-
Cisco IOS Security Command Reference
-
Introduction
-
aaa accounting through aaa local authentication attempts max-fail
-
aaa max-sessions through algorithm
-
all (profile map configuration) through browser-proxy
-
ca trust-point through clear eou
-
clear ip access-list counters through crl-cache none
-
crypto aaa attribute list through crypto ipsec transform-set
-
crypto isakmp aggressive-mode disable through crypto mib ipsec flowmib history tunnel size
-
crypto pki authenticate through ctype
-
database archive through dns
-
dnsix-dmdp retries through dynamic
-
E
-
F through H
-
icmp idle-timeout through ip http ezvpn
-
ip inspect through ip security strip
-
ip source-track through ivrf
-
K through L
-
mac access-group through max-users (WebVPN)
-
message retry count through outgoing
-
parameter through port-misuse
-
ppp accounting through quit
-
radius attribute nas-port-type through rate-limit (firewall)
-
reauthentication time through rsa-pubkey
-
sa ipsec through sessions maximum
-
set aggressive-mode client-endpoint through show class-map type urlfilter
-
show crypto ace redundancy through show crypto vlan
-
show diameter peer through show object-group
-
show parameter-map type consent through show users
-
show vlan group through switchport port-security violation
-
tacacs-server administration through title-color
-
traffic-export through zone security
-
Feedback
Table Of Contents
show crypto call admission statistics
show crypto engine accelerator logs
show crypto engine accelerator ring
show crypto engine accelerator sa-database
show crypto engine accelerator statistic
show crypto ikev2 diagnose error
show crypto ipsec client ezvpn
show crypto ipsec default transform-set
show crypto ipsec security-association idle-time
show crypto ipsec security-association lifetime
show crypto ipsec transform-set
show crypto isakmp default policy
show crypto key pubkey-chain rsa
show crypto mib ipsec flowmib endpoint
show crypto mib ipsec flowmib failure
show crypto mib ipsec flowmib global
show crypto mib ipsec flowmib history
show crypto mib ipsec flowmib history failure size
show crypto mib ipsec flowmib history tunnel size
show crypto mib ipsec flowmib spi
show crypto mib ipsec flowmib tunnel
show crypto mib ipsec flowmib version
show crypto mib isakmp flowmib failure
show crypto mib isakmp flowmib global
show crypto mib isakmp flowmib history
show crypto mib isakmp flowmib peer
show crypto mib isakmp flowmib tunnel
show crypto pki certificates storage
show crypto pki server certificates
show crypto pki server requests
show crypto ace redundancy
To display information about a Blade Failure Group, use the show crypto ace redundancy command in privileged EXEC mode.
show crypto ace redundancy
Defaults
No default behavior or values.
Command Modes
Privileged EXEC (#)
Command History
Examples
The following example shows information about a Blade Failure Group that has a group ID of 1 and consists of two IPSec VPN SPAs—one IPSec VPN SPA is in slot 3, subslot 0 and one IPSec VPN SPA is in slot 5, subslot 0:
Router# show crypto ace redundancy--------------------------------------LC Redundancy Group ID :1Pending Configuration Transactions:0Current State :OPERATIONALNumber of blades in the group :2Slots--------------------------------------Slot:3 Subslot:0Slot state:0x36BootedReceived partner configCompleted Bulk SynchronizationCrypto Engine in ServiceRebooted 22 timesInitialization Timer not runningSlot:5 Subslot:0Slot state:0x36BootedReceived partner configCompleted Bulk SynchronizationCrypto Engine in ServiceRebooted 24 timesInitialization Timer not runningACE B2B Group State:OPERATIONAL Event:BULK DONEACE B2B Group State:CREATED Event:CONFIG_DOWNLOAD_DONEACE B2B Group State:DELETED Event:CONFIG_DELETEACE B2B Group State:OPERATIONAL Event:BULK DONEACE B2B Group State:CREATED Event:CONFIG_DOWNLOAD_DONEACE B2B Group State:DELETED Event:CONFIG_DELETEACE B2B Group State:OPERATIONAL Event:CONFIG_DOWNLOAD_DONEACE B2B Group State:DELETED Event:CONFIG_ADDACE B2B Group State:CREATED Event:UNDEFINED B2B HA EVENTACE B2B Group State:CREATED Event:CONFIG_DOWNLOAD_DONERelated Commands
show crypto ca certificates
Note
This command was replaced by the show crypto pki certificates command effective with Cisco IOS Release 12.3(7)T.
To display information about your certificate, the certification authority certificate, and any registration authority certificates, use the show crypto ca certificates command in privileged EXEC mode.
show crypto ca certificates
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
This command shows information about the following certificates:
•
•
•
Examples
The following is sample output from the show crypto ca certificates command after you authenticated the CA by requesting the CA's certificate and public key with the crypto pki authenticate command:
CA CertificateStatus: AvailableCertificate Serial Number: 3051DF7123BEE31B8341DFE4B3A338E5FKey Usage: Not SetThe CA certificate might show Key Usage as "Not Set."
The following is sample output from the show crypto ca certificates command, and shows the router's certificate and the CA's certificate. In this example, a single, general purpose RSA key pair was previously generated, and a certificate was requested but not received for that key pair.
CertificateSubject NameName: myrouter.example.comIP Address: 10.0.0.1Serial Number: 04806682Status: PendingKey Usage: General PurposeFingerprint: 428125BD A3419600 3F6C7831 6CD8FA95 00000000CA CertificateStatus: AvailableCertificate Serial Number: 3051DF7123BEE31B8341DFE4B3A338E5FKey Usage: Not SetNote that in the previous sample, the router's certificate Status shows "Pending." After the router receives its certificate from the CA, the Status field changes to "Available" in the show output.
The following is sample output from the show crypto ca certificates command, and shows two router's certificates and the CA's certificate. In this example, special usage RSA key pairs were previously generated, and a certificate was requested and received for each key pair.
CertificateSubject NameName: myrouter.example.comIP Address: 10.0.0.1Status: AvailableCertificate Serial Number: 428125BDA34196003F6C78316CD8FA95Key Usage: SignatureCertificateSubject NameName: myrouter.example.comIP Address: 10.0.0.1Status: AvailableCertificate Serial Number: AB352356AFCD0395E333CCFD7CD33897Key Usage: EncryptionCA CertificateStatus: AvailableCertificate Serial Number: 3051DF7123BEE31B8341DFE4B3A338E5FKey Usage: Not SetThe following is sample output from the show crypto ca certificates command when the CA supports an RA. In this example, the CA and RA certificates were previously requested with the crypto ca authenticate command.
CA CertificateStatus: AvailableCertificate Serial Number: 3051DF7123BEE31B8341DFE4B3A338E5FKey Usage: Not SetRA Signature CertificateStatus: AvailableCertificate Serial Number: 34BCF8A0Key Usage: SignatureRA KeyEncipher CertificateStatus: AvailableCertificate Serial Number: 34BCF89FKey Usage: EncryptionRelated Commands
show crypto ca crls
Note
To display the current certificate revocation list (CRL) on router, use the show crypto ca crls command in privileged EXEC mode.
show crypto ca crls
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Examples
The following is sample output of the show crypto ca crls command:
Router# show crypto ca crlsCRL Issuer Name:OU = sjvpn, O = cisco, C = usLastUpdate: 16:17:34 PST Jan 10 2002NextUpdate: 17:17:34 PST Jan 11 2002Retrieved from CRL Distribution Point:LDAP: CN = CRL1, OU = sjvpn, O = cisco, C = usRelated Commands
crypto pki crl request
Requests that a new CRL be obtained immediately from the CA.
show crypto ca roots
The show crypto ca roots command is replaced by the show crypto ca trustpoints command. See the show crypto ca trustpoints command for more information.
show crypto ca timers
Note
To display the status of the managed timers that are maintained by Cisco IOS for public key infrastructure (PKI), use the show crypto ca timers command in privileged EXEC mode.
show crypto ca timers
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
12.2(8)T
This command was introduced.
12.2(18)SXD
This command was integrated into Cisco IOS Release 12.2(18)SXD.
Usage Guidelines
For each timer, this command displays the time remaining before the timer expires. It also associates trustpoint certification authorities (CAs), except for certificate revocation list (CRL) timers, by displaying the CRL distribution point.
Examples
The following example is sample output for the show crypto ca timers command:
Router# show crypto ca timersPKI Timers| 4d15:13:33.144| 4d15:13:33.144 CRL http://msca-root.cisco.com/CertEnroll/msca-root.crl|328d11:56:48.372 RENEW msroot| 6:43.201 POLL verisignRelated Commands
auto-enroll
Enables autoenrollment.
crypto pki trustpoint
Declares the CA that your router should use.
show crypto ca trustpoints
Note
To display the trustpoints that are configured in the router, use the show crypto pki trustpoints command in privileged EXEC or user EXEC mode.
show crypto ca trustpoints
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
User EXEC (>)Command History
Usage Guidelines
This command replaces the show crypto ca roots command. If you enter the show crypto ca roots command, the output will be written back as the show crypto pki trustpoints command.
Examples
The following is sample output from the show crypto ca trustpoints command:
Router# show crypto ca trustpointsTrustpoint bo:Subject Name:CN = bomborra Certificate ManagerO = cisco.comC = USSerial Number:01Certificate configured.CEP URL:http://bomborraCRL query url:ldap://bomborraRelated Commands
show crypto call admission statistics
To monitor Crypto Call Admission Control (CAC) statistics, use the show crypto call admission statistics command in user EXEC or privileged EXEC mode.
show crypto call admission statistics
Syntax Description
This command has no arguments or keywords.
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
Enter this command to display information about the Crypto CAC configuration parameters and their history, including statistics regarding the current security association (SA) count, SAs being negotiated, total new SA requests, the number of Internet Key Exchange (IKE) and IPsec SA requests accepted and rejected, and details regarding why requests were rejected.
Examples
The following is sample output from the show crypto call admission statistics command:
Router# show crypto call admission statistics---------------------------------------------------------------------Crypto Call Admission Control Statistics---------------------------------------------------------------------System Resource Limit: 111 Max IKE SAs: 0 Max in nego: 1000Total IKE SA Count: 0 active: 0 negotiating: 0Incoming IKE Requests: 0 accepted: 0 rejected: 0Outgoing IKE Requests: 0 accepted: 0 rejected: 0Rejected IKE Requests: 0 rsrc low: 0 Active SA limit: 0In-neg SA limit: 0IKE packets dropped at dispatch: 0Max IPSEC SAs: 111Total IPSEC SA Count: 0 active: 0 negotiating: 0Incoming IPSEC Requests: 0 accepted: 0 rejected: 0Outgoing IPSEC Requests: 0 accepted: 0 rejected: 0Phase1.5 SAs under negotiation: 0Table 82 describes the significant fields shown in the display.
Related Commands
clear crypto call admission statistics
Clears the counters that track the number of accepted and rejected IKE SA requests.
show crypto ctcp
To display information about a Cisco Tunnel Control Protocol (cTCP) session, use the show crypto ctcp command in privileged EXEC mode.
show crypto ctcp [peer ip-address] [detail]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Examples
The following show command output displays detailed information about a specific peer:
Router# show crypto ctcp peer 10.76.235.21 detailRemote Local VRF Status10.76.235.21:3519 10.76.248.239:10000 CTCP_ACK_RLocalSeq#6807392F RemoteSeq#010116C7Table 83 provides information about significant fields in the display.
Related Commands
show crypto datapath
To display the counters that help troubleshoot an encrypted data path, use the show crypto datapath command in privileged EXEC mode.
show crypto datapath {ipv4 | ipv6} {realtime | snapshot} {all | non-zero} [error | internal | punt | success]
Syntax Description
Command Default
The command defaults are:
•
•
•
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the show crypto datapath counters command to troubleshoot an encrypted data path.
Note
You must specify the IP version used in the network. You can display all counters, only the counters that have recorded events, or one of these specific counters:
•
•
•
•
You must also choose the display timeframe for the counters:
•
•
Examples
The following example shows output from the show crypto datapath command. In this example, the snapshot option is specified for the timeframe, and only counters that have recorded events are displayed. The output of this command is intended for use by Cisco TAC engineers.
Router# show crypto datapath ipv4 snapshot non-zeroSuccess Statistics: Snapshot at 21:34:30 PST Mar 4 2006crypto check input core2nd round ok: 245 1st round ok: 118post crypto ip encryptpost encrypt ipflowok: 230crypto ceal post encrypt switchpost encrypt ipflowok-2: 230Error Statistics: Snapshot at 21:34:30 PST Mar 4 2006Punt Statistics: Snapshot at 21:34:30 PST Mar 4 2006crypto ceal post decrypt switchfs to ps: 245Internal Statistics: Snapshot at 21:34:30 PST Mar 4 2006crypto check inputcheck input core not con 378 check input core consume 623crypto check input corecame back from ce: 245 deny pak: 15crypto ipsec les fsnot esp or ah: 1113post crypto ip decryptdecrypt switch: 245crypto decrypt ipsec sa checkcheck ident success: 245crypto ceal post decrypt switchfs: 245crypto ceal post decrypt fsles ip turbo fs: 245 tunnel ip les fs: 245crypto ceal post decrypt psproc inline: 245crypto ceal punt to process inlinecoalesce: 245 simple enq: 245crypto ceal post encrypt switchps: 230crypto ceal post encrypt psps coalesce: 230 simple enq: 230crypto engine ps vecip encrypt: 230crypto send epa packetsucast next hop: 230 ip ps send: 230Related Commands
show crypto debug-condition
To display crypto debug conditions that have already been enabled in the router, use the show crypto debug-condition command in privileged EXEC mode.
show crypto debug-condition {[peer] [connid] [spi] [fvrf] [gdoi-group groupname]
[isakmp profile profile-name] [ivrf] [local ip-address] [unmatched] [username username]}Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
You can specify as many filter values as specified via the debug crypto condition command. (You cannot specify a filter value that you did not use in the debug crypto condition command.)
Examples
The following example shows how to display debug messages when the peer IP address is 10.1.1.1, 10.1.1.2, or 10.1.1.3 and when the connection ID 2000 of crypto engine 0 is used. This example also shows how to enable global debug crypto CLIs and enable the show crypto debug-condition command to verify conditional settings.
Router# debug crypto condition connid 2000 engine-id 1Router# debug crypto condition peer ipv4 10.1.1.1Router# debug crypto condition peer ipv4 10.1.1.2Router# debug crypto condition peer ipv4 10.1.1.3Router# debug crypto condition unmatched! Verify crypto conditional settings.Router# show crypto debug-conditionCrypto conditional debug currently is turned ONIKE debug context unmatched flag:ONIPsec debug context unmatched flag:ONCrypto Engine debug context unmatched flag:ONIKE peer IP address filters:10.1.1.1 10.1.1.2 10.1.1.3Connection-id filters:[connid:engine_id]2000:1,! Enable global crypto CLIs to start conditional debugging.Router# debug crypto isakmpRouter# debug crypto ipsecRouter# debug crypto engineThe following example shows how to disable all crypto conditional settings via the reset keyword:
Router# debug crypto condition reset! Verify that all crypto conditional settings have been disabled.Router# show crypto debug-conditionCrypto conditional debug currently is turned OFFIKE debug context unmatched flag:OFFIPsec debug context unmatched flag:OFFCrypto Engine debug context unmatched flag:OFFRelated Commands
show crypto dynamic-map
To display a dynamic crypto map set, use the show crypto dynamic-map command in privileged EXEC mode.
show crypto dynamic-map [tag map-name]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the show crypto dynamic-map command to view a dynamic crypto map set.
Examples
The following is sample output for the show crypto dynamic-map command:
Router# show crypto dynamic-mapCrypto Map Template"vpn1" 1ISAKMP Profile: vpn1-raNo matching address list set.Security association lifetime: 4608000 kilobytes/3600 secondsPFS (Y/N): NTransform sets={vpn1,The following partial configuration was in effect when the above show crypto dynamic-map command was issued:
crypto dynamic-map vpn1 1set transform-set vpn1set isakmp-profile vpn1-rareverse-routeRelated Commands
show crypto eli
To display how many IKE-SAs and IPSec sessions are active and how many Diffie-Hellman keys are in use for each hardware crypto engine, use the show crypto eli in user EXEC or privileged EXEC mode.
show crypto eli
Syntax Description
This command has no arguments or keywords.
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
Use this command to obtain a snapshot of how many Internet Key Exchange (IKE) and IP Security (IPSec) sessions are active and how many Diffie-Hellman keys are in use for each hardware crypto engine. The show crypto eli command also allows you to see how far an ISA is from reaching its maximum limit.
Note
(The eli component of the command calls the Encryption Layer Interface.)
Examples
The following is sample output for the show crypto eli command:
Router# show crypto eliEncryption Layer : ACTIVENumber of crypto engines = 2.Slot-3 crypto engine details.Capability-IPSec :No-IPPCP, 3DES, NoRSAIKE-Session : 0 active, 2029 max, 0 failedDH-Key : 0 active, 1014 max, 0 failedIPSec-Session : 0 active, 4059 max, 0 failedSlot-5 crypto engine details.Capability-IPSec :No-IPPCP, 3DES, NoRSAIKE-Session : 0 active, 2029 max, 0 failedDH-Key : 0 active, 1014 max, 0 failedIPSec-Session : 0 active, 4059 max, 0 failedThe following is sample output for the show crypto eli command for the IPSec VPN SPA:
Router# show crypto eli>>Hardware Encryption : ACTIVE>> Number of hardware crypto engines = 2>>>> CryptoEngine SPA-IPSEC-2G[3/0] details: state = Active>> Capability :>> IPSEC: DES, 3DES, AES, RSA>>>> IKE-Session : 0 active, 16383 max, 0 failed>> DH : 0 active, 9999 max, 0 failed>> IPSec-Session : 0 active, 65534 max, 0 failed>>>> CryptoEngine SPA-IPSEC-2G[3/1] details: state = Active>> Capability :>> IPSEC: DES, 3DES, AES, RSA>>>> IKE-Session : 1 active, 16383 max, 0 failed>> DH : 0 active, 9999 max, 0 failed>> IPSec-Session : 2 active, 65534 max, 0 failedTable 84 describes significant fields shown in the display.
show crypto eng qos
To monitor and maintain low latency queueing (LLQ) for IPSec encryption engines, use the show crypto eng qos command in privileged EXEC mode.
show crypto eng qos
Syntax Description
This command has no keywords or arguments.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the show crypto eng qos command to determine if QoS is enabled on LLQ for IPSec encryption engines.
Examples
The following example shows how to determine if LLQ for IPSec encryption engines is enabled:
Router# show crypto eng qoscrypto engine name: Multi-ISA Using VAM2crypto engine type: hardwareslot: 5queuing: enabledvisible bandwidth: 30000 kbpsllq size: 0default queue size/max: 0/64interface table size: 32FastEthernet0/0 (3), iftype 1, ctable size 16, input filter:ipprecedence 5class voice (1/3), match ip precedence 5bandwidth 500 kbps, max token 100000IN match pkt/byte 0/0, police drop 0OUT match pkt/byte 0/0, police drop 0class default, match pkt/byte 0/0, qdrop 0crypto engine bandwidth:total 30000 kbps, allocated 500 kbpsThe field descriptions in the above display are self-explanatory.
show crypto engine
To display a summary of the configuration information for the crypto engines, use the show crypto engine command in privileged EXEC mode.
show crypto engine {accelerator {statistic | ring {control | packet | pool}} | brief | configuration | connections {active | dh | dropped-packet | flow} | qos | token [detail]}
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
This command displays all crypto engines and displays the AIM-VPN product name.
