.255.255/0/0)current_peer 209.165.200.225 port 500PERMIT, flags={origin_is_acl,}#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0#pkts not decompressed: 0, #pkts decompress failed: 0#send errors 0, #recv errors 0local crypto endpt.: 209.165.201.3, remote crypto endpt.: 209.165.200.225path mtu 1500, media mtu 1500current outbound spi: 0xD42904F0(3559458032)inbound esp sas:spi: 0xD3E9ABD0(3555306448)transform: esp-3des ,in use settings ={Tunnel, }conn id: 2012, flow_id: 12, crypto map: to-peer-outsidesa timing: remaining key lifetime (k/sec): (4441561/3486)HA last key lifetime sent(k): (4441561)ike_cookies: 00000000 00000000 00000000 00000000IV size: 8 bytesreplay detection support: YStatus: STANDBYinbound ah sas:spi: 0xF3EE3620(4092474912)transform: ah-md5-hmac ,in use settings ={Tunnel, }conn id: 2012, flow_id: 12, crypto map: to-peer-outsidesa timing: remaining key lifetime (k/sec): (4441561/3486)HA last key lifetime sent(k): (4441561)ike_cookies: 00000000 00000000 00000000 00000000replay detection support: YStatus: STANDBYinbound pcp sas:outbound esp sas:spi: 0xD42904F0(3559458032)transform: esp-3des ,in use settings ={Tunnel, }conn id: 2011, flow_id: 11, crypto map: to-peer-outsidesa timing: remaining key lifetime (k/sec): (4441561/3485)HA last key lifetime sent(k): (4441561)ike_cookies: 00000000 00000000 00000000 00000000IV size: 8 bytesreplay detection support: YStatus: STANDBYoutbound ah sas:spi: 0x75251086(1965363334)transform: ah-md5-hmac ,in use settings ={Tunnel, }conn id: 2011, flow_id: 11, crypto map: to-peer-outsidesa timing: remaining key lifetime (k/sec): (4441561/3485)HA last key lifetime sent(k): (4441561)ike_cookies: 00000000 00000000 00000000 00000000replay detection support: YStatus: STANDBYoutbound pcp sas:The fields in the above display are self-explanatory or can be found in Table 1, Table 93, or Table 94.
show crypto ipsec security-association lifetime
To display the security association (SA) lifetime value configured for a particular crypto map entry, use the show crypto ipsec security-association lifetime command in EXEC mode.
show crypto ipsec security-association lifetime
Syntax Description
This command has no arguments or keywords.
Command Modes
EXEC
Command History
Examples
The following is sample output for the show crypto ipsec security-association lifetime command:
Router# show crypto ipsec security-association lifetimeSecurity-association lifetime: 4608000 kilobytes/120 secondsThe following configuration was in effect when the previous show crypto ipsec security-association lifetime command was issued:
crypto ipsec security-association lifetime seconds 120show crypto ipsec transform-set
To display the configured transform sets or active default transform sets, use the show crypto ipsec transform-set command in privileged EXEC mode.
show crypto ipsec transform-set [tag transform-set-name]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
There are two default transform sets supported in Cisco IOS k9 images only:
•
•
The show crypto ipsec transform-set command will display the default transform sets if there are no other transform set configured, you have not disabled the default transform sets by issuing the no crypto ipsec default transform-set command, and the crypto engine supports the encryption algorithm.