If a hardware crypto engine does not support native Group Domain of Interpretation (GDOI) header preservation, the show crypto engine connections active output for Group Encrypted Transport VPN (GET VPN) IP security (IPsec) connections displays a disallowed IP address of 0.0.0.0 (see the show crypto engine connections active "Examples" section).
Examples
The following is sample output from the show crypto engine brief command shows typical crypto engine summary information:
Router# show crypto engine briefcrypto engine name: Virtual Private Network (VPN) Modulecrypto engine type: hardwareState: EnabledLocation: aim 0VPN Module in slot: 0Product Name: AIM-VPN/SSL-3Software Serial #: 55AADevice ID: 001F - revision 0000Vendor ID: 0000Revision No: 0x001F0000VSK revision: 0Boot version: 255DPU version: 0HSP version: 3.3(18) (PRODUCTION)Time running: 23:39:30Compression: YesDES: Yes3 DES: YesAES CBC: Yes (128,192,256)AES CNTR: NoMaximum buffer length: 4096Maximum DH index: 3500Maximum SA index: 3500Maximum Flow index: 7000Maximum RSA key size: 2048crypto engine name: Cisco VPN Software Implementationcrypto engine type: softwareserial number: CAD4FCE1crypto engine state: installedcrypto engine in slot: N/ATable 85 describes the significant fields shown in the display.
The following is sample output from show crypto engine command shows IPv6 information:
Router# show crypto engine connectionsID Interface Type Algorithm Encrypt Decrypt IP-Address1 Et2/0 IPsec MD5 0 46 FE80::A8BB:CCFF:FE01:2C022 Et2/0 IPsec MD5 41 0 FE80::A8BB:CCFF:FE01:2C025 Tu0 IPsec SHA+DES 0 0 3FFE:2002::A8BB:CCFF:FE01:2C026 Tu0 IPsec SHA+DES 0 0 3FFE:2002::A8BB:CCFF:FE01:2C021001 Tu0 IKE SHA+DES 0 0 3FFE:2002::A8BB:CCFF:FE01:2C02The following show crypto engine command output displays information for a situation in which a hardware crypto engine does not support native GDOI:
Router# show crypto engine connections activeCrypto Engine ConnectionsID Interface Type Algorithm Encrypt Decrypt IP-Address1079 Se0/0/0.10 IPsec AES+SHA 0 0 0.0.0.01080 Se0/0/0.10 IPsec AES+SHA 0 0 0.0.0.04364 <none> IKE SHA+3DES 0 04381 <none> IKE SHA+3DES 0 0Related Commands
crypto engine accelerator
Enables the use of the onboard hardware accelerator for IPSec encryption.
show crypto engine accelerator logs
To display information about the last 32 CryptoGraphics eXtensions (CGX) Library packet processing commands and associated parameters sent from the VPN module driver to the VPN module hardware, use the show crypto engine accelerator logs command in privileged EXEC mode.
show crypto engine accelerator logs
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
12.1(1)XC
This command was introduced on the Cisco 1720 and Cisco 1750 platforms.
12.1(2)T
This command was integrated into Cisco IOS Release 12.1(2)T.
Usage Guidelines
Use this command when encrypted traffic is sent to the router and a problem with the encryption module is suspected. Use the debug crypto engine accelerator logs command to enable command logging before using this command.
Note
Examples
The following is sample output for the show crypto engine accelerator logs command:
Router# show crypto engine accelerator logsContents of packet log (current index = 20):tag = 0x5B02, cmd = 0x5000param[0] = 0x000E, param[1] = 0x57E8param[2] = 0x0008, param[3] = 0x0000param[4] = 0x0078, param[5] = 0x0004param[6] = 0x142C, param[7] = 0x142Cparam[8] = 0x0078, param[9] = 0x000Ctag = 0x5B03, cmd = 0x4100param[0] = 0x000E, param[1] = 0x583Cparam[2] = 0x0034, param[3] = 0x0040param[4] = 0x00B0, param[5] = 0x0004param[6] = 0x1400, param[7] = 0x1400param[8] = 0x0020, param[9] = 0x000Ctag = 0x5C00, cmd = 0x4100param[0] = 0x000E, param[1] = 0x57BCparam[2] = 0x0034, param[3] = 0x0040param[4] = 0x00B0, param[5] = 0x0004param[6] = 0x1400, param[7] = 0x1400param[8] = 0x0020, param[9] = 0x000C...tag = 0x5A01, cmd = 0x4100param[0] = 0x000E, param[1] = 0x593Cparam[2] = 0x0034, param[3] = 0x0040param[4] = 0x00B0, param[5] = 0x0004param[6] = 0x1400, param[7] = 0x1400param[8] = 0x0020, param[9] = 0x000CContents of cgx log (current index = 12):cmd = 0x0074 ret = 0x0000param[0] = 0x0010, param[1] = 0x028Eparam[2] = 0x0039, param[3] = 0x0D1Eparam[4] = 0x0100, param[5] = 0x0000param[6] = 0x0000, param[7] = 0x0000param[8] = 0x0000, param[9] = 0x0000cmd = 0x0062 ret = 0x0000param[0] = 0x0035, param[1] = 0x1BE0param[2] = 0x0100, param[3] = 0x0222param[4] = 0x0258, param[5] = 0x0000param[6] = 0x0000, param[7] = 0x0000param[8] = 0x0000, param[9] = 0x0000cmd = 0x0063 ret = 0x0000param[0] = 0x0222, param[1] = 0x0258param[2] = 0x0000, param[3] = 0x0000param[4] = 0x0000, param[5] = 0x0000param[6] = 0x0000, param[7] = 0x020Aparam[8] = 0x002D, param[9] = 0x0000...cmd = 0x0065 ret = 0x0000param[0] = 0x0222, param[1] = 0x0258param[2] = 0x0010, param[3] = 0x028Eparam[4] = 0x00A0, param[5] = 0x0008param[6] = 0x0001, param[7] = 0x0000param[8] = 0x0000, param[9] = 0x0000Related Commands
debug crypto engine acclerator logs
Enables logging of commands and associated parameters sent from the VPN module driver to the VPN module hardware using a debug flag.
show crypto engine accelerator ring
To display the contents and status of the control command, transmit packets, and receive packet rings used by the hardware accelerator crypto engine, use the show crypto engine accelerator ring command in privileged EXEC mode.
show crypto engine accelerator ring [control | packet | pool]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
This command displays the command ring information.
If there were valid data in any of the rings, the ring entry would be printed.
Examples
The following example shows the command ring information:
Router# show crypto engine accelerator ring packetPPQ RING:cmd ring:head = 10 tail =10result ring:head = 10 tail =10destination ring:head = 10 tail =10source ring:head = 10 tail =10free ring:head = 0 tail =25500000000 071A96C500000000 071A96C500000001 071A946500000001 071A946500000002 071A920500000002 071A9205...Related Commands
show crypto engine accelerator sa-database
To display active (in-use) entries in the platform-specific virtual private network (VPN) module database, use the show crypto engine accelerator sa-database command in privileged EXEC mode.
show crypto engine accelerator sa-database
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
12.1(1)XC
This command was introduced on the Cisco 1720 and Cisco 1750 platforms.
12.1(2)T
This command was integrated into Cisco IOS Release 12.1(2)T.
Usage Guidelines
Use this command when encrypted traffic is sent to the router and a problem with the encryption module is suspected.
Note
Examples
The following is sample output for the show crypto engine accelerator sa-database command:
Router# show crypto engine accelerator sa-databaseFlow SummaryIndex Algorithms005 tunnel inbound esp-md5-hmac esp-des ah-sha-hmac006 tunnel outbound esp-md5-hmac esp-des ah-sha-hmac007 tunnel inbound esp-md5-hmac esp-des ah-sha-hmac008 tunnel outbound esp-md5-hmac esp-des ah-sha-hmac009 tunnel inbound esp-md5-hmac esp-des ah-sha-hmac010 tunnel outbound esp-md5-hmac esp-des ah-sha-hmacSA Summary:Index DH-Index Algorithms003 001(deleted) DES SHA004 002(deleted) DES SHADH SummaryIndex Group ConfigRelated Commands
debug crypto engine acclerator logs
Enables logging of commands and associated parameters sent from the VPN module driver to the VPN module hardware using a debug flag.
show crypto engine accelerator statistic
To display IP Security (IPsec) encryption statistics and error counters for the onboard hardware accelerator of the router or the IPsec Virtual Private Network (VPN) Shared Port Adapter (SPA), use the show crypto engine accelerator statistic command in privileged EXEC mode.
show crypto engine accelerator statistic
IPsec VPN SPA (SPA-IPSEC-2G) and VSPA (WS-IPSEC-3G)
show crypto engine accelerator statistic [slot slot/subslot | all] [coreutil | detail]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
No specific usage guidelines apply to the hardware accelerators.
IPsec VPN SPA and VSPA
Enter the slot keyword to display platform statistics for the corresponding SPA. This output will not include network interface controller statistics.
Enter the all keyword to display platform statistics for all IPsec VPN SPAs and VSPAs on the router. This output will not include network interface controller statistics.
Enter the detail keyword to display platform statistics for the SPA and network interface controller statistics. Note that the controller statistics contain L2 counters.
VSPA
Enter the coreutil keyword to display VPN core utilization statistics. This output will not include network interface controller statistics.
Tip
Examples
Hardware VPN Module
The following example displays compression statistics for a hardware VPN module:
Router# show crypto engine accelerator statisticDevice: AIM-VPN/SSL-3Location: AIM Slot: 0Virtual Private Network (VPN) Module in slot : 0Statistics for Hardware VPN Module since the last clearof counters 85319 seconds ago560 packets in 560 packets out95600 bytes in 124720 bytes out0 paks/sec in 0 paks/sec out0 Kbits/sec in 0 Kbits/sec out0 packets decrypted 560 packets encrypted0 bytes before decrypt 124720 bytes encrypted0 bytes decrypted 95600 bytes after encrypt0 packets decompressed 0 packets compressed0 bytes before decomp 0 bytes before comp0 bytes after decomp 0 bytes after comp0 packets bypass decompr 0 packets bypass compres0 bytes bypass decompres 0 bytes bypass compressi0 packets not decompress 0 packets not compressed0 bytes not decompressed 0 bytes not compressed1.0:1 compression ratio 1.0:1 overall10426 commands out 10426 commands acknowledgedLast 5 minutes:0 packets in 0 packets out0 paks/sec in 0 paks/sec out0 bits/sec in 0 bits/sec out0 bytes decrypted 0 bytes encrypted0 Kbits/sec decrypted 0 Kbits/sec encrypted1.0:1 compression ratio 1.0:1 overallErrors:ppq full errors : 0 ppq rx errors : 0cmdq full errors : 0 cmdq rx errors : 0ppq down errors : 0 cmdq down errors : 0no buffer : 0 replay errors : 0dest overflow : 0 authentication errors : 0Other error : 0 Raw Input Underrun : 0IPSEC Unsupported Option: 0 IPV4 Header Length : 0ESP Pad Length : 0 IPSEC Decompression : 0AH ESP seq mismatch : 0 AH Header Length : 0AH ICV Incorrect : 0 IPCOMP CPI Mismatch : 0IPSEC ESP Modulo : 0 Unexpected IPV6 Extensio: 0Unexpected Protocol : 0 Dest Buf overflow : 0IPSEC Pkt is fragment : 0 IPSEC Pkt src count : 0Invalid IP Version : 0 Unwrappable : 0SSL Output overrun : 0 SSL Decompress failure : 0SSL BAD Decomp History : 0 SSL Version Mismatch : 0SSL Input overrun : 0 SSL Conn Modulo : 0SSL Input Underrun : 0 SSL Connection closed : 0SSL Unrecognised content: 0 SSL record header length: 0PPTP Duplicate packet : 0 PPTP Exceed max missed p: 0RNG self test fail : 0 DF Bit set : 0Hash Miscompare : 0 Unwrappable object : 0Missing attribute : 0 Invalid attrribute value: 0Bad Attribute : 0 Verification Fail : 0Decrypt Failure : 0 Invalid Packet : 0Invalid Key : 0 Input Overrun : 0Input Underrun : 0 Output buffer overrun : 0Bad handle value : 0 Invalid parameter : 0Bad function code : 0 Out of handles : 0Access denied : 0 Out of memory : 0NR overflow : 0 pkts dropped : 0Warnings:sessions_expired : 0 packets_fragmented : 0general: : 0HSP details:hsp_operations : 10441 hsp_sessioTable 86 describes significant fields shown in the above display.
7200/VSA
The following example is output from a Cisco 7200 with VSA:
Router# show crypto engine accelerator statistic 0Inbound rate: 0pps 0kb/s Outbound rate: 0pps 0kb/sTRAFFIC Transmitted Received-------------------------------------------------------------------------------Message Count: 5 5Message Byte Count: 1212 256Message Overflow: 0Outbound Count: 54 154Outbound Byte Count: 12472 30332Outbound Overflow: 0Inbound Count: 153 153Inbound Byte Count: 26304 19864Inbound Overflow: 0Reassembled Pkt: 0Fragments Dropped: 0IPPE: 0EPPE: 0FIFO: 0RAE: 0Inbound Traffic:-------------------------------------------------------------------------------Decrypted Pkt: 150Passthrough Pkt: 3IKE Pkt: 0SPI Error: 0Policy Violation: 0Outbound Traffic: Route cache Processor-------------------------------------------------------------------------------Encrypted Pkt: 150 0Passthrough Pkt: 0 4Policy Violation: 0Queue Depth:------------------------------------------------------------------------------TXRing Current Queue Depth:High Priority : 0.0 %Medium Priority : 0.0 %Low Priority : 0.0 %VSA RX Exception statistics:Invalid SA : 0 Enc Dec mismatch : 0Next Header mismatch : 0 Pad mismatch : 0MAC mismatch : 0 Anti replay failed : 0Enc Seq num overflow : 0 Dec IPver mismatch : 0Enc IPver mismatch : 0 TTL Decr : 0Selector checks : 0 UDP mismatch : 0IP Parse error : 0 Fragmentation Error : 0IB Selector check : 0 TimeBased Replay Err : 0Misc. Exceptions : 0Table 87 describes significant fields shown in the above display.
IPsec VPN SPA and VSPA
The following example shows the platform statistics for the IPsec VPN SPA in slot 1 subslot 0 and also displays the network interface controller statistics (this platform output is from a Catalyst 6500 series with installed IPsec VPN SPA):
Router# show crypto engine accelerator statistic slot 1/0 detailVPN module in slot 1/0Decryption Side Data Path Statistics====================================Packets RX...............: 454260Packets TX...............: 452480IPSec Transport Mode.....: 0IPSec Tunnel Mode........: 452470AH Packets...............: 0ESP Packets..............: 452470GRE Decapsulations.......: 0NAT-T Decapsulations.....: 0Clear....................: 8ICMP.....................: 0Packets Drop.............: 193Authentication Errors....: 0Decryption Errors........: 0Replay Check Failed......: 0Policy Check Failed......: 0Illegal CLear Packet.....: 0GRE Errors...............: 0SPD Errors...............: 0HA Standby Drop..........: 0Hard Life Drop...........: 0Invalid SA...............: 191SPI No Match.............: 0Destination No Match.....: 0Protocol No Match........: 0Reassembly Frag RX.......: 0IPSec Fragments..........: 0IPSec Reasm Done.........: 0Clear Fragments..........: 0Clear Reasm Done.........: 0Datagrams Drop...........: 0Fragments Drop...........: 0Decryption Side Controller Statistics=====================================Frames RX................: 756088Bytes RX.................: 63535848Mcast/Bcast Frames RX....: 2341RX Less 128Bytes.........: 756025RX Less 512Bytes.........: 58RX Less 1KBytes..........: 2RX Less 9KBytes..........: 3RX Frames Drop...........: 0Frames TX................: 452365Bytes TX.................: 38001544Mcast/Bcast Frames TX....: 9TX Less 128Bytes.........: 452343TX Less 512Bytes.........: 22TX Less 1KBytes..........: 0TX Less 9KBytes..........: 0Encryption Side Data Path Statistics====================================Packets RX...............: 756344Packets TX...............: 753880IPSec Transport Mode.....: 0IPSec Tunnel Mode........: 753869GRE Encapsulations.......: 0NAT-T Encapsulations.....: 0LAF prefragmented........: 0Fragmented...............: 0Clear....................: 753904ICMP.....................: 0Packets Drop.............: 123IKE/TED Drop.............: 27Authentication Errors....: 0Encryption Errors........: 0HA Standby Drop..........: 0Hard Life Drop...........: 0Invalid SA...............: 191Reassembly Frag RX.......: 0Clear Fragments..........: 0Clear Reasm Done.........: 0Datagrams Drop...........: 0Fragments Drop...........: 0Encryption Side Controller Statistics=====================================Frames RX................: 454065Bytes RX.................: 6168274/Mcast/Bcast Frames RX....: 1586RX Less 128Bytes.........: 1562RX Less 512Bytes.........: 452503RX Less 1KBytes..........: 0RX Less 9KBytes..........: 0RX Frames Drop...........: 0Frames TX................: 753558Bytes TX.................: 100977246Mcast/Bcast Frames TX....: 2TX Less 128Bytes.........: 3TX Less 512Bytes.........: 753555TX Less 1KBytes..........: 0TX Less 9KBytes..........: 0Table 88 describes significant fields shown in the above display.
VSPA
The following examples show the output when the coreutil keyword is used with the VSPA and the Catalyst 6500 series switch using Cisco IOS Release 12.2(33)SXI and later releases:
Router#: show crypto engine accelerator statistic slot 2/0 coreutilUtilization Percentages for VPN blade in slot 2/0Blade Utilization Percentages==========================Last 5 seconds ---------------------Slowpath ...................... 35 %Inbound ....................... 24 %Outbound ...................... 32 %QoS ........................... 44 %Last 1 minute ----------------------Slowpath ...................... 12 %Inbound ....................... 11 %Outbound ...................... 15 %QoS ........................... 23 %Last 5 minutes ---------------------Slowpath ....................... 8 %Inbound ....................... 11 %Outbound ...................... 11 %QoS ........................... 10 %Router# show crypto engine accelerator statistic all coreutilUtilization Percentages for VPN blade in slot 2/0Blade Utilization Percentages==========================Last 5 seconds ---------------------Slowpath ...................... 35 %Inbound ....................... 24 %Outbound ...................... 32 %QoS ........................... 44 %Last 1 minute ----------------------Slowpath ...................... 12 %Inbound ....................... 11 %Outbound ...................... 15 %QoS ........................... 23 %Last 5 minutes ---------------------Slowpath ....................... 8 %Inbound ....................... 11 %Outbound ...................... 11 %QoS ........................... 10 %Utilization Percentages for VPN blade in slot 2/1Blade Utilization Percentages==========================Last 5 seconds ---------------------Slowpath ...................... 88 %Inbound ....................... 78 %Outbound ...................... 79 %QoS ........................... 32 %Last 1 minute ----------------------Slowpath ...................... 76 %Inbound ....................... 80 %Outbound ...................... 80 %QoS ........................... 13 %Last 5 minutes ---------------------Slowpath ...................... 75 %Inbound ....................... 65 %Outbound ...................... 70 %QoS ........................... 12 %Table 89 describes significant fields shown in the above display.