Examples
The following is sample output for the show crypto ipsec transform-set command when the default transform sets have been disabled with the no crypto ipsec default transform-set command:
Router# show crypto ipsec transform-setTransform set combined-des-sha: {esp-des esp-sha-hmac}will negotiate = { Tunnel, },Transform set combined-des-md5: {esp-des esp-md5-hmac}will negotiate = { Tunnel, },Transform set t1: {esp-des esp-md5-hmac}will negotiate = {Tunnel,},Transform set t100: {ah-sha-hmac}will negotiate = {Transport,},Transform set t2: {ah-sha-hmac}will negotiate = {Tunnel,},{ esp-des }will negotiate = {Tunnel,},The following configuration was in effect when the previous show crypto ipsec transform-set command was issued:
crypto ipsec transform-set combined-des-sha esp-des esp-sha-hmaccrypto ipsec transform-set combined-des-md5 esp-des esp-md5-hmaccrypto ipsec transform-set t1 esp-des esp-md5-hmaccrypto ipsec transform-set t100 ah-sha-hmacmode transportcrypto ipsec transform-set t2 ah-sha-hmac esp-desno crypto ipsec default transform-setThe following sample output from the show crypto ipsec transform-set command displays a warning message after a user tries to configure an IPsec transform that the hardware does not support:
Router# show crypto ipsec transform-setTransform set transform-1:{ esp-256-aes esp-md5-hmac }will negotiate = { Tunnel, },WARNING: encryption hardware does not support transform esp-aes 256 within IPSec transform transform-1The following is sample output for the show crypto ipsec transform-set command when the default transform sets are active and the crypto engine supports the encryption algorithm:
Router# show crypto ipsec transform-setTransform set asset: { esp-256-aes esp-sha-hmac }will negotiate = { Transport, },Transform set aesset: { esp-256-aes esp-sha-hmac }will negotiate = { Transport, },Transform set #$!default_transform_set_1: { esp-aes esp-sha-hmac }will negotiate = { Transport, },Transform set #$!default_transform_set_0: { esp-3des esp-sha-hmac }will negotiate = { Transport, },Related Commands
show crypto isakmp default policy
To display the default Internet Key Exchange (IKE) policies currently in use, use the show crypto isakmp default policy command in privileged EXEC mode.
show crypto isakmp default policy
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Usage Guidelines
If you have neither manually configured IKE policies with the crypto isakmp policy command nor issued the no crypto isakmp default policy command, IPsec will use the default IKE policies to negotiate IKE proposals. There are eight default IKE default policies supported (see Table 95). The default IKE policies define the following policy set parameters:
•
•
•
•
•
–
–
Table 95
Default IKE Policies
If you have manually configured IKE policies and you issue the show crypto isakmp default policy command there is no output, since the default IKE policies are not in use.
Examples
The following example displays the eight default policies with protection suites of priorities 65507-65014. The default policies are displayed since there are no user configured policies, the default policies have not been disabled, and EzVPN is not configured.
Router# show crypto isakmp default policyDefault protection suite of priority 65507encryption algorithm: AES - Advanced Encryption Standard (128 bit keys).hash algorithm: Secure Hash Standardauthentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65508encryption algorithm: AES - Advanced Encryption Standard (128 bit keys).hash algorithm: Secure Hash Standardauthentication method: Pre-Shared KeyDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65509encryption algorithm: AES - Advanced Encryption Standard (128 bit keys).hash algorithm: Message Digest 5authentication method: Rivest-Shamir-Adleman signatureDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65510encryption algorithm: AES - Advanced Encryption Standard (128 bit keys).hash algorithm: Message Digest 5authentication method: pre-shared keyDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65511encryption algorithm: Three key triple DEShash algorithm: Secure Hash Standardauthentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65512encryption algorithm: Three key triple DEShash algorithm: Secure Hash Standardauthentication method: Pre-Shared KeyDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65513encryption algorithm: Three key triple DEShash algorithm: Message Digest 5authentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65514encryption algorithm: Three key triple DEShash algorithm: Message Digest 5authentication method: Pre-Shared KeyDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitThe following example shows that there is no output from the show crypto isakmp default policy command when the default policies have been disabled.
Router(config)# no crypto isakmp default policy! The default IKE policies have been disabled.Router(config)# exitRouter# configure terminalRouter# show crypto isakmp default policyRouter#! There is no output from the show crypto isakmp default policy command.Related Commands
crypto isakmp policy
Defines an IKE policy.
no crypto isakmp default policy
Disables IKE default policies.
show crypto isakmp policy
Displays the parameters for each IKE policy.
show crypto isakmp key
To list the keyrings and their preshared keys, use the show crypto isakmp key command in privileged EXEC mode.
show crypto isakmp key
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
12.2(15)T
This command was introduced.