Related Commands
show crypto gdoi
To display information about a Group Domain of Interpretation (GDOI) configuration, use the show crypto gdoi command in privileged EXEC mode.
show crypto gdoi [debug-condition] [group group-name] [gm [acl | rekey | replay] | ks [acl | coop [version] | members [ip-address] | policy | rekey | replay]] [ipsec sa]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Because the show running-config command does not display enabled debug commands, the debug-condition keyword is useful for displaying GDOI debug conditional filters that are enabled.
Examples
The following output displays information about a configuration for a GDOI group member:
Router# show crypto gdoi group diffintGroup InformationGroup Name : diffintGroup Identity : 3333Group Members Registered : 0Group Server : 10.0.5.2Group Name : testGroup Identity : 4444Group Members Registered : 0Group Server : 10.0.5.2The following output displays information about a configuration when entered on a GDOI key server:
Router# show crypto gdoi group diffint ksGroup InformationGroup Name : diffintGroup Identity : 3333Group Members Registered : 1Group Server : LocalGroup Rekey Lifetime : 300 secsGroup RekeyRemaining Lifetime : 84 secsIPSec SA Number : 1IPSec SA Rekey Lifetime : 120 secsProfile Name : gdoi-pSA RekeyRemaining Lifetime : 64 secsaccess-list 120 permit ip host 10.0.1.1 host 192.168.1.1access-list 120 permit ip host 10.0.100.2 host 192.168.1.1Group Member List for Group diffint :Member ID : 10.0.3.1Group Name : testGroup Identity : 4444Group Members Registered : 0Group Server : LocalGroup Rekey Lifetime : 600 secsIPSec SA Number : 1IPSec SA Rekey Lifetime : 120 secsProfile Name : gdoi-paccess-list 120 permit ip host 10.0.1.1 host 192.168.1.1access-list 120 permit ip host 10.0.100.2 host 192.168.1.1The following output displays GDOI key server information for registered GMs when entered on a GDOI key server:
Router# show crypto gdoi ks membersGroup Member Information :Detail :Number of rekeys sent for group diffint : 10Group Member ID : 5.0.6.1Group ID : 3333Group Name : diffintKey Server ID : 5.0.10.1Rekeys sent : 10Rekeys retries : 0Rekey Acks Rcvd : 10Rekey Acks missed : 0Sent seq num : 2 3 1 2Rcvd seq num : 2 3 1 2Group Member ID : 5.0.5.1Group ID : 3333Group Name : diffintKey Server ID : 5.0.8.1Rekeys sent : 10Rekeys retries : 0Rekey Acks Rcvd : 10Rekey Acks missed : 0Sent seq num : 2 3 1 2Rcvd seq num : 2 0 0 0show crypto ha
To display all virtual IP (VIP) addresses that are currently in use by IP Security (IPSec) and Internet Key Exchange (IKE), use the show crypto ha command in privileged EXEC mode.
show crypto ha
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Examples
The following output from the show crypto ha command shows all VIP addresses that are being used by IPSec and IKE:
Router# show crypto haIKE VIP: 209.165.201.3stamp: 74 BA 70 27 9C 4F 7F 81 3A 70 13 C9 65 22 E7 76IKE VIP: 255.255.255.253stamp: Not setIKE VIP: 255.255.255.254stamp: Not setIPSec VIP: 209.165.201.3IPSec VIP: 255.255.255.253IPSec VIP: 255.255.255.254show crypto identity
To display the crypto identity list, use the show crypto identity command in privileged EXEC mode.
show crypto identity [identity-tag]
Syntax Description
identity-tag
(Optional) The crypto identity tag value for which to display specific crypto identity list information.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the show crypto identity command to display the configured crypto identity of a router.
Examples
The following are sample outputs from the show crypto identity command:
Router# show crypto identity id12crypto identity id12:Description: line 22Router# show crypto identity id11crypto identity id11:fqdn line22Router# show crypto identitycrypto identity tag12:Description: Linedescriptionfqdn fullyauthorisedoneTable 90 describes the significant fields shown in the display.
Table 90 show crypto identity Field Descriptions
Description
Line description.
fqdn
Fully qualified distinguished name identifier
show crypto ikev2 diagnose error
To display the current Internet Key Exchange Version 2 (IKEv2) exit path database, use the show crypto ikev2 diagnose error command in privileged EXEC mode.
show crypto ikev2 diagnose error [count]
Syntax Description
Command Default
The IKEv2 exit path database is displayed.
Command Modes
Privileged EXEC (#)
Command History
15.1(1)T
This command was introduced.
Cisco IOS XE Release 3.3S
This command was integrated into Cisco IOS XE Release 3.3S.
Usage Guidelines
Use this command to display the IKEv2 exit path database. Enable or disable IKEv2 exit path logging using the crypto ikev2 diagnose error command. Use the clear crypto ikev2 diagnose error command to clear the IKEv2 exit path database.
Examples
The following example is a sample output from the show crypto ikev2 diagnose error command. The output is self-explanatory.
Router# show crypto ikev2 diagnose errorExit Path Table - status: enable, current entry 2, deleted 0, max allow 50Error(1): No pskey found-Traceback= 0x37ABEB8z 0x37AC29Cz 0x2C0CA74z 0x2C0CA70zError(1): No pskey found-Traceback= 0x37B609Cz 0x37ABEB8z 0x37AC29Cz 0x2C0CA74z 0x2C0CA70zRelated Commands
clear crypto ikev2 diagnose error
Clears the IKEv2 exit path database.
crypto ikev2 diagnose error
Enables IKEv2 error diagnosis.
show crypto ikev2 policy
To display the default or a user-defined Internet Key Exchange Version 2 (IKEv2) policy, use the show crypto ikev2 policy command in privileged EXEC mode.
show crypto ikev2 policy [policy-name]
Syntax Description
Command Default
If no option is specified, then this command displays all the policies.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use this command to display the default or user-defined IKEv2 policy. User-defined policies display the default values of the commands that are not explicitly configured under the policy.
Examples
The following examples show the output for a default and user-defined policy.
Default IKEv2 Policy
The default IKEv2 policy matches all local addresses in global VRF and uses the default IKEv2 proposal.
Router# show crypto ikev2 policy defaultIKEv2 policy : defaultMatch fvrf : globalMatch address local : anyProposal : defaultRouter# show crypto ikev2 policy default
This sample output shows the default IKEv2 policy that matches the local IPv6 address in global VRF: IKEv2 policy : defaultMatch fvrf : globalMatch address local : 2001:DB8:1::1Proposal : defaultUser-defined IKEv2 policy
Router# show crypto ikev2 policy policy-1IKEv2 policy : policy-1Match fvrf : greenMatch local : 10.0.0.1Proposal : proposal-AProposal : proposal-BTable 91 describes the significant fields shown in the display.
Related Commands
show crypto ikev2 profile
To display a user-defined Internet Key Exchange Version 2 (IKEv2) profile, use the show crypto ikev2 profile command in privileged EXEC mode.
show crypto ikev2 profile [profile-name]
Syntax Description
Command Default
No default behavior or values.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use this command to display information about an IKEv2 profile. This command also displays the default values of the commands that are not explicitly configured in the IKEv2 profile. If a profile name is not specified, the command displays all the user-defined IKEv2 profiles.
Examples
The following example is sample output from the show crypto ikev2 profile command:
Router# show crypto ikev2 profileIKEv2 profile: profRef Count: 3Match criteria:Fvrf: anyLocal address/interface: noneIdentities:fqdn smap-initiatorCertificate maps: noneLocal identity: fqdn dmap-responderRemote identity: noneLocal authentication method: pre-shareRemote authentication method(s): pre-shareKeyring: v2-kr1Trustpoint(s): noneLifetime: 86400 secondsDPD: disabledNAT-keepalive: disabledIvrf: globalVirtual-template: noneAccounting mlist: noneTable 92 describes the significant fields shown in the display.
show crypto ikev2 proposal
To display the Internet Key Exchange Version 2 (IKEv2) proposal, use the show crypto ikev2 proposal command in privileged EXEC mode.
show crypto ikev2 proposal [name | default]
Syntax Description
Command Default
If no option is specified, the default and user-defined proposals are displayed.
Command Modes
Privileged EXEC (#)
Command History
15.1(1)T
This command was introduced.
Cisco IOS XE Release 3.3S
This command was integrated into Cisco IOS XE Release 3.3S.
Usage Guidelines
Use this command to display the user-defined and default proposals.
Examples
The following example is a sample output from the show crypto ikev2 proposal command:
Router# show crypto ikev2 proposalIKEv2 proposal: pr1Encryption : 3DES AES-CBC-192Integrity : MD596PRF : MD5DH Group : DH_GROUP_768_MODP/Group 1 DH_GROUP_1536_MODP/Group 5IKEv2 proposal: defaultEncryption : AES-CBC-128 3DESIntegrity : SHA96 MD596PRF : SHA1 MD5DH Group : DH_GROUP_1536_MODP/Group 5 DH_GROUP_1024_MODP/Group 2Table 93 describes the significant fields shown in the display.
Related Commands
show crypto ikev2 sa
To display the Internet Key Exchange Version 2 (IKEv2) security associations (SA), use the show crypto ikev2 sa command in privileged EXEC mode.
show crypto ikev2 sa {local ip-address | remote ip-address | fvrf vrf-name} [detailed]
Syntax Description
Command Default
All the current IKEv2 security associations are displayed.
Command Modes
Privileged EXEC (#)
Command History
15.1(1)T
This command was introduced.
Cisco IOS XE Release 3.3S
This command was integrated into Cisco IOS XE Release 3.3S.
Usage Guidelines
Use this command to display information about the current IKEv2 security associations.
Examples
The following is sample output from the show crypto ikev2 sa command:
Router# show crypto ikev2 saTunnel-id Local Remote fvrf/ivrf Status2 10.0.0.1/500 10.0.0.2/500 (none)/(none) READYEncr: 3DES, Hash: SHA96, DH Grp:2, Auth: PSKLife/Active Time: 86400/361 secThe following is sample output from the show crypto ikev2 sa detailed command:
Router# show crypto ikev2 sa detailedTunnel-id Local Remote fvrf/ivrf Status1 1.1.1.1/500 1.1.1.2/500 (none)/(none) READYEncr: 3DES, Hash: MD596, DH Grp:2, Auth sign: PSK, Auth verify: PSKLife/Active Time: 86400/12 secCE id: 1001, Session-id: 1Status Description: Negotiation doneLocal spi: 41E942F807BA4153 Remote spi: 993043F2AF648C48Local id: 1.1.1.1Remote id: 1.1.1.2Local req msg id: 2 Remote req msg id: 0Local next msg id: 2 Remote next msg id: 0Local req queued: 2 Remote req queued: 0Local window: 5 Remote window: 5DPD configured for 0 seconds, retry 0NAT-T is not detectedTable 94 describes the significant fields shown in the display.
show crypto ikev2 session
To display the status of active Internet Key Exchange Version 2 (IKEv2) sessions, use the show crypto ikev2 session command in privileged EXEC mode.
show crypto ikev2 session [detailed]
Syntax Description
Command Default
The session information is displayed in a brief format.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use this command to display information about the active IKEv2 sessions. Use the detailed keyword to display information about IKEv2 parent and child security associations.
Examples
The following is a sample output from the show crypto ikev2 session and show crypto ikev2 session detailed command.
Router# show crypto ikev2 sessionSession-id:1, Status:UP-ACTIVE, IKE count:1, CHILD count:1Tunnel-id Local Remote fvrf/ivrf Status1 10.0.0.1/500 10.0.0.2/500 (none)/(none) READYEncr: 3DES, Hash: SHA96, DH Grp:2, Auth: PSKLife/Active Time: 86400/65 secCHild sa: local selector 10.0.0.1/0 - 10.0.0.1/65535remote selector 10.0.0.2/0 - 10.0.0.2/65535ESP spi in/out: 0x9360A95/0x6C340600CPI in/out: 0x9FE5/0xC776Router# show crypto ikev2 session detailedSession-id:1, Status:UP-ACTIVE, IKE count:1, CHILD count:1Tunnel-id Local Remote fvrf/ivrf Status1 10.0.0.1/500 10.0.0.2/500 (none)/(none) READYEncr: 3DES, Hash: SHA96, DH Grp:2, Auth: PSKLife/Remaining/Active Time: 86400/86157/248 secCE id: 0, Session-id: 1, MIB-id: 1Status Description: Negotiation doneLocal spi: 750CBE827434A245 Remote spi: 4353FEDBABEBF24CLocal id: 10.0.0.1 Remote id: 10.0.0.2Local req mess id: 0 Remote req mess id: 0Local next mess id: 0 Remote next mess id: 2Local req queued: 0 Remote req queued: 0Local window: 5 Remote window: 5DPD configured for 0 secondsNAT-T is not detectedChild sa: local selector 10.0.0.1/0 - 10.0.0.1/65535remote selector 10.0.0.2/0 - 10.0.0.2/65535ESP spi in/out: 0x9360A95/0x6C340600CPI in/out: 0x9FE5/0xC776AH spi in/out: 0x0/0x0Encr: AES CBC, keysize: 128, esp_hmac: SHA96ah_hmac: Unknown - 0, comp: IPCOMP_LZS, mode tunnelTable 95 describes the significant fields shown in the display.
show crypto ikev2 stats
To display the Internet Key Exchange Version 2 (IKEv2) security associations (SAs) statistics, use the show crypto ikev2 stats command in privileged EXEC mode.
show crypto ikev2 stats
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
15.1(1)T
This command was introduced.
Cisco IOS XE Release 3.3S
This command was integrated into Cisco IOS XE Release 3.3S.
Usage Guidelines
Use this command to display IKEv2 security associations statistics.
Examples
The following example is a sample output from the show crypto ikev2 stats command. The fields in the output are self-explanatory.
Router(#) show crypto ikev2 stats---------------------------------------------------------------------Crypto IKEV2 SA Statistics---------------------------------------------------------------------System Resource Limit: 0 Max IKEv2 SAs: 0 Max in nego: 1000Total IKEv2 SA Count: 1 active: 1 negotiating: 0Incoming IKEv2 Requests: 0 accepted: 0 rejected: 0Outgoing IKEv2 Requests: 1 accepted: 1 rejected: 0Rejected IKEv2 Requests: 0 rsrc low: 0 SA limit: 0IKEv2 packets dropped at dispatch: 0Incoming IKEV2 Cookie Challenged Requests: 0accepted: 0 rejected: 0 rejected no cookie: 0show crypto ipsec client ezvpn
To display the Cisco Easy VPN Remote configuration, use the show crypto ipsec client ezvpn command in privileged EXEC mode.
show crypto ipsec client ezvpn
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Examples
The following example shows a typical display from the show crypto ipsec client ezvpn command for an active Virtual Private Network (VPN) connection when the router is in client mode. The last two lines indicate that a configuration URL and configuration version number have been pushed through the Mode-Configuration Exchange by the server to the Easy VPN remote device.
Router# show crypto ipsec client ezvpnTunnel name: hw1Inside interface list: FastEthernet0/0, Serial1/0,Outside interface: Serial0/0Current State: IPSEC_ACTIVELast Event: SOCKET_UPAddress: 192.168.201.0Mask: 255.255.255.224DNS Primary: 192.168.201.1DNS Secondary: 192.168.201.2NBMS/WINS Primary: 192.168.201.3NBMS/WINS Secondary: 192.168.201.4Default Domain: cisco.comConfiguration URL: http://10.8.8.88/easy.cfgConfiguration Version: 10The following example shows a typical display from the show crypto ipsec client ezvpn command for an active VPN connection when the router is in network-extension mode:
Router# show crypto ipsec client ezvpnTunnel name: hw1Inside interface list: FastEthernet0/0, Serial1/0,Outside interface: Serial0/0Current State: IPSEC_ACTIVELast Event: SOCKET_UPAddress: 192.168.202.128Mask: 255.255.255.224Default Domain: cisco.comSplit Tunnel List: 1Address : 192.168.200.225Mask : 255.255.255.224Protocol : 0x0Source Port: 0Dest Port : 0The following example shows a typical display from the show crypto ipsec client ezvpn command for an inactive VPN connection:
Router# show crypto ipsec client ezvpnCurrent State: IDLELast Event: REMOVE INTERFACE CFGRouter#The following example displays information about the outside interface "Virtual-Access1", which is bound to the real interface (Ethernet0/0) on which the user has configured Easy VPN as an outside interface:
Router# show crypto ipsec client ezvpnEasy VPN Remote Phase: 5Tunnel name : ezInside interface list: Ethernet1/0,Outside interface: Virtual-Access1 (bound to Ethernet0/0)Easy VPN connect ACL checking activeConnect : ACL based with access-list 101Current State: CONNECT_REQUIREDLast Event: TRACKED OBJECT UPSave Password: DisallowedCurrent EzVPN Peer: 10.0.0.2Table 96 describes significant fields shown by the show crypto ipsec client ezvpn command:
Related Commands
show crypto ipsec transform
Displays the specific configuration for one or all transformation sets.
show crypto ipsec default transform-set
To display the default IP Security (IPsec) transform sets currently in use by Internet Key Exchange (IKE), use the show crypto ipsec default transform-set command in privileged EXEC mode.
show crypto ipsec default transform-set
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Usage Guidelines
If the default transform sets are in use, the show crypto ipsec default transform-set command displays the two default transform sets each of which defines an Encapsulation Security Protocol (ESP) encryption transform type and an ESP authentication transform type.
Examples
The following example displays the two default transform sets. No user defined transform sets have been configured, the default transform sets have not been disabled, and the crypto engine supports the encryption algorithm.
Router# show crypto ipsec default transform-setTransform set #$!default_transform_set_1: { esp-aes esp-sha-hmac }will negotiate = { Transport, },Transform set #$!default_transform_set_0: { esp-3des esp-sha-hmac }will negotiate = { Transport, },Table 97 show crypto ipsec default transform-set Field Descriptions
The following example shows that when the default transform sets are disabled with the no crypto ipsec default transform-set, the show crypto ipsec default transform-set has no output.
Router(config)# no crypto ipsec default transform-setRouter(config)# exitRouter#Router# show crypto ipsec default transform-setRouter#Related Commands
show crypto ipsec sa
To display the settings used by current security associations (SAs), use the show crypto ipsec sa command in privileged EXEC mode.
show crypto ipsec sa [map map-name | address | identity | interface type number | peer [vrf fvrf-name] address | vrf ivrf-name | ipv6 [interface type number]] [detail]
IPsec and IKE Stateful Failover Syntax
show crypto ipsec sa [active | standby]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
If no keyword is used, all SAs are displayed. They are sorted first by interface and then by traffic flow (for example, source or destination address, mask, protocol, or port). Within a flow, the SAs are listed by protocol (ESP or AH) and direction (inbound or outbound).
Examples
The following is sample output from the show crypto ipsec sa command:
Router# show crypto ipsec sainterface: Tunnel1Crypto map tag: Tunnel1-head-0, local addr 10.5.5.2protected vrf: (none)local ident (addr/mask/prot/port): (10.5.5.2/255.255.255.255/47/0)remote ident (addr/mask/prot/port): (10.5.5.1/255.255.255.255/47/0)current_peer 10.5.5.1 port 500PERMIT, flags={origin_is_acl,}#pkts encaps: 492908510, #pkts encrypt: 492908510, #pkts digest: 492908510#pkts decaps: 492908408, #pkts decrypt: 492908408, #pkts verify: 492908408#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0#pkts not decompressed: 0, #pkts decompress failed: 0#send errors 55, #recv errors 0local crypto endpt.: 10.5.5.2, remote crypto endpt.: 10.5.5.1path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/2current outbound spi: 0xDE4EE29D(3729711773)inbound esp sas:spi: 0xC06CA92B(3228346667)transform: esp-3des esp-sha-hmac ,in use settings ={Tunnel, }conn id: 3139, flow_id: VSA:1139, crypto map: Tunnel1-head-0sa timing: remaining key lifetime (k/sec): (3948785/556)IV size: 8 bytesreplay detection support: YStatus: ACTIVEinbound ah sas:spi: 0xC87AB936(3363486006)transform: ah-md5-hmac ,in use settings ={Tunnel, }conn id: 3139, flow_id: VSA:1139, crypto map: Tunnel1-head-0sa timing: remaining key lifetime (k/sec): (3948785/556)replay detection support: YStatus: ACTIVEinbound pcp sas:outbound esp sas:spi: 0xDE4EE29D(3729711773)transform: esp-3des esp-sha-hmac ,in use settings ={Tunnel, }conn id: 3140, flow_id: VSA:1140, crypto map: Tunnel1-head-0sa timing: remaining key lifetime (k/sec): (3948785/556)IV size: 8 bytesreplay detection support: YStatus: ACTIVEoutbound ah sas:spi: 0xAEEDD4F1(2934822129)transform: ah-md5-hmac ,in use settings ={Tunnel, }conn id: 3140, flow_id: VSA:1140, crypto map: Tunnel1-head-0sa timing: remaining key lifetime (k/sec): (3948785/556)replay detection support: YStatus: ACTIVEoutbound pcp sas:The following is sample output from the show crypto ipsec sa identity detail command:
Router# show crypto ipsec sa identity detailinterface: Tunnel1Crypto map tag: Tunnel1-head-0, local addr 10.5.5.2protected vrf: (none)local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)current_peer (none) port 500DENY, flags={ident_is_root,}#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0#pkts not decompressed: 0, #pkts decompress failed: 0#pkts no sa (send) 0, #pkts invalid sa (rcv) 0#pkts encaps failed (send) 0, #pkts decaps failed (rcv) 0#pkts invalid prot (recv) 0, #pkts verify failed: 0#pkts invalid identity (recv) 0, #pkts invalid len (rcv) 0#pkts replay rollover (send): 0, #pkts replay rollover (rcv) 0##pkts replay failed (rcv): 0#pkts internal err (send): 0, #pkts internal err (recv) 0protected vrf: (none)local ident (addr/mask/prot/port): (10.5.5.2/255.255.255.255/47/0)remote ident (addr/mask/prot/port): (10.5.5.1/255.255.255.255/47/0)current_peer 10.5.5.1 port 500PERMIT, flags={origin_is_acl,}#pkts encaps: 492923510, #pkts encrypt: 492923510, #pkts digest: 492923510#pkts decaps: 492923408, #pkts decrypt: 492923408, #pkts verify: 492923408#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0#pkts not decompressed: 0, #pkts decompress failed: 0#pkts no sa (send) 55, #pkts invalid sa (rcv) 0#pkts encaps failed (send) 0, #pkts decaps failed (rcv) 0#pkts invalid prot (recv) 0, #pkts verify failed: 0#pkts invalid identity (recv) 0, #pkts invalid len (rcv) 0#pkts replay rollover (send): 0, #pkts replay rollover (rcv) 0##pkts replay failed (rcv): 0#pkts internal err (send): 0, #pkts internal err (recv) 0Table 98 describes the significant fields shown in the above displays (show crypto ipsec sa and show crypto ipsec sa detail).
show crypto ipsec sa vrf Command Output
The following is sample output from the show crypto ipsec sa vrf command:
Router# show crypto ipsec sa vrf vpn2interface: Ethernet1/2Crypto map tag: ra, local addr. 172.16.1.1protected vrf: vpn2local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)remote ident (addr/mask/prot/port): (10.4.1.4/255.255.255.255/0/0)current_peer: 10.1.1.1:500PERMIT, flags={}#pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0#pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0#pkts not decompressed: 0, #pkts decompress failed: 0#send errors 0, #recv errors 0local crypto endpt.: 172.16.1.1, remote crypto endpt.: 10.1.1.1path mtu 1500, media mtu 1500current outbound spi: 50110CF8inbound esp sas:spi: 0xA3E24AFD(2749516541)transform: esp-3des esp-md5-hmac ,in use settings ={Tunnel, }slot: 0, conn id: 5127, flow_id: 7, crypto map: rasa timing: remaining key lifetime (k/sec): (4603517/3503)IV size: 8 bytesreplay detection support: Yinbound ah sas:inbound pcp sas:outbound esp sas:spi: 0x50110CF8(1343294712)transform: esp-3des esp-md5-hmac ,in use settings ={Tunnel, }slot: 0, conn id: 5128, flow_id: 8, crypto map: rasa timing: remaining key lifetime (k/sec): (4603517/3502)IV size: 8 bytesreplay detection support: Youtbound ah sas:outbound pcp sas:The following configuration was in effect when the preceding show crypto ipsec sa vrf command was issued. The IPsec remote access tunnel was "UP" when this command was issued.
crypto dynamic-map vpn1 1set transform-set vpn1set isakmp-profile vpn1-rareverse-route!crypto dynamic-map vpn2 1set transform-set vpn2set isakmp-profile vpn2-rareverse-route!!crypto map ra 1 ipsec-isakmp dynamic vpn1crypto map ra 2 ipsec-isakmp dynamic vpn2Table 99 describes the significant fields shown in the preceding show crypto ipsec sa vrf display. Additional fields are self-explanatory or can be found in Table 98.
IPsec and IKE Stateful Failover Examples
The following sample output shows the IPsec SA status of only the active device:
Router# show crypto ipsec sa activeinterface: Ethernet0/0Crypto map tag: to-peer-outside, local addr 10.165.201.3protected vrf: (none)local ident (addr/mask/prot/port): (192.168.0.1/255.255.255.255/0/0)remote ident (addr/mask/prot/port): (172.16.0.1/255.255.255.255/0/0)current_peer 209.165.200.225 port 500PERMIT, flags={origin_is_acl,}#pkts encaps: 3, #pkts encrypt: 3, #pkts digest: 3#pkts decaps: 4, #pkts decrypt: 4, #pkts verify: 4#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0#pkts not decompressed: 0, #pkts decompress failed: 0#send errors 0, #recv errors 0local crypto endpt.: 209.165.201.3, remote crypto endpt.: 209.165.200.225path mtu 1500, media mtu 1500current outbound spi: 0xD42904F0(3559458032)inbound esp sas:spi: 0xD3E9ABD0(3555306448)transform: esp-3des ,in use settings ={Tunnel, }conn id: 2006, flow_id: 6, crypto map: to-peer-outsidesa timing: remaining key lifetime (k/sec): (4586265/3542)HA last key lifetime sent(k): (4586267)ike_cookies: 9263635C CA4B4E99 C14E908E 8EE2D79CIV size: 8 bytesreplay detection support: YStatus: ACTIVETable 100 describes the significant fields shown in the preceding show crypto ipsec sa active display. Additional fields are self-explanatory or can be found in Table 98 or Table 99.
Table 100 show crypto ipsec sa active Field Descriptions.
HA last key lifetime sent (k)
Last stored kilobytes lifetime value for HA.
ike_cookies
ID that identifies the IKE SAs.
The following sample output shows the IPsec SA status of only the standby device. The fields in the display are either self-explanatory or can be found in Table 98, Table 99, or Table 100.
Router# show crypto ipsec sa standbyinterface: Ethernet0/0Crypto map tag: to-peer-outside, local addr 10.165.201.3protected vrf: (none)local ident (addr/mask/prot/port): (192.168.0.1/255.255.255.255/0/0)remote ident (addr/mask/prot/port): (172.16.0.1/255.255.255.255/0/0)current_peer 209.165.200.225 port 500PERMIT, flags={origin_is_acl,}#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0#pkts compressed: 0, #pkts decompressed: 0#pkts not compressed: 0, #pkts compr. failed: 0#pkts not decompressed: 0, #pkts decompress failed: 0#send errors 0, #recv errors 0local crypto endpt.: 209.165.201.3, remote crypto endpt.: 209.165.200.225path mtu 1500, media mtu 1500current outbound spi: 0xD42904F0(3559458032)inbound esp sas:spi: 0xD3E9ABD0(3555306448)transform: esp-3des ,in use settings ={Tunnel, }conn id: 2012, flow_id: 12, crypto map: to-peer-outsidesa timing: remaining key lifetime (k/sec): (4441561/3486)HA last key lifetime sent(k): (4441561)ike_cookies: 00000000 00000000 00000000 00000000IV size: 8 bytesreplay detection support: YStatus: STANDBYinbound ah sas:spi: 0xF3EE3620(4092474912)transform: ah-md5-hmac ,in use settings ={Tunnel, }conn id: 2012, flow_id: 12, crypto map: to-peer-outsidesa timing: remaining key lifetime (k/sec): (4441561/3486)HA last key lifetime sent(k): (4441561)ike_cookies: 00000000 00000000 00000000 00000000replay detection support: YStatus: STANDBYinbound pcp sas:outbound esp sas:spi: 0xD42904F0(3559458032)transform: esp-3des ,in use settings ={Tunnel, }conn id: 2011, flow_id: 11, crypto map: to-peer-outsidesa timing: remaining key lifetime (k/sec): (4441561/3485)HA last key lifetime sent(k): (4441561)ike_cookies: 00000000 00000000 00000000 00000000IV size: 8 bytesreplay detection support: YStatus: STANDBYoutbound ah sas:spi: 0x75251086(1965363334)transform: ah-md5-hmac ,in use settings ={Tunnel, }conn id: 2011, flow_id: 11, crypto map: to-peer-outsidesa timing: remaining key lifetime (k/sec): (4441561/3485)HA last key lifetime sent(k): (4441561)ike_cookies: 00000000 00000000 00000000 00000000replay detection support: YStatus: STANDBYoutbound pcp sas:Related Commands
show crypto ipsec security-association idle-time
To display the security association (SA) idle-time value configured for crypto map entry, use the show crypto ipsec security-association idle-time command in privileged EXEC mode.
show crypto ipsec security-association idle-time
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the show crypto ipsec security-association idle-time command to display the idle time.
When a router running the Cisco IOS software creates an IPsec SA for a peer, resources must be allocated to maintain the SA. The SA requires both memory and several managed timers. For idle peers, these resources are wasted. If enough resources are wasted by idle peers, the router could be prevented from creating new SAs with other peers. The IPsec Security Association Idle Timers feature introduces a configurable idle timer to monitor SAs for activity, allowing SAs for idle peers to be deleted. This increases the availability of the resources and improve scalability of Cisco IOS IPsec deployments.
Examples
The following is a sample output from the show crypto ipsec security-association idle-time command. The output is self-explanatory.
Router# show crypto ipsec security-association idle-timeSecurity association idletime: 567 secondsRelated CommandsRelated Commands
show crypto ipsec security-association lifetime
Displays the SA lifetime value configured for a particular crypto map entry.
show crypto ipsec security-association lifetime
To display the security association (SA) lifetime value configured for a particular crypto map entry, use the show crypto ipsec security-association lifetime command in privileged EXEC mode.
show crypto ipsec security-association lifetime
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Examples
The following is sample output for the show crypto ipsec security-association lifetime command:
Router# show crypto ipsec security-association lifetimeSecurity-association lifetime: 4608000 kilobytes/120 secondsThe following configuration was in effect when the previous show crypto ipsec security-association lifetime command was issued:
crypto ipsec security-association lifetime seconds 120show crypto ipsec transform-set
To display the configured transform sets or active default transform sets, use the show crypto ipsec transform-set command in privileged EXEC mode.
show crypto ipsec transform-set [tag transform-set-name]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
There are two default transform sets supported in Cisco IOS k9 images only:
•
•
The show crypto ipsec transform-set command will display the default transform sets if there are no other transform set configured, you have not disabled the default transform sets by issuing the no crypto ipsec default transform-set command, and the crypto engine supports the encryption algorithm.
Examples
The following is sample output for the show crypto ipsec transform-set command when the default transform sets have been disabled with the no crypto ipsec default transform-set command:
Router# show crypto ipsec transform-setTransform set combined-des-sha: {esp-des esp-sha-hmac}will negotiate = { Tunnel, },Transform set combined-des-md5: {esp-des esp-md5-hmac}will negotiate = { Tunnel, },Transform set t1: {esp-des esp-md5-hmac}will negotiate = {Tunnel,},Transform set t100: {ah-sha-hmac}will negotiate = {Transport,},Transform set t2: {ah-sha-hmac}will negotiate = {Tunnel,},{ esp-des }will negotiate = {Tunnel,},The following configuration was in effect when the previous show crypto ipsec transform-set command was issued:
crypto ipsec transform-set combined-des-sha esp-des esp-sha-hmaccrypto ipsec transform-set combined-des-md5 esp-des esp-md5-hmaccrypto ipsec transform-set t1 esp-des esp-md5-hmaccrypto ipsec transform-set t100 ah-sha-hmacmode transportcrypto ipsec transform-set t2 ah-sha-hmac esp-desno crypto ipsec default transform-setThe following sample output from the show crypto ipsec transform-set command displays a warning message after a user tries to configure an IPsec transform that the hardware does not support:
Router# show crypto ipsec transform-setTransform set transform-1:{ esp-256-aes esp-md5-hmac }will negotiate = { Tunnel, },WARNING: encryption hardware does not support transform esp-aes 256 within IPSec transform transform-1The following is sample output for the show crypto ipsec transform-set command when the default transform sets are active and the crypto engine supports the encryption algorithm:
Router# show crypto ipsec transform-setTransform set asset: { esp-256-aes esp-sha-hmac }will negotiate = { Transport, },Transform set aesset: { esp-256-aes esp-sha-hmac }will negotiate = { Transport, },Transform set #$!default_transform_set_1: { esp-aes esp-sha-hmac }will negotiate = { Transport, },Transform set #$!default_transform_set_0: { esp-3des esp-sha-hmac }will negotiate = { Transport, },Related Commands
show crypto isakmp default policy
To display the default Internet Key Exchange (IKE) policies currently in use, use the show crypto isakmp default policy command in privileged EXEC mode.
show crypto isakmp default policy
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Usage Guidelines
If you have neither manually configured IKE policies with the crypto isakmp policy command nor issued the no crypto isakmp default policy command, IPsec will use the default IKE policies to negotiate IKE proposals. There are eight default IKE default policies supported (see Table 101). The default IKE policies define the following policy set parameters:
•
•
•
•
•
–
–
Table 101
Default IKE Policies
If you have manually configured IKE policies and you issue the show crypto isakmp default policy command there is no output, since the default IKE policies are not in use.
Examples
The following example displays the eight default policies with protection suites of priorities 65507-65014. The default policies are displayed since there are no user configured policies, the default policies have not been disabled, and EzVPN is not configured.
Router# show crypto isakmp default policyDefault protection suite of priority 65507encryption algorithm: AES - Advanced Encryption Standard (128 bit keys).hash algorithm: Secure Hash Standardauthentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65508encryption algorithm: AES - Advanced Encryption Standard (128 bit keys).hash algorithm: Secure Hash Standardauthentication method: Pre-Shared KeyDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65509encryption algorithm: AES - Advanced Encryption Standard (128 bit keys).hash algorithm: Message Digest 5authentication method: Rivest-Shamir-Adleman signatureDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65510encryption algorithm: AES - Advanced Encryption Standard (128 bit keys).hash algorithm: Message Digest 5authentication method: pre-shared keyDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65511encryption algorithm: Three key triple DEShash algorithm: Secure Hash Standardauthentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65512encryption algorithm: Three key triple DEShash algorithm: Secure Hash Standardauthentication method: Pre-Shared KeyDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65513encryption algorithm: Three key triple DEShash algorithm: Message Digest 5authentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitDefault protection suite of priority 65514encryption algorithm: Three key triple DEShash algorithm: Message Digest 5authentication method: Pre-Shared KeyDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitThe following example shows that there is no output from the show crypto isakmp default policy command when the default policies have been disabled.
Router(config)# no crypto isakmp default policy! The default IKE policies have been disabled.Router(config)# exitRouter# configure terminalRouter# show crypto isakmp default policyRouter#! There is no output from the show crypto isakmp default policy command.Related Commands
crypto isakmp policy
Defines an IKE policy.
no crypto isakmp default policy
Disables IKE default policies.
show crypto isakmp policy
Displays the parameters for each IKE policy.
show crypto isakmp key
To list the keyrings and their preshared keys, use the show crypto isakmp key command in privileged EXEC mode.
show crypto isakmp key
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Examples
The following is sample output for the show crypto isakmp key command:
Router# show crypto isakmp keyHostname/Address Preshared Keyvpn1 : 172.61.1.1 vpn1vpn2 : 10.1.1.1 vpn2The following configuration was in effect when the above show crypto isakmp key command was issued:
crypto keyring vpn1pre-shared-key address 172.16.1.1 key vpn1crypto keyring vpn2pre-shared-key address 10.1.1.1 key vpn2Table 102 describes significant fields in the show crypto isakmp key profile.
show crypto isakmp peers
To display the Internet Security Association and Key Management Protocol (ISAKMP) peer descriptions, use the show crypto isakmp peers command in privileged EXEC mode.
show crypto isakmp peers [ipaddress | ipv6address | config [peername]]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Before you can use the config keyword, the following commands must be enabled for the accounting update to work correctly: aaa accounting update with new info keyword and radius-server vsa send with accounting keyword.
Examples
The following output example shows information about the peer named "This-is-another-peer-at-10-1-1-3":
Router# show crypto isakmp peersPeer: 10.1.1.3 Port: 500Description: This-is-another-peer-at-10-1-1-3Phase1 id: 10.1.1.3In the following example, the config keyword is used to display all manageability information for an Easy VPN remote device. Cisco Easy VPN is an IP Security (IPsec) virtual private network (VPN) solution supported by Cisco routers and security appliances. It greatly simplifies VPN deployment for remote offices and mobile workers. The fields are self-explanatory.