12.4(4)T
IPv6 address information was added to command output.
Examples
The following is sample output for the show crypto isakmp key command:
Router# show crypto isakmp keyHostname/Address Preshared Keyvpn1 : 172.61.1.1 vpn1vpn2 : 10.1.1.1 vpn2The following configuration was in effect when the above show crypto isakmp key command was issued:
crypto keyring vpn1pre-shared-key address 172.16.1.1 key vpn1crypto keyring vpn2pre-shared-key address 10.1.1.1 key vpn2Table 96 describes significant fields in the show crypto isakmp key profile.
show crypto isakmp peers
To display peer descriptions, use the show crypto isakmp peers command in privileged EXEC mode.
show crypto isakmp peers [ipaddress] | config [peername]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
When using the config keyword, the following commands must be enabled for the accounting update to work correctly: aaa accounting update new info and radius-server vsa send accounting.
Examples
The following output example shows information about the peer named "This-is-another-peer-at-10-1-1-3":
Router# show crypto isakmp peersPeer: 10.1.1.3 Port: 500Description: This-is-another-peer-at-10-1-1-3Phase1 id: 10.1.1.3In the following example, the config keyword has been used to display all manageability information for an Easy VPN remote device:Router# show crypto isakmp peers configClient-Public-Addr=192.168.10.2:500; Client-Assigned-Addr=172.16.1.209; Client-Group=branch; Client-User=branch; Client-Hostname=branch.; Client-Platform=Cisco 1711; Client-Serial=FOC080210E2 (412454448); Client-Config-Version=11; Client-Flash=33292284; Client-Available-Flash=10202680; Client-Memory=95969280; Client-Free-Memory=14992140; Client-Image=flash:c1700-advipservicesk9-mz.ef90241;Client-Public-Addr=192.168.10.3:500; Client-Assigned-Addr=172.16.1.121; Client-Group=store; Client-User=store; Client-Hostname=831-storerouter.; Client-Platform=Cisco C831; Client-Serial=FOC08472UXR (1908379618); Client-Config-Version=2; Client-Flash=24903676; Client-Available-Flash=5875028; Client-Memory=45298688; Client-Free-Memory=6295596; Client-Image=flash:c831-k9o3y6-mz.ef90241Related Commands
clear crypto session
Deletes crypto sessions (IPSec and IKE) SAs.
show crypto session
Displays status information for active crypto sessions in a router.
show crypto isakmp policy
To display the parameters for each Internet Key Exchange (IKE) policy, use the show crypto isakmp policy command in privileged EXEC mode.
show crypto isakmp policy
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
There are eight default IKE default policies supported with protection suites of priorities 65507-65514, where 65507 is the highest priority and 65514 is the lowest priority. If you have neither manually configured IKE policies with the crypto isakmp policy command nor disabled the default IKE policies by issuing the no crypto isakmp default policy command, the default IKE policies will be displayed when the show crypto isakmp policy command is issued.
Examples
The following is sample output from the show crypto isakmp policy command, after two IKE policies have been configured (with priorities 15 and 20, respectively):
Router# show crypto isakmp policyProtection suite priority 15encryption algorithm: DES - Data Encryption Standard (56 bit keys)hash algorithm: Message Digest 5authentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman Group: #2 (1024 bit)lifetime: 5000 seconds, no volume limitProtection suite priority 20encryption algorithm: DES - Data Encryption Standard (56 bit keys)hash algorithm: Secure Hash Standardauthentication method: preshared KeyDiffie-Hellman Group: #1 (768 bit)lifetime: 10000 seconds, no volume limitDefault protection suiteencryption algorithm: DES - Data Encryption Standard (56 bit keys)hash algorithm: Secure Hash Standardauthentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman Group: #1 (768 bit)lifetime: 86400 seconds, no volume limit
Note
The following sample output from the show crypto isakmp policy command displays a warning message after a user tries to configure an IKE encryption method that the hardware does not support:
Router# show crypto isakmp policyProtection suite of priority 1encryption algorithm: AES - Advanced Encryption Standard (256 bit keys).WARNING:encryption hardware does not support the configuredencryption method for ISAKMP policy 1hash algorithm: Secure Hash Standardauthentication method: Pre-Shared KeyDiffie-Hellman group: #1 (768 bit)lifetime: 3600 seconds, no volume limitThe following sample output from the show crypto isakmp policy command displays the default IKE policies. The manually configured IKE policies with priorities 10 and 20 have been removed.