Router# show crypto isakmp peers configClient-Public-Addr=192.168.10.2:500; Client-Assigned-Addr=172.16.1.209; Client-Group=branch; Client-User=branch; Client-Hostname=branch.; Client-Platform=Cisco 1711; Client-Serial=FOC080210E2 (412454448); Client-Config-Version=11; Client-Flash=33292284; Client-Available-Flash=10202680; Client-Memory=95969280; Client-Free-Memory=14992140; Client-Image=flash:c1700-advipservicesk9-mz.ef90241;Client-Public-Addr=192.168.10.3:500; Client-Assigned-Addr=172.16.1.121; Client-Group=store; Client-User=store; Client-Hostname=831-storerouter.; Client-Platform=Cisco C831; Client-Serial=FOC08472UXR (1908379618); Client-Config-Version=2; Client-Flash=24903676; Client-Available-Flash=5875028; Client-Memory=45298688; Client-Free-Memory=6295596; Client-Image=flash:c831-k9o3y6-mz.ef90241Related Commands
show crypto isakmp policy
To display the parameters for each Internet Key Exchange (IKE) policy, use the show crypto isakmp policy command in privileged EXEC mode.
show crypto isakmp policy
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
There are eight default IKE default policies supported with protection suites of priorities 65507-65514, where 65507 is the highest priority and 65514 is the lowest priority. If you have neither manually configured IKE policies with the crypto isakmp policy command nor disabled the default IKE policies by issuing the no crypto isakmp default policy command, the default IKE policies will be displayed when the show crypto isakmp policy command is issued.
Examples
The following is sample output from the show crypto isakmp policy command, after two IKE policies have been configured (with priorities 15 and 20, respectively):
Router# show crypto isakmp policyProtection suite priority 15encryption algorithm: DES - Data Encryption Standard (56 bit keys)hash algorithm: Message Digest 5authentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman Group: #2 (1024 bit)lifetime: 5000 seconds, no volume limitProtection suite priority 20encryption algorithm: DES - Data Encryption Standard (56 bit keys)hash algorithm: Secure Hash Standardauthentication method: preshared KeyDiffie-Hellman Group: #1 (768 bit)lifetime: 10000 seconds, no volume limitDefault protection suiteencryption algorithm: DES - Data Encryption Standard (56 bit keys)hash algorithm: Secure Hash Standardauthentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman Group: #1 (768 bit)lifetime: 86400 seconds, no volume limit
Note
The following sample output from the show crypto isakmp policy command displays a warning message after a user tries to configure an IKE encryption method that the hardware does not support:
Router# show crypto isakmp policyProtection suite of priority 1encryption algorithm: AES - Advanced Encryption Standard (256 bit keys).WARNING:encryption hardware does not support the configuredencryption method for ISAKMP policy 1hash algorithm: Secure Hash Standardauthentication method: Pre-Shared KeyDiffie-Hellman group: #1 (768 bit)lifetime: 3600 seconds, no volume limitThe following sample output from the show crypto isakmp policy command displays the default IKE policies. The manually configured IKE policies with priorities 10 and 20 have been removed.
Router(config)# no crypto isakmp policy 10Router(config)# no crypto isakmp policy 20Router(config)# exitR1# show crypto isakmp policyDefault IKE policyProtection suite of priority 65507encryption algorithm: AES - Advanced Encryption Standard (128 bit key.hash algorithm: Secure Hash Standardauthentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitProtection suite of priority 65508encryption algorithm: AES - Advanced Encryption Standard (128 bit key.hash algorithm: Secure Hash Standardauthentication method: Pre-Shared KeyDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitProtection suite of priority 65509encryption algorithm: AES - Advanced Encryption Standard (128 bit key.hash algorithm: Message Digest 5authentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitProtection suite of priority 65510encryption algorithm: AES - Advanced Encryption Standard (128 bit key.hash algorithm: Message Digest 5authentication method: Pre-Shared KeyDiffie-Hellman group: #5 (1536 bit)lifetime: 86400 seconds, no volume limitProtection suite of priority 65511encryption algorithm: Three key triple DEShash algorithm: Secure Hash Standardauthentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitProtection suite of priority 65512encryption algorithm: Three key triple DEShash algorithm: Secure Hash Standardauthentication method: Pre-Shared KeyDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitProtection suite of priority 65513encryption algorithm: Three key triple DEShash algorithm: Message Digest 5authentication method: Rivest-Shamir-Adleman SignatureDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitProtection suite of priority 65514encryption algorithm: Three key triple DEShash algorithm: Message Digest 5authentication method: Pre-Shared KeyDiffie-Hellman group: #2 (1024 bit)lifetime: 86400 seconds, no volume limitThe field descriptions in the display are self-explanatory.
Related Commands
show crypto isakmp profile
To list all the Internet Security Association and Key Management Protocol (ISAKMP) profiles that are defined on a router, use the show crypto isakmp profile command in privileged EXEC mode.
show crypto isakmp profile [tag profilename | vrf vrfname]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Examples
The following is sample output from the show crypto isakmp profile command:
Router# show crypto isakmp profileISAKMP PROFILE vpn1-raIdentities matched are:group vpn1-raIdentity presented is: ip-addressThe following sample output shows information for an IPv6 router:
Router# show crypto isakmp profileISAKMP PROFILE tomIdentities matched are:ipv6-address 2001:0DB8:0:1::1/32Certificate maps matched are:Identity presented is: ipv6-address fqdnkeyring(s): <none>trustpoint(s): <all>Table 103 describes the significant fields shown in the display.
The following configuration was in effect when the preceding show crypto isakmp profile command was issued:
crypto isakmp profile vpn1-ravrf vpn1self-identity addressmatch identity group vpn1-raclient authentication list aaa-listisakmp authorization list aaaclient configuration address initiateclient configuration address respondRelated Commands
show crypto isakmp sa
To display current Internet Key Exchange (IKE) security associations (SAs), use the show crypto isakmp sa command in privileged EXEC mode.
show crypto isakmp sa [active | standby | detail | nat] [vrf vrfname]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
If neither the active keyword nor the standby keyword is specified, current SAs for all configured routers will be shown. Use the nat keyword to display the IP address and port address of a remote peer when NAT is used.
Examples
The following sample output shows the SAs of both the active and standby devices:
Router# show crypto isakmp sadst src state conn-id slot status10.165.201.3 10.165.200.225 QM_IDLE 2 0 STDBY10.0.0.1 10.0.0.2 QM_IDLE 1 0 ACTIVEThe following sample output shows the SAs of only the active device:
Router# show crypto isakmp sa activedst src state conn-id slot status10.165.201.3 10.165.200.225 QM_IDLE 5 0 ACTIVEThe following sample output shows the SAs of only the standby device:
Router# show crypto isakmp sa standbydst src state conn-id slot status10.165.201.3 10.165.200.225 QM_IDLE 5 0 STDBY10.165.201.3 10.165.200.225 QM_IDLE 1 0 STDBYThe following sample output shows the SAs of an active IPv6 device. The IPv4 device is inactive.
Router# show crypto isakmp sa detail
Codes: C - IKE configuration mode, D - Dead Peer Detection
K - Keepalives, N - NAT-traversal
X - IKE Extended Authentication
psk - Preshared key, rsig - RSA signature
renc - RSA encryption
IPv4 Crypto ISAKMP SA
C-id Local Remote I-VRF Status Encr Hash Auth DH
Lifetime Cap.
IPv6 Crypto ISAKMP SA
dst: 3FFE:2002::A8BB:CCFF:FE01:2C02
src: 3FFE:2002::A8BB:CCFF:FE01:9002
conn-id: 1001 I-VRF: Status: ACTIVE Encr: des Hash: sha Auth:
psk
DH: 1 Lifetime: 23:45:00 Cap: D Engine-id:Conn-id = SW:1
dst: 3FFE:2002::A8BB:CCFF:FE01:2C02
src: 3FFE:2002::A8BB:CCFF:FE01:9002
conn-id: 1002 I-VRF: Status: ACTIVE Encr: des Hash: sha Auth:
psk
DH: 1 Lifetime: 23:45:01 Cap: D Engine-id:Conn-id = SW:2
Table 104 through Table 107 show the various states that may be displayed in the output of the show crypto isakmp sa command. When an Internet Security Association and Key Management Protocol (ISAKMP) SA exists, it will most likely be in its quiescent state (QM_IDLE). For long exchanges, some of the main mode (MM_xxx) states may be observed.
Related Commands
crypto isakmp policy
Defines an IKE policy.
lifetime (IKE policy)
Specifies the lifetime of an IKE SA.
show crypto key mypubkey rsa
To display the RSA public keys of your router, use the show crypto key mypubkey rsa command in privileged EXEC mode.
show crypto key mypubkey rsa
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
This command displays the RSA public keys of your router.
Note
Examples
The following is sample output from the show crypto key mypubkey rsa command. Special usage RSA keys were previously generated for this router using the crypto key generate rsa command.
% Key pair was generated at: 06:07:49 UTC Jan 13 1996Key name: myrouter.example.comUsage: Signature KeyKey Data:005C300D 06092A86 4886F70D 01010105 00034B00 30480241 00C5E23B 55D6AB2204AEF1BA A54028A6 9ACC01C5 129D99E4 64CAB820 847EDAD9 DF0B4E4C 73A05DD2BD62A8A9 FA603DD2 E2A8A6F8 98F76E28 D58AD221 B583D7A4 71020301 0001% Key pair was generated at: 06:07:50 UTC Jan 13 1996Key name: myrouter.example.comUsage: Encryption KeyKey Data:00302017 4A7D385B 1234EF29 335FC973 2DD50A37 C4F4B0FD 9DADE748 429618D518242BA3 2EDFBDD3 4296142A DDF7D3D8 08407685 2F2190A0 0B43F1BD 9A8A26DB07953829 791FCDE9 A98420F0 6A82045B 90288A26 DBC64468 7789F76E EE21The following example shows how to encrypt the RSA key "pki1-72a.cisco.com." Thereafter, the show crypto key mypubkey rsa command is issued to verify that the RSA key is encrypted (protected) and unlocked.
Router(config)# crypto key encrypt rsa name pki1-72a.cisco.com passphrase cisco1234Router(config)# exitRouter# show crypto key mypubkey rsa% Key pair was generated at:00:15:32 GMT Jun 25 2003
Key name:pki1-72a.cisco.com
Usage:General Purpose Key
*** The key is protected and UNLOCKED. ***
Key is not exportable.
Key Data:
305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00E0CC9A 1D23B52C
CD00910C ABD392AE BA6D0E3F FC47A0EF 8AFEE340 0EC1E62B D40E7DCC
23C4D09E
03018B98 E0C07B42 3CFD1A32 2A3A13C0 1FF919C5 8DE9565F 1F020301 0001
% Key pair was generated at:00:15:33 GMT Jun 25 2003
Key name:pki1-72a.cisco.com.server
Usage:Encryption Key
Key is exportable.
Key Data:
307C300D 06092A86 4886F70D 01010105 00036B00 30680261 00D3491E 2A21D383
854D7DA8 58AFBDAC 4E11A7DD E6C40AC6 66473A9F 0C845120 7C0C6EC8 1FFF5757
3A41CE04 FDCB40A4 B9C68B4F BC7D624B 470339A3 DE739D3E F7DDB549 91CD4DA4
DF190D26 7033958C 8A61787B D40D28B8 29BCD0ED 4E6275C0 6D020301 0001
Router#The following example shows how to lock the key "pki1-72a.cisco.com." Thereafter, the show crypto key mypubkey rsa command is issued to verify that the key is protected (encrypted) and locked.
Router# crypto key lock rsa name pki1-72a.cisco.com passphrase cisco1234!Router# show crypto key mypubkey rsa% Key pair was generated at:20:29:41 GMT Jun 20 2003Key name:pki1-72a.cisco.comUsage:General Purpose Key*** The key is protected and LOCKED. ***Key is exportable.Key Data:305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00D7808D C5FF14AC0D2B55AC 5D199F2F 7CB4B355 C555E07B 6D0DECBE 4519B1F0 75B12D6F 902D6E9FB6FDAD8D 654EF851 5701D5D7 EDA047ED 9A2A619D 5639DF18 EB020301 0001The string "Redundancy enabled" in the following example indicates that the redundancy keyword was specified when the key was generated by the crypto_key_generate_rsa command.Router#show crypto key mypubkey rsa MYKEYS% Key pair was generated at: 07:38:04 GMT Oct 02 2009Key name: MYKEYSStorage Device: not specifiedUsage: General Purpose KeyKey is not exportable. Redundancy enabled.Key Data:305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00A63726 28C9EE7DA89AF6E1 5B42A854 A76EDF9F 35681024 A7868113 B93E2384 EF15CD78 8467A797F946268F 067FF15E A1734BE6 3E3444C2 BAE00618 BCAED5A3 BB020301 0001Related Commands
crypto key encrypt rsa
Encrypts the RSA private key.
crypto key generate rsa
Generates RSA key pairs.
crypto key lock rsa
Locks the RSA private key in a router.
show crypto key pubkey-chain rsa
To display the RSA public keys of the peer that are stored on the router, use the show crypto key pubkey-chain rsa command in user EXEC mode or privileged EXEC mode.
show crypto key pubkey-chain rsa [address key-address | name key-name | vrf vrf-name [address ip-address]]
Syntax Description
Command Default
Information is displayed for all RSA public keys stored on the router.
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
The keys that are displayed include peers' RSA public keys that are manually configured at the router and keys that are received by the router via other means (such as by a certificate, if certification authority support is configured).
If a router reboots, any keys derived by certificates are lost. This is because the router requests certificates again (then the keys are derived again).
Examples
The following example shows how to display information for all RSA public keys stored on the router:
Router# show crypto key pubkey-chain rsaCodes: M - Manually Configured, C - Extracted from certificateCode Usage IP-address Keyring NameM Signature 209.165.200.225 default myrouter.example.comM Encryption 209.165.202.129 default myrouter.example.comC Signature 209.165.200.225 default routerA.example.comC Encryption 209.165.202.129 default routerA.example.comC General 209.165.200.225 default routerB.domain1.comThe example above shows manually configured special usage RSA public keys for the peer myrouter.example.com. This sample also indicates certificate support and therefore shows three keys obtained from peers' certificates: special usage keys for peer routerA.example.com and a general purpose key for peer routerB.domain1.com.
The following example shows how to display keys for a specific VRF instance.
Router# show crypto key pubkey-chain rsa vrf
Code Usage IP-Address/VRF Keyring NameM General 209.165.200.225 default Key_1M General 209.165.202.129 default Key_2The following example shows how to display details for a key named somerouter.example.com:
Router# show crypto key pubkey-chain rsa name somerouter.example.comKey name: somerouter.example.comKey address: 209.165.200.225Usage: Signature KeySource: ManualData:305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00C5E23B 55D6AB2204AEF1BA A54028A6 9ACC01C5 129D99E4 64CAB820 847EDAD9 DF0B4E4C 73A05DD2BD62A8A9 FA603DD2 E2A8A6F8 98F76E28 D58AD221 B583D7A4 71020301 0001Key name: somerouter.example.comKey address: 209.165.200.225Usage: Encryption KeySource: ManualData:00302017 4A7D385B 1234EF29 335FC973 2DD50A37 C4F4B0FD 9DADE748 429618D518242BA3 2EDFBDD3 4296142A DDF7D3D8 08407685 2F2190A0 0B43F1BD 9A8A26DB07953829 791FCDE9 A98420F0 6A82045B 90288A26 DBC64468 7789F76E EE21
Note
The following example shows how to display details for a key with address 209.165.202.129:
Router# show crypto key pubkey-chain rsa address 209.165.202.129Key name: routerB.example.comKey address: 209.165.202.129Usage: General Purpose KeySource: CertificateData:0738BC7A 2BC3E9F0 679B00FE 53987BCC 01030201 42DD06AF E228D24C 458AD22858BB5DDD F4836401 2A2D7163 219F882E 64CE69D4 B583748A 241BED0F 6E7F2F160DE0986E DF02031F 4B0B0912 F68200C4 C625C389 0BFF3321 A2598935 C1B1
Note
Table 108 describes the significant fields shown in the displays.
Related Commands
show crypto map (IPsec)
To display the crypto map configuration, use the show crypto map command in user EXEC or privileged EXEC mode.
show crypto map [gdoi fail-close map-name | interface interface | tag map-name]
Syntax Description
Command Default
No crypto maps are displayed.
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
The show crypto map command allows you to specify a particular crypto map. The crypto maps shown in the command output are dynamically generated; you need not configure crypto maps in order for them to appear in this command output.
Two default transform sets are supported in Cisco IOS K9 images only:
•
•
The show crypto map command displays the default transform sets if no other transform sets are configured for the crypto map, if you have not disabled the default transform sets by issuing the no crypto ipsec default transform-set command, and if the crypto engine supports the encryption algorithm.
Examples
The following example shows that crypto input and output ACLs have been configured:
Router# show crypto mapCrypto Map "test" 10 ipsec-isakmpPeerExtended IP access list ipsec_aclaccess-list ipsec_acl permit ip 192.168.2.0 0.0.0.255 192.168.102.0 0.0.0.255Extended IP access check IN list 110access-list 110 permit ip host 192.168.102.47 192.168.2.0 10.0.0.15access-list 110 permit ip host 192.168.102.47 192.168.2.32 10.0.0.15access-list 110 permit ip host 192.168.102.47 192.168.2.64 10.0.0.15access-list 110 permit ip host 192.168.102.57 192.168.2.0 10.0.0.15access-list 110 permit ip host 192.168.102.57 192.168.2.32 10.0.0.15access-list 110 permit ip host 192.168.102.57 192.168.2.64 10.0.0.15Extended IP access check OUT list 120access-list 120 permit ip 192.168.2.0 10.0.0.15 host 192.168.102.47access-list 120 permit ip 192.168.2.32 10.0.0.15 host 192.168.102.47access-list 120 permit ip 192.168.2.64 10.0.0.15 host 192.168.102.47access-list 120 permit ip 192.168.2.0 10.0.0.15 host 192.168.102.57access-list 120 permit ip 192.168.2.32 10.0.0.15 host 192.168.102.57access-list 120 permit ip 192.168.2.64 10.0.0.15 host 192.168.102.57Current peer: 10.0.0.2Security association lifetime: 4608000 kilobytes/3600 secondsPFS (Y/N): NTransform sets=testInterfaces using crypto map test:Serial0/1Table 109 describes the significant fields shown in the display.
The following example displays output from the show crypto map command. No transform sets are configured for the crypto map "mymap," the default transform sets are enabled, and the crypto engine supports the encryption algorithm.
Router# show crypto mapCrypto Map "mymap" 1 ipsec-isakmpPeer = 209.165.201.1Extended IP access list 102access-list 102 permit ip 192.168.1.0 0.0.0.255 10.0.0.0 0.0.255.255Security association lifetime: 4608000 kilobytes/3600 secondsPFS (Y/N): NTransform sets={#$!default_transform_set_1: { esp-aes esp-sha-hmac } ,#$!default_transform_set_0: { esp-3des esp-sha-hmac } ,}Reverse Route Injection EnabledInterfaces using crypto map mymap:The following example displays output of the show crypto map command. No transform sets configured for the crypto map "mymap" and the default transform sets have been disabled.
Router(config)# no crypto ipsec default transform-setRouter(config)# exitRouter# configure terminalRouter# show crypto mapCrypto Map "mymap" 1 ipsec-isakmpPeer = 209.165.201.1Extended IP access list 102access-list 102 permit ip 192.168.1.0 0.0.0.255 10.0.0.0 0.0.255.255Security association lifetime: 4608000 kilobytes/3600 secondsPFS (Y/N): NTransform sets={}! There are no transform sets for the crypto map "mymap."Reverse Route Injection EnabledInterfaces using crypto map mymap:The following example displays output for the show crypto map command and gdoi fail-close keywords (show crypto map gdoi fail-close). Fail-close has been activated. In addition, an implicit "permit ip any any" entry is configured, causing any traffic other than Telnet and Open Shortest Path First (OSPF) to be dropped:
Router# show crypto map gdoi fail-close 23Crypto Map: "svn"Activate: yesFail-Close Access-List: (Deny = Forward In Clear, Permit = Drop)access-list 105 deny tcp any port = 23 anyaccess-list 105 deny ospf any anyRelated Commands
show crypto ipsec default transform-set
Displays the default IPsec transform sets.
show crypto ipsec transform-set
Displays the configured transform sets.
show crypto mib ipsec flowmib endpoint
To display the IP Security (IPsec) phase-2 tunnel endpoint table, use the show crypto mib ipsec flowmib endpoint command in privileged EXEC mode.
show crypto mib ipsec flowmib endpoint [vrf vrf-name]
Syntax Description
vrf vrf-name
(Optional) Displays the parameters for the specified Virtual Private Network (VPN) routing and forwarding (VRF) instance.
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Usage Guidelines
The IPsec phase-2 tunnel endpoint table contains an entry for each active endpoint associated with an IPsec phase-2 tunnel.
Examples
The following example displays the IPsec phase 2 tunnel endpoint table for all VRFs:
Router# show crypto mib ipsec flowmib endpointvrf GlobalIndex: 1Local type: Single IP addressLocal address: 192.1.2.1Protocol: 0Local port: 0Remote type: Single IP addressRemote address: 192.1.2.2Remote port: 0Index: 2Local type: SubnetLocal address: 192.1.3.0 255.255.255.0Protocol: 0Local port: 0Remote type: SubnetRemote address: 192.1.3.0 255.255.255.0Remote port: 0Table 110 describes the significant fields shown in the display.
Related Commands
show crypto mib ipsec flowmib failure
To display statistics associated with IP Security (IPsec) phase-2 failure, use the show crypto mib ipsec flowmib failure command in privileged EXEC mode.
show crypto mib ipsec flowmib failure [vrf vrf-name]
Syntax Description
vrf vrf-name
(Optional) Displays the parameters for the specified Virtual Private Network (VPN) routing and forwarding (VRF) instance.
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Examples
The following example displays the IPsec phase 2 MIB failure table for all indexes and VRFs:
Router# show crypto mib ipsec flowmib failurevrf GlobalIndex: 1Reason: Operation requestFailure time since reset: 00:25:18Src address: 192.1.2.1Destination address: 192.1.2.2SPI: 0Table 111 describes the significant fields shown in the display.
Related Commands
show crypto mib ipsec flowmib global
To display IP Security (IPsec) phase-2 global statistics, use the show crypto mib ipsec flowmib global command in privileged EXEC mode.
show crypto mib ipsec flowmib global [vrf vrf-name]
Syntax Description
vrf vrf-name
(Optional) Displays the parameters for the specified Virtual Private Network (VPN) routing and forwarding (VRF) instance.
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Examples
The following example displays IPsec phase 2 global statistics for all VRFs:
Router# show crypto mib ipsec flowmib globalvrf GlobalActive Tunnels: 2Previous Tunnels: 0In octets: 800Out octets: 1408In packets: 8Out packets: 8Uncompressed encrypted bytes: 1408In packets drops: 0Out packets drops: 2In replay drops: 0In authentications: 8Out authentications: 8In decrypts: 8Out encrypts: 8Compressed bytes: 0Uncompressed bytes: 0In uncompressed bytes: 0Out uncompressed bytes: 0In decrypt failures: 0Out encrypt failures: 0No SA failures: 0Protocol use failures: 0System capacity failures: 0In authentication failures: 0Out authentication failures: 0Table 112 describes the significant fields shown in the display.
Related Commands
show crypto mib ipsec flowmib history
To display statistics associated with previously active IP Security (IPsec) phase-2 tunnels, use the show crypto mib ipsec flowmib history command in privileged EXEC mode.
show crypto mib ipsec flowmib history [vrf vrf-name]
Syntax Description
vrf vrf-name
(Optional) Displays the parameters for the specified Virtual Private Network (VPN) routing and forwarding (VRF) instance.
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Examples
The following example displays the IPsec phase 2 history statistics for all VRFs:
Router# show crypto mib ipsec flowmib historyvrf GlobalReason: Operation requestIndex: 1Local address: 192.1.2.1Remote address: 192.1.2.2IPSEC keying: IKEEncapsulation mode: 1Lifetime (KB): 4608000Lifetime (Sec): 3600Active time: 00:24:32Lifetime threshold (KB): 423559168Lifetime threshold (Sec): 3590000Total number of refreshes: 0Expired SA instances: 4Current SA instances: 4In SA DH group: 1In sa encrypt algorithm desIn SA auth algorithm: rsigIn SA ESP auth algo: ESP_HMAC_SHAIn SA uncompress algorithm: NoneOut SA DH group: 1Out SA encryption algorithm: desOut SA auth algorithm: ESP_HMAC_SHAOut SA ESP auth algorithm: ESP_HMAC_SHAOut SA uncompress algorithm: NoneIn octets: 400Decompressed octets: 400In packets: 4In drops: 0In replay drops: 0In authentications: 4In authentication failures: 0In decrypts: 4In decrypt failures: 0Out octets: 704Out uncompressed octets: 704Out packets: 4Out drops: 1Out authentications: 4Out authentication failures: 0Out encryptions: 4Out encryption failures: 0Compressed octets: 0Decompressed octets: 0Out uncompressed octets: 704Table 113 describes the significant fields shown in the display.
Related Commands
show crypto mib ipsec flowmib history failure size
To display the size of the IP Security (IPSec) failure history table, use the show crypto mib ipsec flowmib history failure size command in privileged EXEC mode.
show crypto mib ipsec flowmib history failure size
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the show crypto mib ipsec flowmib history failure size command to display the size of the failure history table.
Examples
The following is sample output from the show crypto mib ipsec flowmib history failure size command:
Router# show crypto mib ipsec flowmib history failure sizeIPSec Failure Window size: 140Related Commands
show crypto mib ipsec flowmib history tunnel size
To display the size of the IP Security (IPSec) tunnel history table, use the show crypto mib ipsec flowmib history tunnel size command in privileged EXEC mode.
show crypto mib ipsec flowmib history tunnel size
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the show crypto mib ipsec flowmib history tunnel size command to display the size of the tunnel history table.
Examples
The following is sample output from the show crypto mib ipsec flowmib history tunnel size command:
Router# show crypto mib ipsec flowmib history tunnel sizeIPSec History Window Size: 130Related Commands
show crypto mib ipsec flowmib spi
To display the IP Security (IPsec) phase-2 security protection index (SPI) table, use the show crypto mib ipsec flowmib spi command in privileged EXEC mode.
show crypto mib ipsec flowmib spi [vrf vrf-name]
Syntax Description
vrf vrf-name
(Optional) Displays the parameters for the specified Virtual Private Network (VPN) routing and forwarding (VRF) instance.
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Usage Guidelines
The IPsec phase-2 SPI table contains an entry for each active and expiring security association (SA).
Examples
The following example displays the IPsec phase-2 SPI table for all VRFs:
Router# show crypto mib ipsec flowmib spivrf GlobalTunnel Index: 1SPI Index: 1SPI Value: 0xCC57D053SPI Direction: InSPI Protocol: AHSPI Status: ActiveSPI Index: 2SPI Value: 0x68612DFSPI Direction: OutSPI Protocol: AHSPI Status: ActiveSPI Index: 3SPI Value: 0x56947526SPI Direction: InSPI Protocol: ESPSPI Status: ActiveSPI Index: 4SPI Value: 0x8D7C2204SPI Direction: OutSPI Protocol: ESPSPI Status: ActiveThe field descriptions in the display are self-explanatory.
Related Commands
show crypto mib ipsec flowmib tunnel
To display statistics for all active IP Security (IPsec) phase-2 tunnels, use the show crypto mib ipsec flowmib tunnel command in privileged EXEC mode.
show crypto mib ipsec flowmib tunnel [index tunnel-mib-index] [vrf vrf-name]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Examples
The following example displays statistics for all active IPsec phase-2 tunnels for all tunnel indexes and VRFs:
Router# show crypto mib ipsec flowmib tunnelvrf GlobalIndex: 1Local address: 192.0.2.1Remote address: 192.0.2.2IPSEC keying: IKEEncapsulation mode: 1Lifetime (KB): 4608000Lifetime (Sec): 3600Active time: 00:05:46Lifetime threshold (KB): 64Lifetime threshold (Sec): 10Total number of refreshes: 0Expired SA instances: 0Current SA instances: 4In SA DH group: 1In sa encrypt algorithm: desIn SA auth algorithm: rsigIn SA ESP auth algo: ESP_HMAC_SHAIn SA uncompress algorithm: NoneOut SA DH group: 1Out SA encryption algorithm: desOut SA auth algorithm: ESP_HMAC_SHAOut SA ESP auth algorithm: ESP_HMAC_SHAOut SA uncompress algorithm: NoneIn octets: 400Decompressed octets: 400In packets: 4In drops: 0In replay drops: 0In authentications: 4In authentication failures: 0In decrypts: 4In decrypt failures: 0Out octets: 704Out uncompressed octets: 704Out packets: 4Out drops: 1Out authentications: 4Out authentication failures: 0Out encryptions: 4Out encryption failures: 0Compressed octets: 0Decompressed octets: 0Out uncompressed octets: 704Table 114 describes the significant fields shown in the display.
Related Commands
show crypto mib ipsec flowmib version
To display the IP Security (IPSec) MIB version used by the router, use the show crypto mib ipsec flowmib version command in privileged EXEC mode.
show crypto mib ipsec flowmib version
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the show crypto mib ipsec flowmib version command to display the MIB version used by the management applications to identify the feature set.
Note
Examples
The following is sample output from the show crypto mib ipsec flowmib version command:
Router# show crypto mib ipsec flowmib versionIPSec Flow MIB version: 1Related Commands
show crypto mib isakmp flowmib failure
To display the statistics associated with an Internet Security Association and Key Management Protocol (ISAKMP) phase-1 failure, use the show crypto mib isakmp flowmib failure command in privileged EXEC mode.
show crypto mib isakmp flowmib failure [vrf vrf-name]
Syntax Description
vrf vrf-name
(Optional) Displays the parameters for a specific Virtual Private Network (VPN) routing and forwarding (VRF) instance.
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Examples
The following is sample output from the show crypto mib isakmp flowmib failure command:
vrf GlobalIndex: 1Reason: peer lostFailure time since reset: 00:07:27Local type: ID_IPV4_ADDRLocal value: 192.0.2.1Remote type: ID_IPV4_ADDRRemote Value: 192.0.2.2Local Address: 192.0.2.1Remote Address: 192.0.2.2Index: 2Reason: peer lostFailure time since reset: 00:07:27Local type: ID_IPV4_ADDRLocal value: 192.0.3.1Remote type: ID_IPV4_ADDRRemote Value: 192.0.3.2Local Address: 192.0.3.1Remote Address: 192.0.3.2Index: 3Reason: peer lostFailure time since reset: 00:07:32Local type: ID_IPV4_ADDRRemote type: ID_IPV4_ADDRRemote Value: 192.0.2.2Local Address: 192.0.2.1Remote Address: 192.0.2.2Table 115 describes the significant fields shown in the display.
Related Commands
show crypto mib isakmp flowmib global
To display the global Internet Security Association and Key Management Protocol (ISAKMP) phase-1 statistics, use the show crypto mib isakmp flowmib global command in privileged EXEC mode.
show crypto mib isakmp flowmib global [vrf vrf-name]
Syntax Description
vrf vrf-name
(Optional) Displays the parameters for a specific Virtual Private Network (VPN) routing and forwarding (VRF) instance.
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Examples
The following example displays global ISAKMP statistics:
Router# show crypto mib isakmp flowmib globalvrf GlobalActive Tunnels: 3Previous Tunnels: 0In octets: 2856Out octets: 3396In packets: 16Out packets: 19In packets drop: 0Out packets drop: 0In notifys: 4Out notifys: 7In P2 exchg: 3Out P2 exchg: 6In P2 exchg invalids: 0Out P2 exchg invalids: 0In P2 exchg rejects: 0Out P2 exchg rejects: 0In IPSEC delete: 0Out IPSEC delete: 0SAs locally initiated: 3SAs locally initiated failed: 0SAs remotely initiated failed: 0System capacity failures: 0Authentication failures: 0Decrypt failures: 0Hash failures: 0Invalid SPI: 0Table 116 describes the fields shown in the display.
Related Commands
show crypto mib isakmp flowmib history
To display the statistics associated with previously active Internet Security Association and Key Management Protocol (ISAKMP) phase-1 tunnels, use the show crypto mib isakmp flowmib history command in privileged EXEC mode.
show crypto mib isakmp flowmib history [vrf vrf-name]
Syntax Description
vrf vrf-name
(Optional) Displays the parameters for a specific Virtual Private Network (VPN) routing and forwarding (VRF) instance.
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Examples
The following example displays previous ISAKMP phase-1 tunnel information for all VRFs:
Router# show crypto mib isakmp flowmib historyvrf GlobalReason: peer lostIndex: 2Local type: ID_IPV4_ADDRLocal address: 192.0.2.1Remote type: ID_IPV4_ADDRRemote address: 192.0.2.2Negotiation mode: Main ModeDiffie Hellman Grp: 2Encryption algo: desHash algo: shaAuth method: pskLifetime: 86400Active time: 00:06:30Policy priority: 1Keepalive enabled: YesIn octets: 3024In packets: 22In drops: 0In notifys: 18In P2 exchanges: 1In P2 exchg invalids: 0In P2 exchg rejected: 0In P2 SA delete reqs: 0Out octets: 4188Out packets: 33Out drops: 0Out notifys: 28Out P2 exchgs: 2Out P2 exchg invalids: 0Out P2 exchg rejects: 0Out P2 Sa delete requests: 0Reason: peer lostIndex: 3Local type: ID_IPV4_ADDRLocal address: 192.0.3.1Remote type: ID_IPV4_ADDRRemote address: 192.0.3.2Negotiation mode: Main ModeDiffie Hellman Grp: 2Encryption algo: desHash algo: shaAuth method: pskLifetime: 86400Active time: 00:06:25Policy priority: 1Keepalive enabled: YesIn octets: 3140In packets: 23In drops: 0In notifys: 19In P2 exchanges: 1In P2 exchg invalids: 0In P2 exchg rejected: 0In P2 SA delete reqs: 0Out octets: 4304Out packets: 34Out drops: 0Out notifys: 29Out P2 exchgs: 2Out P2 exchg invalids: 0Out P2 exchg rejects: 0Out P2 Sa delete requests: 0Table 117 describes the significant fields shown in the display.
Related Commands
show crypto mib isakmp flowmib peer
To display attributes for an active Internet Security Association and Key Management Protocol (ISAKMP) phase-1 peer association, use the show crypto mib isakmp flowmib peer command in privileged EXEC mode.
show crypto mib isakmp flowmib peer [index peer-mib-index] [vrf vrf-name]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Examples
The following example displays ISAKMP peer information for all indexes and VRFs:
Router# show crypto mib isakmp flowmib peervrf GlobalIndex: 1Local type: ID_IPV4_ADDRLocal address: 192.0.2.1Remote type: ID_IPV4_ADDRRemote address: 192.0.2.2Index: 2Local type: ID_IPV4_ADDRLocal address: 192.0.3.1Remote type: ID_IPV4_ADDRRemote address: 192.0.3.1Index: 3Local type: ID_IPV4_ADDRLocal address: 192.0.4.1Remote type: ID_IPV4_ADDRRemote address: 192.0.4.1Table 118 describes the significant fields shown in the display.
Related Commands
show crypto mib isakmp flowmib tunnel
To display statistics associated with active Internet Security Association and Key Management Protocol (ISAKMP) phase-1 tunnels, use the show crypto mib isakmp flowmib tunnel command in privileged EXEC mode.
show crypto mib isakmp flowmib tunnel [index tunnel-mib-index] [vrf vrf-name]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Examples
The following example displays ISAKMP tunnel information for all indexes and VRFs:
Router# show crypto mib isakmp flowmib tunnelvrf GlobalIndex: 1Local type: ID_IPV4_ADDRLocal address: 192.0.2.1Remote type: ID_IPV4_ADDRRemote address: 192.0.2.2Negotiation mode: Main ModeDiffie Hellman Grp: 2Encryption algo: desHash algo: shaAuth method: pskLifetime: 86400Active time: 00:03:08Policy priority: 1Keepalive enabled: YesIn octets: 2148In packets: 15In drops: 0In notifys: 11In P2 exchanges: 1In P2 exchg invalids: 0In P2 exchg rejected: 0In P2 SA delete reqs: 0Out octets: 2328Out packets: 16Out drops: 0Out notifys: 12Out P2 exchgs: 2Out P2 exchg invalids: 0Out P2 exchg rejects: 0Out P2 Sa delete requests: 0Table 119 describes the significant fields shown in the display.
Related Commands
show crypto pki benchmarks
To display benchmarking data for Public Key Infrastructure (PKI) performance monitoring and optimization that was collected, use the show crypto pki benchmarks command in privileged EXEC mode.
show crypto pki benchmarks [failures]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the show crypto pki benchmarks command to display benchmarking data for PKI performance monitoring and optimization that was collected.
The IOS PKI Performance Monitoring and Optimization feature enables you to collect the following types of PKI performance data:
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Examples
The following example displays show crypto pki benchmark command output of all PKI benchmarking data:
Router# show crypto pki benchmarkDisplay Validation Benchmark Table4 Records collectedValidation Session 10006Start: 20:47:29.021 GMT Wed Oct 27 2010Duration: 756 msPeer Certificate Serial Number (hex): 296ED1EB0000000052FAPubkey Bypass: noResult: SuccessSize of Chain to Validate: 1Revocation Check for Certificate 1 of 1Start: 20:47:29.063 GMT Wed Oct 27 2010Duration: 714 msCRL Fetch - http://msca-root/CertEnroll/msca-root.crlStart: 20:47:29.067 GMT Wed Oct 27 2010Duration: 661 msFetch Result: SuccessCRL InsertStart: 20:47:29.731 GMT Wed Oct 27 2010Duration: 24 msCRL Size: 582Validation Session 10007Start: 20:48:15.897 GMT Wed Oct 27 2010Duration: 26 msPubkey Bypass: noResult: Failed CRYPTO_CERT_EXPIREDSize of Chain to Validate: 1Validation Session 10008Start: 20:49:08.916 GMT Wed Oct 27 2010Duration: 26 msPubkey Bypass: noResult: Failed CRYPTO_CERT_EXPIREDSize of Chain to Validate: 1Validation Session 10009Start: 20:49:15.051 GMT Wed Oct 27 2010Duration: 32 msPeer Certificate Serial Number (hex): 296ED1EB0000000052FAPubkey Bypass: noResult: SuccessSize of Chain to Validate: 1Revocation Check for Certificate 1 of 1Start: 20:49:15.076 GMT Wed Oct 27 2010Duration: 6 msThe following example displays show crypto pki benchmark command output of a section filter in PKI benchmarking data:Router# show crypto pki benchmark | section RevocationRevocation Check for Certificate 1 of 1Start: 20:47:29.063 GMT Wed Oct 27 2010Duration: 714 msRevocation Check for Certificate 1 of 1Start: 20:49:15.076 GMT Wed Oct 27 2010Duration: 6 msRelated Commands
show crypto pki certificates
To display information about your certificate, the certification authority certificate (CA), and any registration authority (RA) certificates, use the show crypto pki certificates command in privileged EXEC mode.
show crypto pki certificates [trustpoint-name [verbose]]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
This command shows information about the following certificates:
•
•
•
•
•
Examples
The following is sample output from the show crypto pki certificates command after you authenticated the CA by requesting the certificate of the CA and public key with the crypto pki authenticate command:
CA CertificateStatus: AvailableCertificate Serial Number: 3051DF7123BEE31B8341DFE4B3A338E5FKey Usage: Not SetThe CA certificate might show Key Usage as "Not Set."