Router(config)# no crypto isakmp policy 10Router(config)# no crypto isakmp policy 20Router(config)# exitR1# show crypto isakmp policyDefault IKE policyProtection suite of priority 65507encryption algorithm: AES - Advanced Encryption Standard (128 bit key.hash algorithm: Secure Hash Standardauthentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitProtection suite of priority 65508encryption algorithm: AES - Advanced Encryption Standard (128 bit key.hash algorithm: Secure Hash Standardauthentication method: Pre-Shared KeyDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitProtection suite of priority 65509encryption algorithm: AES - Advanced Encryption Standard (128 bit key.hash algorithm: Message Digest 5authentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitProtection suite of priority 65510encryption algorithm: AES - Advanced Encryption Standard (128 bit key.hash algorithm: Message Digest 5authentication method: Pre-Shared KeyDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitProtection suite of priority 65511encryption algorithm: Three key triple DEShash algorithm: Secure Hash Standardauthentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitProtection suite of priority 65512encryption algorithm: Three key triple DEShash algorithm: Secure Hash Standardauthentication method: Pre-Shared KeyDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitProtection suite of priority 65513encryption algorithm: Three key triple DEShash algorithm: Message Digest 5authentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitProtection suite of priority 65514encryption algorithm: Three key triple DEShash algorithm: Message Digest 5authentication method: Pre-Shared KeyDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitThe field descriptions in the display are self-explanatory.
Related Commands
show crypto isakmp profile
To list all the Internet Security Association and Key Management Protocol (ISAKMP) profiles that are defined on a router, use the show crypto isakmp profile command in privileged EXEC mode.
show crypto isakmp profile [tag profilename | vrf vrfname]
Syntax Description
Command Modes
Privileged EXEC
Command History
12.2(15)T
This command was introduced.
12.4(4)T
IPv6 support was added.
12.4(11)T
The tag profilename and vrf vrfname keywords and arguments were added.
Examples
The following is sample output from the show crypto isakmp profile command:
Router# show crypto isakmp profileISAKMP PROFILE vpn1-raIdentities matched are:group vpn1-raIdentity presented is: ip-addressThe following sample output shows information for an IPv6 router:
Router# show crypto isakmp profileISAKMP PROFILE tomIdentities matched are:ipv6-address 2001:0DB8:0:1::1/32Certificate maps matched are:Identity presented is: ipv6-address fqdnkeyring(s): <none>trustpoint(s): <all>Table 97 describes the significant fields shown in the display.
The following configuration was in effect when the preceding show crypto isakmp profile command was issued:
crypto isakmp profile vpn1-ravrf vpn1self-identity addressmatch identity group vpn1-raclient authentication list aaa-listisakmp authorization list aaaclient configuration address initiateclient configuration address respondRelated Commands
show crypto isakmp sa
To display current Internet Key Exchange (IKE) security associations (SAs), use the show crypto isakmp sa command in privileged EXEC mode.
show crypto isakmp sa [active | standby | detail | nat] [vrf vrfname]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
If neither the active keyword nor the standby keyword is specified, current SAs for all configured routers will be shown. Use the nat keyword to display the IP address and port address of a remote peer when NAT is used.
Examples
The following sample output shows the SAs of both the active and standby devices:
Router# show crypto isakmp sadst src state conn-id slot status10.165.201.3 10.165.200.225 QM_IDLE 2 0 STDBY10.0.0.1 10.0.0.2 QM_IDLE 1 0 ACTIVEThe following sample output shows the SAs of only the active device:
Router# show crypto isakmp sa activedst src state conn-id slot status10.165.201.3 10.165.200.225 QM_IDLE 5 0 ACTIVEThe following sample output shows the SAs of only the standby device:
Router# show crypto isakmp sa standbydst src state conn-id slot status10.165.201.3 10.165.200.225 QM_IDLE 5 0 STDBY10.165.201.3 10.165.200.225 QM_IDLE 1 0 STDBYThe following sample output shows the SAs of an active IPv6 device. The IPv4 device is inactive.
Router# show crypto isakmp sa detail
Codes: C - IKE configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal
X - IKE Extended Authentication
psk - Preshared key, rsig - RSA signature
renc - RSA encryption
IPv4 Crypto ISAKMP SA
C-id Local Remote I-VRF Status Encr Hash Auth DH
Lifetime Cap.
IPv6 Crypto ISAKMP SA
dst: 3FFE:2002::A8BB:CCFF:FE01:2C02
src: 3FFE:2002::A8BB:CCFF:FE01:9002
conn-id: 1001 I-VRF: Status: ACTIVE Encr: des Hash: sha Auth:
psk
DH: 1 Lifetime: 23:45:00 Cap: D Engine-id:Conn-id = SW:1
dst: 3FFE:2002::A8BB:CCFF:FE01:2C02
src: 3FFE:2002::A8BB:CCFF:FE01:9002
conn-id: 1002 I-VRF: Status: ACTIVE Encr: des Hash: sha Auth:
psk
DH: 1 Lifetime: 23:45:01 Cap: D Engine-id:Conn-id = SW:2
Table 98 through Table 101 show the various states that may be displayed in the output of the show crypto isakmp sa command. When an Internet Security Association and Key Management Protocol (ISAKMP) SA exists, it will most likely be in its quiescent state (QM_IDLE). For long exchanges, some of the main mode (MM_xxx) states may be observed.
Related Commands
crypto isakmp policy
Defines an IKE policy.
lifetime (IKE policy)
Specifies the lifetime of an IKE SA.
show crypto key mypubkey rsa
To display the RSA public keys of your router, use the show crypto key mypubkey rsa command in privileged EXEC mode.
show crypto key mypubkey rsa
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
This command displays the RSA public keys of your router.
Note
Examples
The following is sample output from the show crypto key mypubkey rsa command. Special usage RSA keys were previously generated for this router using the crypto key generate rsa command.
% Key pair was generated at: 06:07:49 UTC Jan 13 1996Key name: myrouter.example.comUsage: Signature KeyKey Data:005C300D 06092A86 4886F70D 01010105 00034B00 30480241 00C5E23B 55D6AB2204AEF1BA A54028A6 9ACC01C5 129D99E4 64CAB820 847EDAD9 DF0B4E4C 73A05DD2BD62A8A9 FA603DD2 E2A8A6F8 98F76E28 D58AD221 B583D7A4 71020301 0001% Key pair was generated at: 06:07:50 UTC Jan 13 1996Key name: myrouter.example.comUsage: Encryption KeyKey Data:00302017 4A7D385B 1234EF29 335FC973 2DD50A37 C4F4B0FD 9DADE748 429618D518242BA3 2EDFBDD3 4296142A DDF7D3D8 08407685 2F2190A0 0B43F1BD 9A8A26DB07953829 791FCDE9 A98420F0 6A82045B 90288A26 DBC64468 7789F76E EE21The following example shows how to encrypt the RSA key "pki1-72a.cisco.com." Thereafter, the show crypto key mypubkey rsa command is issued to verify that the RSA key is encrypted (protected) and unlocked.
Router(config)# crypto key encrypt rsa name pki1-72a.cisco.com passphrase cisco1234Router(config)# exitRouter# show crypto key mypubkey rsa% Key pair was generated at:00:15:32 GMT Jun 25 2003
Key name:pki1-72a.cisco.com
Usage:General Purpose Key
*** The key is protected and UNLOCKED. ***
Key is not exportable.