The following is sample output from the show crypto pki certificates command, and it shows the certificate of the router and the certificate of the CA. In this example, a single, general-purpose Rivest, Shamir, and Adelman (RSA) key pair was previously generated, and a certificate was requested but not received for that key pair.
CertificateSubject NameName: myrouter.example.comIP Address: 10.0.0.1Serial Number: 04806682Status: PendingKey Usage: General PurposeFingerprint: 428125BD A3419600 3F6C7831 6CD8FA95 00000000CA CertificateStatus: AvailableCertificate Serial Number: 3051DF7123BEE31B8341DFE4B3A338E5FKey Usage: Not SetNote that in the previous sample, the certificate status of the router shows "Pending." After the router receives its certificate from the CA, the Status field changes to "Available" in the show output.
The following is sample output from the show crypto pki certificates command, and it shows the certificates of two routers and the certificate of the CA. In this example, special-usage RSA key pairs were previously generated, and a certificate was requested and received for each key pair.
CertificateSubject NameName: myrouter.example.comIP Address: 10.0.0.1Status: AvailableCertificate Serial Number: 428125BDA34196003F6C78316CD8FA95Key Usage: SignatureCertificateSubject NameName: myrouter.example.comIP Address: 10.0.0.1Status: AvailableCertificate Serial Number: AB352356AFCD0395E333CCFD7CD33897Key Usage: EncryptionCA CertificateStatus: AvailableCertificate Serial Number: 3051DF7123BEE31B8341DFE4B3A338E5FKey Usage: Not SetThe following is sample output from the show crypto pki certificates command when the CA supports an RA. In this example, the CA and RA certificates were previously requested with the crypto pki authenticate command.
CA CertificateStatus: AvailableCertificate Serial Number: 3051DF7123BEE31B8341DFE4B3A338E5FKey Usage: Not SetRA Signature CertificateStatus: AvailableCertificate Serial Number: 34BCF8A0Key Usage: SignatureRA KeyEncipher CertificateStatus: AvailableCertificate Serial Number: 34BCF89FKey Usage: EncryptionThe following is sample output from the show crypto pki certificates command using the optional trustpoint-name argument and verbose keyword. The output shows the certificate of a router and the certificate of the CA. In this example, general-purpose RSA key pairs were previously generated, and a certificate was requested and received for the key pair.
CertificateStatus: AvailableVersion: 3Certificate Serial Number: 18C1EE03000000004CBDCertificate Usage: General PurposeIssuer:cn=msca-rootou=pki msca-rooto=companyl=stownst=statec=USea=user@example.comSubject:Name: myrouter.example.comhostname=myrouter.example.comCRL Distribution Points:http://msca-root/CertEnroll/msca-root.crlValidity Date:start date: 19:50:40 GMT Oct 5 2004end date: 20:00:40 GMT Oct 12 2004Subject Key Info:Public Key Algorithm: rsaEncryptionRSA Public Key: (360 bit)Signature Algorithm: SHA1 with RSA EncryptionFingerprint MD5: 2B5F53E6 E3E892E6 3A9D3706 01261F10Fingerprint SHA1: 315D127C 3AD34010 40CE7F3A 988BBDA5 CD528824X509v3 extensions:X509v3 Key Usage: A0000000Digital SignatureKey EnciphermentX509v3 Subject Key ID: D156E92F 46739CBA DFE66D2D 3559483E B41ECCF4X509v3 Authority Key ID: 37F3CC61 AF5E7C0B 434AB364 CF9FA0C1 B17C50D9Authority Info Access:Associated Trustpoints: msca-rootKey Label: myrouter.example.comCA CertificateStatus: AvailableVersion: 3Certificate Serial Number: 1244325DE0369880465F977A18F61CA8Certificate Usage: SignatureIssuer:cn=msca-rootou=pki msca-rooto=companyl=townst=statec=USea=user@example.comSubject:cn=msca-rootou=pki msca-rooto=companyl=townst=statec=USea=user@example.comCRL Distribution Points:http://msca-root.example.com/CertEnroll/msca-root.crlValidity Date:start date: 22:19:29 GMT Oct 31 2002end date: 22:27:27 GMT Oct 31 2017Subject Key Info:Public Key Algorithm: rsaEncryptionRSA Public Key: (512 bit)Signature Algorithm: SHA1 with RSA EncryptionFingerprint MD5: 84E470A2 38176CB1 AA0476B9 C0B4F478Fingerprint SHA1: 0F57170C 654A5D7D 10973553 EFB0F94F 2FAF9837X509v3 extensions:X509v3 Key Usage: C6000000Digital SignatureNon RepudiationKey Cert SignCRL SignatureX509v3 Subject Key ID: 37F3CC61 AF5E7C0B 434AB364 CF9FA0C1 B17C50D9X509v3 Basic Constraints:CA: TRUEAuthority Info Access:Associated Trustpoints: msca-rootThe following example shows that a self-signed certificate has been created using a user-defined trustpoint:
Router Self-Signed CertificateStatus: AvailableCertificate Serial Number: 01Certificate Usage: General PurposeIssuer:serialNumber=C63EBBE9+ipaddress=10.3.0.18+hostname=test.company.comSubject:Name: router.company.comIP Address: 10.3.0.18Serial Number: C63EBBE9serialNumber=C63EBBE9+ipaddress=10.3.0.18+hostname=test.company.comValidity Date:start date: 20:51:40 GMT Nov 29 2004end date: 00:00:00 GMT Jan 1 2020Associated Trustpoints: localThe following example shows that a shadow CA certificate, or rollover certificate, is available and shows its status:
Router# show crypto ca certificatesRollover CertificateStatus: Waiting for rolloverCertificate Serial Number: 3CCertificate Usage: General PurposeIssuer:cn=ezsddSubject:Name: Router.company.comSerial Number: 3A9BEC55serialNumber=3A9BEC55+hostname=Router.company.comValidity Date:start date: 21:22:08 UTC Mar 17 2004end date: 21:22:08 UTC Mar 17 2005renew date: 00:00:00 UTC Jan 1 1970Associated Trustpoints: ttiRelated Commands
show crypto pki certificates storage
To display the current public key infrastructure (PKI) certificate storage location, use the show crypto pki certificates storage command in privileged EXEC mode.
show crypto pki certificates storage
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the show crypto pki certificates storage command to display the current PKI certificate storage location.
Examples
The following is sample output for the show crypto pki certificates storage command where the certificates are stored in the certs subdirectory of disk0:
Router# show crypto pki certificates storageCertificates will be stored in disk0:/certs/Related Commands
crypto pki certificate storage
Specifies local storage device for PKI certificates.
show crypto pki counters
To display the public key infrastructure (PKI) counters that are configured on the router, use the show crypto pki counters command in privileged EXEC mode.
show crypto pki counters
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Examples
Router# show crypto pki countersPKI Sessions Started: 5PKI Sessions Ended: 5PKI Sessions Active: 0Successful Validations: 1Failed Validations: 4Bypassed Validations: 0Pending Validations: 0CRLs checked: 3CRL - fetch attempts: 2CRL - failed attempts: 0AAA authorizations: 0Table 120 describes the significant fields shown in the display.
Related Commands
show crypto pki crls
To display the current certificate revocation list (CRL) on the router, use the show crypto pki crls command in privileged EXEC mode.
show crypto pki crls
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Examples
The following is sample output of the show crypto pki crls command:
Router# show crypto pki crlsCRL Issuer Name:OU = vpn, O = company, C = usLastUpdate: 16:17:34 PST Jan 10 2002NextUpdate: 17:17:34 PST Jan 11 2002Retrieved from CRL Distribution Point:LDAP: CN = CRL1, OU = vpn, O = company, C = us
The following is sample output of the show crypto pki crls command with the maximum CRL cache size set to 2048 bytes:
Router# show crypto pki crlsCRL Issuer Name:cn=ioscs,l=Anytown,c=USLastUpdate: 02:53:41 GMT Mar 6 2007NextUpdate: 02:53:41 GMT Mar 13 2007Retrieved from CRL Distribution Point:** CDP Not Published - Retrieved via SCEPCRL DER is 475 bytesCRL is stored in parsed CRL cacheParsed CRL cache current size is 1705 bytesParsed CRL cache maximum size is 2048 bytesRelated Commands
crypto pki crl cache
Sets the maximum amount of volatile memory used to cache CRLs.
crypto pki crl request
Requests that a new CRL be obtained immediately from the CA.
show crypto pki server
To display the current state and configuration of the certificate server, use the show crypto pki server command in privileged EXEC mode.
show crypto pki server [cs-label]
Syntax Description
cs-label
(Optional) Name of the certificate server. The name must match the name specified through the crypto pki server command.
Command Modes
User EXEC (>)
Privileged EXEC (#)Command History
Usage Guidelines
At startup, the certificate server must check the current configuration before issuing any certificates. As it starts up, the certificate server transitions through the states defined in Table 121. Use the show crypto pki server command to display the state of the certificate server.
Examples
The following is sample output from the show crypto pki server command:
Router# show crypto pki serverCertificate Server status: disabled, storage configuration incompleteGranting mode is: manualLast certificate issued serial number: 0CA certificate expiration timer: 21:29:38 GMT Jun 5 2006CRL NextUpdate timer: 21:31:39 GMT Jun 6 2003Current storage dir: ftp://myftpserverDatabase Level: Minimum - no cert data written to storageTable 122 describes the significant fields shown in the display.
The following is sample output from the show crypto pki server command when redundancy is configured and its state is simplex:
Router# show crypto pki server cert1Certificate Server cert1:Status: disabledState: disabledServer's configuration is unlocked (enter "no shut" to lock it)Issuer name: CN=cert1CA cert fingerprint: -Not found-Granting mode is: manualLast certificate issued serial number (hex): 0CA certificate expiration timer: 00:00:00 UTC Jan 1 1970CRL not present.Current primary storage dir: nvram:Database Level: Minimum - no cert data written to storageRedundancy configured. Simplex mode.The following is sample output from the show crypto pki server command when redundancy is configured and its state is active:Certificate Server HA:Status: enabledState: enabledServer's configuration is locked (enter "shut" to unlock it)Issuer name: CN=ioscs,L=Santa Cruz,C=USCA cert fingerprint: 42308002 188180FC 9265946F FDC68A52Granting mode is: autoLast certificate issued serial number (hex): 2CA certificate expiration timer: 20:22:55 PST Apr 26 2013CRL NextUpdate timer: 20:27:46 PST May 11 2010Current primary storage dir: nvram:Database Level: Complete - all issued certs written as <serialnum>.cerRedundancy configured. This is active.The following is sample output from the show crypto pki server command when redundancy is configured and its state is standby:Certificate Server HA:Status: enabledState: enabledServer's configuration is locked (enter "shut" to unlock it)Issuer name: CN=ioscs,L=Santa Cruz,C=USCA cert fingerprint: 42308002 188180FC 9265946F FDC68A52Granting mode is: autoLast certificate issued serial number (hex): 2CA certificate expiration timer: 20:22:55 PST Apr 26 2013CRL NextUpdate timer: 20:27:46 PST May 11 2010Current primary storage dir: nvram:Database Level: Complete - all issued certs written as <serialnum>.cerRedundancy configured. This is standby.The following example shows that the certificate server MyCS has rollover configured. Rollover has not yet occurred. The rollover status "pending" and rollover CA certificate timer show when the rollover timer will be triggered. When this timer is triggered, the shadow certificate will become the active certificate and the previously active certificate will be deleted.
Router# show crypto pki serverCertificate Server routercs:Status: enabled, configuredIssuer name: CN=walnutcsCA cert fingerprint: 800F5944 74337E5B C2DF6C52 9A7B1BDBGranting mode is: autoLast certificate issued serial number: 0x6CA certificate expiration timer: 22:10:29 GMT Jan 29 2007CRL NextUpdate timer: 21:50:56 GMT Mar 5 2004Current storage dir: nvram:Database Level: Minimum - no cert data written to storageRollover status: pendingRollover CA certificate timer: 20:34:23 GMT Jan 8 2005The following example shows that the certificate server MyCS has rollover configured. The rollover time has occurred and the rollover certificate is available. The status shows the rollover certificate fingerprint and rollover CA certificate expiration timer information.
Router# show crypto pki serverCertificate Server routercs:Status: enabled, configuredIssuer name: CN=walnutcsCA cert fingerprint: 800F5944 74337E5B C2DF6C52 9A7B1BDBGranting mode is: autoLast certificate issued serial number: 0x7CA certificate expiration timer: 22:10:29 GMT Jan 29 2007CRL NextUpdate timer: 21:50:56 GMT Mar 5 2004Current storage dir: nvram:Database Level: Minimum - no cert data written to storageRollover status: available for rolloverRollover CA cert fingerprint: 6AAF5944 74227A5B 23DF3E52 9A7F1FEFRollover CA certificate expiration timer: 22:10:29 GMT Jan 29 2017The following example shows a certificate server (CS) that has been prevented from entering rollover state because the Cisco IOS configuration cannot be saved.
Router# show crypto pki serverCertificate Server routercs:Status: enabled, configuredIssuer name: CN=walnutcsCA cert fingerprint: 800F5944 74337E5B C2DF6C52 9A7B1BDBGranting mode is: autoLast certificate issued serial number: 0x7CA certificate expiration timer: 22:10:29 GMT Jan 29 2007CRL NextUpdate timer: 21:50:56 GMT Mar 5 2004Current storage dir: nvram:Database Level: Minimum - no cert data written to storageRollover status: disabled, unable to save configurationRollover CA cert fingerprint: 6AAF5944 74227A5B 23DF3E52 9A7F1FEFRollover CA certificate expiration timer: 22:10:29 GMT Jan 29 2017Related Commands
crypto pki server
Enables a Cisco IOS certificate server and enter certificate server configuration mode.
show crypto pki server certificates
To display certificate information for all certificates of the specified certificate server, use the show crypto pki server certificates command in privileged EXEC mode.
show crypto pki server cs-label certificates [start-number [end-number]] [expired]
Syntax Description
Command Default
Certificate information is shown for all serial numbers for the specified certificate server, from the first serial number in the certificate database to the last serial number in the certificate database.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
This command displays available information on each certificate for the specified certificate server. If the certificate information is not available, the output displayed reads as "<cert not available>". If the certificate information is incomplete, or if it has been corrupted, the output displayed reads as "<certificate incomplete or corrupted>".
You may display information on all the certificates in the certificate database, one certificate in the certificate database, or a range of certificates in the certificate database by setting the start-number and end-number arguments.
Examples
The following example shows the listing of all certificates in the certificate database for the certificate server "mycs":
Router# show crypto pki server mycs certificatesSerial Issued date Expire date Subject Name1 02:09:09 PST Jan 22 2007 02:09:09 PST Jan 21 2010 cn=company2 02:57:59 PST Jan 22 2007 02:57:59 PST Jan 22 2008 hostname=client.example.com3 03:00:12 PST Jan 22 2007 03:00:12 PST Jan 22 2008 hostname=client.example.com4 19:53:07 PST Jan 18 2007 19:53:07 PST Jan 19 2007 hostname=client.example.com5 <cert not available>6 <cert not available>7 <cert not available>8 02:57:59 PST Jan 22 2007 02:57:59 PST Jan 22 2008 hostname=client.example.com9 <Certificate incomplete or corrupted>A <cert not available>B <cert not available>The following example shows the information for certificate serial number 3 in the certificate database for the certificate server "mycs":
Router# show crypto pki server mycs certificates start 3Serial Issued date Expire date Subject Name3 03:00:12 PST Jan 22 2007 03:00:12 PST Jan 22 2008 hostname=client.example.comThe following example shows the information for certificate serial number 3 through certificate serial number 7 in the certificate database for the certificate server "mycs":
Router# show crypto pki server mycs certificates start 3 end 7show crypto pki server mycs certificatesSerial Issued date Expire date Subject Name3 03:00:12 PST Jan 22 2007 03:00:12 PST Jan 22 2008 hostname=client.example.com4 19:53:07 PST Jan 18 2007 19:53:07 PST Jan 19 2007 hostname=client.example.com5 <cert not available>6 <cert not available>7 <cert not available>Related Commands
show crypto pki server crl
To display information regarding the status of the current certificate revocation list (CRL), use the
show crypto pki server crl command in privileged EXEC mode.show crypto pki server cs-label crl
Syntax Description
cs-label
Name of the certificate server. The name must match the name specified via the crypto pki server command.
Command Defaults
None.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
CRLs are issued once every specified time period via the lifetime crl command. It is the responsibility of the network administrator to ensure that the CRL is available from the location that is specified via the cdp-url command. To access information, such as the lifetime and location of the CRL, use the show crypto pki server crl command.
Examples
The following example shows how to access CRL information for the certificate server "mycs":
Router# show crypto pki server mycs crlRelated Commands
show crypto pki server requests
To display all outstanding certificate enrollment requests, use the show crypto pki server requests command in privileged EXEC mode.
show crypto pki server cs-label requests
Syntax Description
cs-label
Name of the certificate server. The name must match the name specified via the crypto pki server command.
Command Default
None
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
A certificate enrollment request functions as follows:
•
–
–
•
–
–
If the connection of the client has closed, the certificate server will wait for the client user to request another certificate.
All enrollment requests transitions through the certificate enrollment states that are defined in Table 123.