Key Data:
305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00E0CC9A 1D23B52C
CD00910C ABD392AE BA6D0E3F FC47A0EF 8AFEE340 0EC1E62B D40E7DCC
23C4D09E
03018B98 E0C07B42 3CFD1A32 2A3A13C0 1FF919C5 8DE9565F 1F020301 0001
% Key pair was generated at:00:15:33 GMT Jun 25 2003
Key name:pki1-72a.cisco.com.server
Usage:Encryption Key
Key is exportable.
Key Data:
307C300D 06092A86 4886F70D 01010105 00036B00 30680261 00D3491E 2A21D383
854D7DA8 58AFBDAC 4E11A7DD E6C40AC6 66473A9F 0C845120 7C0C6EC8 1FFF5757
3A41CE04 FDCB40A4 B9C68B4F BC7D624B 470339A3 DE739D3E F7DDB549 91CD4DA4
DF190D26 7033958C 8A61787B D40D28B8 29BCD0ED 4E6275C0 6D020301 0001
Router#The following example shows how to lock the key "pki1-72a.cisco.com." Thereafter, the show crypto key mypubkey rsa command is issued to verify that the key is protected (encrypted) and locked.
Router# crypto key lock rsa name pki1-72a.cisco.com passphrase cisco1234!Router# show crypto key mypubkey rsa% Key pair was generated at:20:29:41 GMT Jun 20 2003Key name:pki1-72a.cisco.comUsage:General Purpose Key*** The key is protected and LOCKED. ***Key is exportable.Key Data:305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00D7808D C5FF14AC0D2B55AC 5D199F2F 7CB4B355 C555E07B 6D0DECBE 4519B1F0 75B12D6F 902D6E9FB6FDAD8D 654EF851 5701D5D7 EDA047ED 9A2A619D 5639DF18 EB020301 0001Related Commands
crypto key encrypt rsa
Encrypts the RSA private key.
crypto key generate rsa (IKE)
Generates RSA key pairs.
crypto key lock rsa
Locks the RSA private key in a router.
show crypto key pubkey-chain rsa
To display the Rivest, Shamir, and Adelman (RSA) public keys of the peer that are stored on your router, use the show crypto key pubkey-chain rsa command in User EXEC or privileged EXEC mode.
show crypto key pubkey-chain rsa [address key-address | name key-name | vrf vrf-name [address ip-address]]
Cisco IOS Release 12.2(33)SXI
show crypto key pubkey-chain rsa [name key-name]
Syntax Description
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
This command shows RSA public keys stored on your router. These include RSA public keys of peer routers manually configured on your router and keys received by your router via other means (such as by a certificate, if certification authority support is configured).
If a router reboots, any public key derived by the certificates are lost. The public key is derived again when the router requests for certificates.
Use the name or address keywords to display details about a particular RSA public key stored on your router.
If no keywords are used, this command displays a list of all RSA public keys stored on your router.
Examples
The following is sample output from the show crypto key pubkey-chain rsa command:
Router# show crypto key pubkey-chain rsaCodes: M - Manually Configured, C - Extracted from certificateCode Usage IP-address NameM Signature 209.165.200.225 myrouter.example.comM Encryption 209.165.202.129 myrouter.example.comC Signature 209.165.200.225 routerA.example.comC Encryption 209.165.202.129 routerA.example.comC General 209.165.200.225 routerB.domain1.comThis sample output shows manually configured special usage RSA public keys for the peer router. The peer router can be either Router A or Router B. This sample also shows three keys obtained from the certificates of peer routers: special usage keys for peer "routerA" and a general purpose key for peer "routerB."
If certificate support is not used, none of the keys of the peer router show "C" in the code column. You must configure them manually.
The following is sample output from the show crypto key pubkey-chain rsa command. This example also includes the vrf keyword.
Router# show crypto key pubkey-chain rsa vrf
Code Usage IP-Address/VRF Keyring NameM General 209.165.200.225 defaultM General 209.165.202.129 defaultThe following is sample output from the show crypto key pubkey-chain rsa name command:
Router# show crypto key pubkey-chain rsa name somerouter.example.comKey name: somerouter.example.comKey address: 209.165.200.225Usage: Signature KeySource: ManualData:305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00C5E23B 55D6AB2204AEF1BA A54028A6 9ACC01C5 129D99E4 64CAB820 847EDAD9 DF0B4E4C 73A05DD2BD62A8A9 FA603DD2 E2A8A6F8 98F76E28 D58AD221 B583D7A4 71020301 0001Key name: somerouter.example.comKey address: 209.165.200.225Usage: Encryption KeySource: ManualData:00302017 4A7D385B 1234EF29 335FC973 2DD50A37 C4F4B0FD 9DADE748 429618D518242BA3 2EDFBDD3 4296142A DDF7D3D8 08407685 2F2190A0 0B43F1BD 9A8A26DB07953829 791FCDE9 A98420F0 6A82045B 90288A26 DBC64468 7789F76E EE21
Note
The following is sample output from the show crypto key pubkey-chain rsa address 209.165.202.129 command:
Router# show crypto key pubkey-chain rsa address 209.165.202.129Key name: routerB.example.comKey address: 209.165.202.129Usage: General Purpose KeySource: CertificateData:0738BC7A 2BC3E9F0 679B00FE 53987BCC 01030201 42DD06AF E228D24C 458AD22858BB5DDD F4836401 2A2D7163 219F882E 64CE69D4 B583748A 241BED0F 6E7F2F160DE0986E DF02031F 4B0B0912 F68200C4 C625C389 0BFF3321 A2598935 C1B1
Note
Related Commands
rsa-pubkey
Defines the RSA manual key to be used for encryption or signature during IKE authentication.
show crypto map (IPsec)
To display the crypto map configuration, use the show crypto map command in user EXEC or privileged EXEC mode.
show crypto map [gdoi fail-close | interface interface | tag map-name]
Syntax Description
Command Default
No crypto maps are shown.
Command Modes
User EXEC (>)
Privileged EXEC (#)
Command History
Usage Guidelines
The show crypto map command allows you to specify a particular crypto map. The crypto maps shown in the command output have been dynamically generated; the user does not have to configure crypto maps in order for them to appear in this command output.
There are two default transform sets supported in Cisco IOS k9 images only:
•
•
The show crypto map command will display the default transform sets if there are no other transform sets configured for the crypto map, you have not disabled the default transform sets by issuing the no crypto ipsec default transform-set command, and the crypto engine supports the encryption algorithm.
Examples
The following example shows that crypto input and output ACLs have been configured:
Router# show crypto mapCrypto Map "test" 10 ipsec-isakmpPeerExtended IP access list ipsec_aclaccess-list ipsec_acl permit ip 192.168.2.0 0.0.0.255 192.168.102.0 0.0.0.255Extended IP access check IN list 110access-list 110 permit ip host 192.168.102.47 192.168.2.0 10.0.0.15access-list 110 permit ip host 192.168.102.47 192.168.2.32 10.0.0.15access-list 110 permit ip host 192.168.102.47 192.168.2.64 10.0.0.15access-list 110 permit ip host 192.168.102.57 192.168.2.0 10.0.0.15access-list 110 permit ip host 192.168.102.57 192.168.2.32 10.0.0.15access-list 110 permit ip host 192.168.102.57 192.168.2.64 10.0.0.15Extended IP access check OUT list 120access-list 120 permit ip 192.168.2.0 10.0.0.15 host 192.168.102.47access-list 120 permit ip 192.168.2.32 10.0.0.15 host 192.168.102.47access-list 120 permit ip 192.168.2.64 10.0.0.15 host 192.168.102.47access-list 120 permit ip 192.168.2.0 10.0.0.15 host 192.168.102.57access-list 120 permit ip 192.168.2.32 10.0.0.15 host 192.168.102.57access-list 120 permit ip 192.168.2.64 10.0.0.15 host 192.168.102.57Current peer: 10.0.0.2Security association lifetime: 4608000 kilobytes/3600 secondsPFS (Y/N): NTransform sets=testInterfaces using crypto map test:Serial0/1Table 102 describes the output in the display.