Examples
The following example shows output for the certificate server "certsrv1," which has a pending certificate enrollment request:
Router# show crypto pki server certsrv1 requestsEnrollment Request Database:ReqID State Fingerprint SubjectName--------------------------------------------------------------1 pending 0A71820219260E526D250ECC59857C2D serialNumber=2326115A+hostname=831.The following example shows the output for shadow public key infrastructure (PKI) certificate info requests:
Router# show crypto pki server mycs requestsEnrollment Request Database:RA certificate requests:ReqID State Fingerprint SubjectName--------------------------------------------------------------RA rollover certificate requests:ReqID State Fingerprint SubjectName--------------------------------------------------------------Router certificates requests:ReqID State Fingerprint SubjectName--------------------------------------------------------------1 pending A426AF07FE3A4BB69062E0E47198E5BF hostname=clientRouter rollover certificates requests:ReqID State Fingerprint SubjectName--------------------------------------------------------------2 pending B69062E0E47198E5BFA426AF07FE3A4B hostname=clientRelated Commands
crypto pki server
Enables a Cisco IOS certificate server and enters PKI configuration mode.
show crypto pki timers
To display the status of the managed timers that are maintained by Cisco IOS for public key infrastructure (PKI), use the show crypto pki timers command in privileged EXEC mode.
show crypto pki timers
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
For each timer, this command displays the time remaining before the timer expires. It also associates trustpoint certification authorities (CAs), except for certificate revocation list (CRL) timers, by displaying the CRL distribution point.
Examples
The following example is sample output for the show crypto pki timers command:
Router# show crypto pki timersPKI Timers| 4d15:13:33.144| 4d15:13:33.144 CRL http://msca-root.cisco.com/CertEnroll/msca-root.crl|328d11:56:48.372 RENEW msroot| 6:43.201 POLL verisignRelated Commands
auto-enroll
Enables autoenrollment.
crypto pki trustpoint
Declares the CA that your router should use.
show crypto pki token
To display the Cisco IOS public key infrastructure (PKI) tokens that are configured on the router, use the show crypto pki token command in privileged EXEC mode.
show crypto pki token [name]
Syntax Description
Command Default
If the name argument is not specified, command output is displayed for all PKI tokens.
Command Modes
Privileged EXEC (#)
Command History
Examples
The following is sample output from the show crypto pki token command:
Router# show crypto pki tokenConfiguration for token usbtoken0:Automatic login enabled.Removal timeout 60 secondsConfiguration for token default:Secondary Config file "BIFT.CFG"Table 124 describes the significant fields shown in the display.
Related Commands
show crypto pki trustpoints
To display the trustpoints that are configured in the router, use the show crypto pki trustpoints command in privileged EXEC or user EXEC mode.
show crypto pki trustpoints [status | label [status]]
Syntax Description
Command Default
If the label argument (trustpoint name) is not specified, command output is displayed for all trustpoints.
Command Modes
Privileged EXEC (#)
User EXEC (>)Command History
Examples
The following is sample output from the show crypto pki trustpoints command:
Router# show crypto pki trustpointsTrustpoint bo:Subject Name:CN = host Certificate ManagerO = company.comC = USSerial Number:01Certificate configured.CEP URL:http://hostCRL query url:ldap://hostThe following is sample output from the show crypto pki trustpoints command when a persistent self-signed certificate has been configured:
Router# show crypto pki trustpointsTrustpoint local:Subject Name:serialNumber=C63EBBE9+ipaddress=10.3.0.18+hostname=test.company.comSerial Number: 01Persistent self-signed certificate trust pointThe following output shows that a shadow PKI certificate is available and shows the SCEP capabilities:
Router# show crypto pki trustpointsTrustpoint vpn:Subject Name:cn=Company SSL CAo=CompanySerial Number: 0FFEBBDC1B6F6D9D0EA7875875E4C695Certificate configured.Rollover certificate configured.Enrollment Protocol:SCEPv1, PKI RolloverThe following output using the status keyword shows that the trustpoint is configured in query mode and is currently trying to query the certificates (the certificate authority (CA) certificate and the router certificate are both pending):
Router# show crypto pki trustpoints statusTrustpoint yni:Issuing CA certificate pending:Subject Name:cn=r1 Cert Manager,ou=pki,o=company.com,c=countryFingerprint: C21514AC 12815946 09F635ED FBB6CF31Router certificate pending:Subject Name:hostname=host.company.com,o=company.comNext query attempt:52 secondsThe following output using the status keyword shows that the trustpoint has been authenticated:
Router# show crypto pki trustpoints statusTrustpoint yni:Issuing CA certificate configured:Subject Name:cn=r1 Cert Manager,ou=pki,o=company.com,c=countryFingerprint: C21514AC 12815946 09F635ED FBB6CF31State:Keys generated ............. NoIssuing CA authenticated ....... YesCertificate request(s) ..... NoneThe following output using the status keyword shows that the trustpoint is enrolling and that two of the certificate requests are pending (Signature and Encryption):
Router# show crypto pki trustpoints statusTrustpoint yni:Issuing CA certificate configured:Subject Name:cn=r1 Cert Manager,ou=pki,o=company.com,c=countryFingerprint: C21514AC 12815946 09F635ED FBB6CF31Router Signature certificate pending:Requested Subject Name:hostname=host.company.comRequest Fingerprint: FAE0D74E BB844EA1 54B26698 56AB42ECEnrollment polling: 1 times (9 left)Next poll: 32 secondsRouter Encryption certificate pending:Requested Subject Name:hostname=host.company.comRequest Fingerprint: F4E815DB D9D9B60F 9B5B1724 3E155DBFEnrollment polling: 1 times (9 left)Next poll: 44 secondsLast enrollment status: PendingState:Keys generated ............. Yes (Signature, Encryption)Issuing CA authenticated ....... YesCertificate request(s) ..... PendingThe following output using the status keyword shows that enrollment has succeeded and that two router certificates have been granted (Signature and Encryption):
Router# show crypto pki trustpoints statusTrustpoint yni:Issuing CA certificate configured:Subject Name:cn=r1 Cert Manager,ou=pki,o=company.com,c=countryFingerprint: C21514AC 12815946 09F635ED FBB6CF31Router Signature certificate configured:Subject Name:hostname=host.company.com,o=company.comFingerprint: 8A370B8B 3B6A2464 F962178E 8385E9D6Router Encryption certificate configured:Subject Name:hostname=host.company.com,o=company.comFingerprint: 43A03218 C0AFF844 AE0C162A 690B414ALast enrollment status: GrantedState:Keys generated ............. Yes (Signature, Encryption)Issuing CA authenticated ....... YesCertificate request(s) ..... YesThe following output using the status keyword shows that trustpoint enrollment has been rejected:
Router# show crypto pki trustpoints statusTrustpoint yni:Issuing CA certificate configured:Subject Name:cn=r1 Cert Manager,ou=pki,o=company.com,c=countryFingerprint: C21514AC 12815946 09F635ED FBB6CF31Last enrollment status: RejectedState:Keys generated ............. Yes (General Purpose)Issuing CA authenticated ....... YesCertificate request(s) ..... NoneThe following output using the status keyword shows that enrollment has succeeded and that the router is configured for autoenrollment using a regenerated key. In addition, the running configuration has been modified so that it will not be saved automatically after autoenrollment.
Router# show crypto pki trustpoints statusTrustpoint yni:Issuing CA certificate configured:Subject Name:cn=r1 Cert Manager,ou=pki,o=company.com,c=countryFingerprint: C21514AC 12815946 09F635ED FBB6CF31Router General Purpose certificate configured:Subject Name:hostname=host.company.com,o=company.comFingerprint: FC365F95 E24D4B55 81347510 10FFE331Last enrollment status: GrantedNext enrollment attempt:01:58:25 PST Feb 14 2004* A new key will be generated ** Configuration will not be saved after enrollment *State:Keys generated ............. Yes (General Purpose)Issuing CA authenticated ....... YesCertificate request(s) ..... YesTable 125 describes the significant fields shown in the display.
Related Commands
show crypto route
To display routes that are created through IPsec via Reverse Route Injection (RRI) or Easy VPN virtual tunnel interfaces (VTIs) in one table, use the show crypto route command in privileged EXEC mode.
show crypto route
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC
Command History
Examples
The following example displays routes that were created through IPSec using RRI and VTIs:
Router# show crypto routeVPN Routing Table: Shows RRI and VTI created routesCodes: RRI - Reverse-Route, VTI- Virtual Tunnel InterfaceS - Static Map ACLsRoutes created in table GLOBAL DEFAULT192.168.6.2/255.255.255.255 [0/0] via 10.0.0.133on Virtual-Access3 RRI10.1.1.0/255.255.255.0 [10/0] via Virtual-Access2 VTI192.168.6.1/255.255.255.255 [0/0] via Virtual-Access2 VTIThe fields in the above display are self-explanatory.
Related Commands
reverse-route
Creates source proxy information for a crypto map entry.
set reverse-route
Defines a distance metric for each static route or tags a RRI-created route.
show crypto ruleset
To display information about crypto rules on outgoing packets, use the show crypto ruleset command in privileged EXEC mode.
show crypto ruleset [detail]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Examples
The following example displays information about the crypto rules on outgoing packets:
Router# show crypto rulesetEthernet0/0:59 ANY ANY DENY11 ANY/848 ANY/848 DENYIP ANY ANY IPSec SA PassiveIP ANY ANY IPSec CryptomapThe following output example shows the directional mode of the IPsec SA:
Router# show crypto ruleset detailEthernet0/0:20000001000019 59 ANY ANY DENY -> 2000000199999920000001000029 11 ANY/848 ANY/848 DENY -> 2000000199999920000001000035 IP ANY ANY IPSec SA Passive20000001000039 IP ANY ANY IPSec CryptomapTable 126 describes the significant fields shown in the display.
show crypto session
To display status information for active crypto sessions, use the show crypto session command in privileged EXEC mode.
show crypto session [groups | interface type [brief | detail] | isakmp [group group-name | profile profile-name] [brief | detail] | [local | remote] [ip-address | ipv6-address] [port portnumber] | [fvrf fvrf-name] [ivrf ivrf-name] [brief | detail] | summary group-name | username username]
IPsec and IKE Stateful Failover Syntax
show crypto session [active | standby]
Syntax Description
Command Default
All existing sessions will be displayed.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
This command lists all the active Virtual Private Network (VPN) sessions and the IKE and IPsec SAs for each VPN session. The listing will include the following information:
•
•
•
•
Multiple IKE or IPsec SAs may be established for the same peer (for the same session), in which case IKE peer descriptions will be repeated with different values for the IKE SAs that are associated with the peer and for the IPsec SAs that are serving the flows of the session.
IPv6 does not support the fvfr and ivrf keywords and the vrf-name argument.
Examples
The following example shows the status information for all active crypto sessions:
Router# show crypto sessionCrypto session current statusInterface: Virtual-Access2Username: ciscoProfile: profGroup: easyAssigned address: 10.3.3.4Session status: UP-ACTIVEPeer: 10.1.1.2 port 500IKE SA: local 10.1.1.1/500 remote 10.1.1.2/500 ActiveIKE SA: local 10.1.1.1/500 remote 10.1.1.2/500 InactiveIPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 host 3.3.3.4Active SAs: 2, origin: crypto mapThe following is sample output from the show crypto session brief command:
Router# show crypto session briefStatus: A- Active, U - Up, D - Down, I - Idle, S - Standby, N - NegotiatingK - No IKEivrf = (none)Peer I/F Username Group/Phase1_id Uptime Status10.1.1.2 Vi2 cisco easy 00:50:30 UAThe following is sample output from the show crypto session detail command:
Router# show crypto session detailCrypto session current statusCode: C - IKE Configuration mode, D - Dead Peer DetectionK - Keepalives, N - NAT-traversal, X - IKE Extended AuthenticationInterface: Virtual-Access2Username: ciscoProfile: profGroup: easyAssigned address: 10.3.3.4Uptime: 00:49:33Session status: UP-ACTIVEPeer: 10.1.1.2 port 500 fvrf: (none) ivrf: (none)Phase1_id: easyDesc: (none)IKE SA: local 10.1.1.1/500 remote 10.1.1.2/500 ActiveCapabilities:CX connid:1002 lifetime:23:10:15IPSEC FLOW: permit ip 10.0.0.0/0.0.0.0 host 10.3.3.4Active SAs: 2, origin: crypto mapInbound: #pkts dec'ed 0 drop 0 life (KB/Sec) 4425776/626Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 4425776/626Table 127 describes the significant fields shown in the display.
Table 127 show crypto session Field Descriptions
Interface
Interface to which the crypto session is related.
Session status
Current status of the crypto (VPN) sessions. See Table 128 for explanations of the status of the IKE SA, IPsec SA, and tunnel as shown in the display.
IKE SA
Information about the IKE SA, such as local and remote address and port, SA status, SA capabilities, crypto engine connection ID, and remaining lifetime of the IKE SA.
IPSEC FLOW
A snapshot of information about the IPsec-protected traffic flow, such as the status of the flow (for example, permit IP host 10.1.1.5 host 10.1.2.5), the number of IPsec SAs, the origin of the SA, such as manually entered, dynamic, or static crypto maps, number of encrypted or decrypted packets or dropped packets, and the IPsec SA remaining lifetime in kilobytes per second.
Table 128 provides an explanation of the current status of the VPN sessions shown in the display.
Note
The following sample output shows all crypto sessions that are in the standby state:
Router# show crypto session standbyCrypto session current statusInterface: Ethernet0/0Session status: UP-STANDBYPeer: 10.165.200.225 port 500IKE SA: local 10.165.201.3/500 remote 10.165.200.225/500 ActiveIKE SA: local 10.165.201.3/500 remote 10.165.200.225/500 ActiveIPSEC FLOW: permit ip host 192.168.0.1 host 172.16.0.1Active SAs: 4, origin: crypto mapRelated Commands
clear crypto session
Deletes crypto sessions (IPsec and IKE SAs).
description
Adds a description for an IKE peer.
show crypto isakmp peer
Displays peer descriptions.
show crypto session group
To display groups that are currently active on the Virtual Private Network (VPN) device, use the show crypto session group command in privileged EXEC mode.
show crypto session group
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
If the crypto isakmp client configuration group command and max-users keyword have not been enabled in any VPN group profile, this command will yield a blank result.
Examples
The following example shows that at least one session is active for the group Connections:
Router# show crypto session groupGroup: Connectionscisco: 1Related Commands
show crypto session summary
To display groups that are currently active on the Virtual Private Network (VPN) device and the users that are connected for each of those groups, use the show crypto session summary command in privileged EXEC mode.
show crypto session summary
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
If the crypto isakmp client configuration group command and max-users keyword are not enabled in any VPN group profile and the crypto isakmp client configuration group command and max-logins keyword are not enabled, this command will yield a blank result.
Examples
The following example shows that the group "cisco" is active and that it has one user connected, green, who is connected one time. The number in parentheses (1) is the number of simultaneous logins for that user.
Router# show crypto session summaryGroup cisco has 1 connectionsUser (Logins)green (1)Related Commands
show crypto socket
To list crypto sockets, use the show crypto socket command in privileged EXEC mode.
show crypto socket
Syntax Description
This command has no arguments or keywords.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use this command to list crypto sockets and the state of the sockets.
Examples
The following sample output shows the number of crypto socket connections (2) and their state:
Router# show crypto socketNumber of Crypto Socket connections 2Tu0 Peers (local/remote): 192.168.2.2/192.168.1.1Local Ident (addr/mask/port/prot): (192.168.2.2/255.255.255.255/0/47)Remote Ident (addr/mask/port/prot): (192.168.1.1/255.255.255.255/0/47)Flags: sharedSocket State: OpenClient: "TUNNEL SEC" (Client State: Active)Tu1 Peers (local/remote): 192.168.2.2/192.168.1.3Local Ident (addr/mask/port/prot): (192.168.2.2/255.255.255.255/0/47)Remote Ident (addr/mask/port/prot): (192.168.1.3/255.255.255.255/0/47)Flags: sharedSocket State: OpenClient: "TUNNEL SEC" (Client State: Active)Crypto Sockets in Listen state:Client: "TUNNEL SEC" Profile: "dmvpn-profile" Map-name: "dmvpn-profile-head-2"Table 129 describes the significant fields in the display.
show crypto tech-support
To display the crypto technical support information, use the show crypto tech-support command in privileged EXEC mode.
show crypto tech-support [peer ip-address | vrf vrf-name]
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Use the optional keywords and arguments to display the specific crypto technical support information.
Examples
The following is sample output from the show crypto tech-support command. The fields are self-explanatory.
Router# show crypto tech-support------------------ show crypto session remote 1.0.1.2 detail ------------------------------------ show crypto ipsec sa peer 1.0.1.2 detail ------------------------------------ show crypto isakmp sa peer 1.0.1.2 detail ------------------IPv4 Crypto ISAKMP SAdst src state conn-id status------------------ show crypto isakmp peers 1.0.1.2 ------------------------------------ show crypto ruleset detail ------------------------------------ show processes memory | include Crypto IKMP ----------------240 0 7112 252 20064 0 0 Crypto IKMP------------------ show processes cpu | include Crypto IKMP ------------------240 0 3 0 0.00% 0.00% 0.00% 0 Crypto IKMP------------------ show crypto eli ------------------Hardware Encryption : ACTIVENumber of hardware crypto engines = 1CryptoEngine Onboard VPN details: state = ActiveCapability : IPPCP, DES, 3DES, AES, IPv6, FAILCLOSEIPSec-Session : 0 active, 1400 max, 0 failed------------------ show cry engine accelerator statistic ------------------Device: Onboard VPNLocation: Onboard: 0:Statistics for encryption device since the last clearof counters 1818819 seconds ago0 packets in 0 packets out0 bytes in 0 bytes out0 paks/sec in 0 paks/sec out0 Kbits/sec in 0 Kbits/sec out0 packets decrypted 0 packets encrypte0 bytes before decrypt 0 bytes encrypted0 bytes decrypted 0 bytes after encr0 packets decompressed 0 packets compress0 bytes before decomp 0 bytes before com0 bytes after decomp 0 bytes after comp0 packets bypass decompr 0 packets bypass cs0 bytes bypass decompres 0 bytes bypass comi0 packets not decompress 0 packets not compd0 bytes not decompressed 0 bytes not compre1.0:1 compression ratio 1.0:1 overallLast 5 minutes:0 packets in 0 packets outshow crypto vlan
To display the VPN running state for an IPSec VPN SPA, use the show crypto vlan command in privileged EXEC mode.
show crypto vlan
Defaults
No default behavior or values.
Command Modes
Privileged EXEC (#)
Command History
12.2(18)SXE2
This command was introduced.
12.2(33)SRA
This command was integrated into Cisco IOS Release 12.2(33)SRA.
Usage Guidelines
When you show the configuration, the crypto engine subslot configuration state is expressed in the context of the associated interface VLAN. The interface VLAN is also shown as having been added to the appropriate inside trunk port. This is the case even if the configuration was loaded from a legacy (pre-crypto engine subslot) configuration file, or if VLANs were manually added instead of being added through the crypto engine subslot command.
Examples
In the following example, the interface VLAN belongs to the IPSec VPN SPA inside port:
Router# show crypto vlanInterface VLAN 2 on IPSec Service Module port 7/1/1 connected to Fa8/3In the following example, VLAN 2 is the interface VLAN and VLAN 2022 is the hidden VLAN:
Router# show crypto vlanInterface VLAN 2 on IPSec Service Module port 3/1/1 connected to VLAN 2022 with crypto map set coral2In the following example, either the interface VLAN is missing on the IPSec VPN SPA inside port, the IPSec VPN SPA is removed from the chassis, or the IPSec VPN SPA was moved to a different subslot:
Router# show crypto vlanInterface VLAN 2 connected to VLAN 3 (no IPSec Service Module attached)Related Commands
s