The following example displays the output of the show crypto map command. There are no transform sets configured for the crypto map "mymap", the default transform sets are enabled, and the crypto engine supports the encryption algorithm.
Router# show crypto mapCrypto Map "mymap" 1 ipsec-isakmpPeer = 10.1.1.1Extended IP access list 102access-list 102 permit ip 192.168.1.0 0.0.0.255 10.0.0.0 0.0.255.255Security association lifetime: 4608000 kilobytes/3600 secondsPFS (Y/N): NTransform sets={#$!default_transform_set_1: { esp-aes esp-sha-hmac } ,#$!default_transform_set_0: { esp-3des esp-sha-hmac } ,}Reverse Route Injection EnabledInterfaces using crypto map mymap:The following example displays the output of the show crypto map command. There are no transform sets configured for the crypto map "mymap" and the default transform sets have been disabled.
Router(config)# no crypto ipsec default transform-setRouter(config)# exitRouter# configure terminalRouter# show crypto mapCrypto Map "mymap" 1 ipsec-isakmpPeer = 10.1.1.1Extended IP access list 102access-list 102 permit ip 192.168.1.0 0.0.0.255 10.0.0.0 0.0.255.255Security association lifetime: 4608000 kilobytes/3600 secondsPFS (Y/N): NTransform sets={}! There are no transform sets for the crypto map "mymap."Reverse Route Injection EnabledInterfaces using crypto map mymap:The following example displays output for the show crypto map command and gdoi fail-close keyword (show crypto map gdoi fail-close). Fail-close has been activated. In addition, an implicit "permit ip any any" entry is configured, causing any traffic other than Telnet and Open Shortest Path First (OSPF) to be dropped:
Router# show crypto map gdoi fail-closeCrypto Map: "svn"Activate: yesFail-Close Access-List: (Deny = Forward In Clear, Permit = Drop)access-list 105 deny tcp any port = 23 anyaccess-list 105 deny ospf any anyRelated Commands
show crypto ipsec default transform-set
Displays the default IPsec transform sets.
show crypto ipsec transform-set
Displays the configured transform sets.
show crypto mib ipsec flowmib endpoint
To display the IP Security (IPsec) phase-2 tunnel endpoint table, use the show crypto mib ipsec flowmib endpoint command in privileged EXEC mode.
show crypto mib ipsec flowmib endpoint [vrf vrf-name]
Syntax Description
vrf vrf-name
(Optional) Displays the parameters for the specified Virtual Private Network (VPN) routing and forwarding (VRF) instance.
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Usage Guidelines
The IPsec phase-2 tunnel endpoint table contains an entry for each active endpoint associated with an IPsec phase-2 tunnel.
Examples
The following example displays the IPsec phase 2 tunnel endpoint table for all VRFs:
Router# show crypto mib ipsec flowmib endpointvrf GlobalIndex: 1Local type: Single IP addressLocal address: 192.1.2.1Protocol: 0Local port: 0Remote type: Single IP addressRemote address: 192.1.2.2Remote port: 0Index: 2Local type: SubnetLocal address: 192.1.3.0 255.255.255.0Protocol: 0Local port: 0Remote type: SubnetRemote address: 192.1.3.0 255.255.255.0Remote port: 0Table 103 describes the significant fields shown in the display.
Related Commands
show crypto mib ipsec flowmib failure
To display statistics associated with IP Security (IPsec) phase-2 failure, use the show crypto mib ipsec flowmib failure command in privileged EXEC mode.
show crypto mib ipsec flowmib failure [vrf vrf-name]
Syntax Description
vrf vrf-name
(Optional) Displays the parameters for the specified Virtual Private Network (VPN) routing and forwarding (VRF) instance.
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Examples
The following example displays the IPsec phase 2 MIB failure table for all indexes and VRFs:
Router# show crypto mib ipsec flowmib failurevrf GlobalIndex:
