Cisco IOS Security Configuration Guide, Release 12.4
IP Security VPN Monitoring
Download this chapter
IP Security VPN MonitoringIP Security VPN Monitoring
Download the complete book
Cisco IOS Security Configuration Guide, Release 12.4Cisco IOS Security Configuration Guide, Release 12.4 (PDF - 14 MB)
give_us_feedback

Table Of Contents

IP Security VPN Monitoring

Contents

Prerequisites for IP Security VPN Monitoring

Restrictions for IP Security VPN Monitoring

Information About IPSec VPN Monitoring

Background: Crypto Sessions

Per-IKE Peer Description

Summary Listing of Crypto Session Status

Syslog Notification for Crypto Session Up or Down Status

IKE and IPSec Security Exchange Clear Command

How to Configure IP Security VPN Monitoring

Adding the Description of an IKE Peer

Verifying Peer Descriptions

Examples

Clearing a Crypto Session

Configuration Examples for IP Security VPN Monitoring

show crypto session Command Output: Examples

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Command Reference


IP Security VPN Monitoring

The IP Security VPN Monitoring feature provides VPN session monitoring enhancements that will allow you to troubleshoot the Virtual Private Network (VPN) and monitor the end-user interface. Session monitoring enhancements include the following:

•Ability to specify an Internet Key Exchange (IKE) peer description in the configuration file

•Summary listing of crypto session status

•Syslog notification for crypto session up or down status

•Ability to clear both IKE and IP Security (IPSec) security associations (SAs) using one command-line interface (CLI)

Release
Modification

12.3(4)T

This feature was introduced.

Cisco IOS XE Release 2.1

This feature was introduced on Cisco ASR 1000 Series Routers.


Feature History for IP Security VPN Monitoring

Finding Support Information for Platforms and Cisco IOS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.

Contents

•Prerequisites for IP Security VPN Monitoring

•Restrictions for IP Security VPN Monitoring

•Information About IPSec VPN Monitoring

•How to Configure IP Security VPN Monitoring

•Configuration Examples for IP Security VPN Monitoring

•Additional References

•Command Reference

Prerequisites for IP Security VPN Monitoring

•You should be familiar with IPSec and encryption.

•Your router must support IPSec, and before using the IP Security VPN Monitoring feature, you must have configured IPSec on your router.

Restrictions for IP Security VPN Monitoring

•You must be running Cisco IOS k8 or k9 crypto images on your router.

Information About IPSec VPN Monitoring

To troubleshoot the IPSec VPN and monitor the end-user interface, you should understand the following concepts:

•Background: Crypto Sessions

•Per-IKE Peer Description

•Summary Listing of Crypto Session Status

•Syslog Notification for Crypto Session Up or Down Status

•IKE and IPSec Security Exchange Clear Command

Background: Crypto Sessions

A crypto session is a set of IPSec connections (flows) between two crypto endpoints. If the two crypto endpoints use IKE as the keying protocol, they are IKE peers to each other. Typically, a crypto session consists of one IKE security association (for control traffic) and at least two IPSec security associations (for data traffic—one per each direction). There may be duplicated IKE security associations (SAs) and IPSec SAs or duplicated IKE SAs or IPSec SAs for the same session in the duration of rekeying or because of simultaneous setup requests from both sides.

Per-IKE Peer Description

The Per-IKE Peer Description function allows you to enter a description of your choosing for an IKE peer. (Before Cisco IOS Release 12.3(4)T, you could use only the IP address or fully qualified domain name [FQDN] to identify the peer; there was no way to configure a description string.) The unique peer description, which can include up to 80 characters, can be used whenever you are referencing that particular IKE peer. To add the peer description, use the description command.

Note IKE peers that "sit" behind a Network Address Translation (NAT) device cannot be uniquely identified; therefore, they have to share the same peer description.

The primary application of this description field is for monitoring purposes (for example, when using show commands or for logging [syslog messages]). The description field is purely informational (for example, it cannot act as a substitute for the peer address or FQDN when defining crypto maps).

Summary Listing of Crypto Session Status

You can get a list of all the active VPN sessions by entering the show crypto session command. The listing will include the following:

•Interface

•IKE peer description, if available

•IKE SAs that are associated with the peer by whom the IPSec SAs are created

•IPSec SAs serving the flows of a session

Multiple IKE or IPSec SAs may be established for the same peer (for the same session), in which case IKE peer descriptions will be repeated with different values for the IKE SAs that are associated with the peer and for the IPSec SAs that are serving the flows of the session.

You can also use the show crypto session detail variant of this command to obtain more detailed information about the sessions.

Syslog Notification for Crypto Session Up or Down Status

The Syslog Notification for Crypto Session Up or Down Status function provides syslog notification every time the crypto session comes up or goes down.

The following is a sample syslog notification showing that a crypto session is up: 

%CRYPTO-5-SESSION_STATUS: Crypto session is UP. Peer 10.6.6.1:500 fvrf=name10 ivrf=name20  
Description: SJC24-2-VPN-Gateway Id: 10.5.5.2

The following is a sample syslog notification showing that a crypto session is down: 

%CRYPTO-5-SESSION_STATUS: Crypto session is DOWN. Peer 10.6.6.1:500 fvrf=name10 
ivrf=name20 Description: SJC24-2-VPN-Gateway Id: 10.5.5.2

IKE and IPSec Security Exchange Clear Command

In previous IOS versions, there was no single command to clear both IKE and IPSec connections (that is, SAs). Instead, you had to use the clear crypto isakmp command to clear IKE and the clear crypto ipsec command to clear IPSec. The new clear crypto session command allows you to clear both IKE and IPSec with a single command. To clear a specific crypto session or a subset of all the sessions (for example, a single tunnel to one remote site), you need to provide session-specific parameters, such as a local or remote IP address, a local or remote port, a front door VPN routing and forwarding (FVRF) name, or an inside VRF (IVRF) name. Typically, the remote IP address will be used to specify a single tunnel to be deleted.

If a local IP address is provided as a parameter when you use the clear crypto session command, all the sessions (and their IKE SAs and IPSec SAs) that share the IP address as a local crypto endpoint (IKE local address) will be cleared. If you do not provide a parameter when you use the clear crypto session command, all IPSec SAs and IKE SAs that are in the router will be deleted.

How to Configure IP Security VPN Monitoring

See the following sections for configuration tasks for this feature. Each task in the list is identified as either required or optional.

•Adding the Description of an IKE Peer (optional)

•Verifying Peer Descriptions (optional)

•Clearing a Crypto Session (optional)

Adding the Description of an IKE Peer

To add the description of an IKE peer to an IPSec VPN session, perform the following steps.

SUMMARY STEPS

1. enable

2. configure terminal

3. crypto isakmp peer {ip-address ip-address}

4. description

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2 

configure terminal

Example:

Router# configure terminal

Enters global configuration mode.

Step 3 

crypto isakmp peer {ip-address ip-address}

Example:

Router (config)# crypto isakmp peer address 10.2.2.9

Enables an IPSec peer for IKE querying of authentication, authorization, and accounting (AAA) for tunnel attributes in aggressive mode and enters ISAKMP peer configuration mode.

Step 4 

description

Example:

Router (config-isakmp-peer)# description connection from site A

Adds a description for an IKE peer.

Verifying Peer Descriptions

To verify peer descriptions, use the show crypto isakmp peer command.

SUMMARY STEPS

1. enable

2. show crypto isakmp peer

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2 

show crypto isakmp peer

Example:

Router# show crypto isakmp peer

Displays peer descriptions.

Examples

The following output example verifies that the description "connection from site A" has been added for IKE peer 10.2.2.9: 

Router# show crypto isakmp peer


Peer: 10.2.2.9 Port: 500

 Description: connection from site A

  flags: PEER_POLICY

When the peer at address 10.2.2.9 connects and the session comes up, the syslog status will be shown as follows: 

%CRYPTO-5-SESSION_STATUS: Crypto tunnel is UP. Peer 10.2.2.9:500 Description: connection 
from site A Id: ezvpn

Clearing a Crypto Session

To clear a crypto session, use the clear crypto session command from the router command line. No configuration statements are required in the configuration file to use this command.

SUMMARY STEPS

1. enable

2. clear crypto session

DETAILED STEPS

 
Command or Action
Purpose

Step 1 

enable

Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2 

clear crypto session

Example:

Router# clear crypto session

Deletes crypto sessions (IPSec and IKE SAs).

Configuration Examples for IP Security VPN Monitoring

This section provides the following configuration example:

•show crypto session Command Output: Examples

show crypto session Command Output: Examples

The following is sample output for the show crypto session output without the detail keyword: 

Router# show crypto session


Crypto session current status


Interface: FastEthernet0/1

Session status: UP-ACTIVE

Peer: 172.0.0.2/500

   IKE SA: local 172.0.0.1/500 remote 172.0.0.2/500 Active

   IPSEC FLOW: permit ip 10.10.10.0/255.255.255.0 10.30.30.0/255.255.255.0

         Active SAs: 2, origin: crypto map

The following is sample output using the show crypto session command and the detail keyword: 

Router# show crypto session detail


Interface: Tunnel0

Session status: UP-ACTIVE

Peer: 10.1.1.3 port 500 fvrf: (none) ivrf: (none)

      Desc: this is my peer at 10.1.1.3:500 Green

      Phase1_id: 10.1.1.3

  IKE SA: local 10.1.1.4/500 remote 10.1.1.3/500 Active

          Capabilities:(none) connid:3 lifetime:22:03:24

  IPSEC FLOW: permit 47 host 10.1.1.4 host 10.1.1.3

        Active SAs: 0, origin: crypto map

        Inbound:  #pkts dec'ed 0 drop 0 life (KB/Sec) 0/0

        Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 0/0

  IPSEC FLOW: permit ip host 10.1.1.4 host 10.1.1.3

        Active SAs: 4, origin: crypto map

        Inbound:  #pkts dec'ed 4 drop 0 life (KB/Sec) 4605665/2949

        Outbound: #pkts enc'ed 4 drop 1 life (KB/Sec) 4605665/2949

Additional References

The following sections provide references related to IP Security VPN Monitoring.

Related Documents

Related Topic
Document Title

IP security, encryption, and IKE

"IP Security and Encryption" section of the Cisco IOS Security Configuration Guide

Security commands

Cisco IOS Security Command Reference, Release 12.3 T


Standards

Standards
Title

No new or modified standards are supported by this feature.

—


MIBs

MIBs
MIBs Link

No new or modified MIBs are supported by this feature.

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs


RFCs

RFCs
Title

No new or modified RFCs are supported by this feature.

—


Technical Assistance

Description
Link

Technical Assistance Center (TAC) home page, containing 30,000 pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content.

http://www.cisco.com/public/support/tac/home.shtml


Command Reference

The following commands are introduced or modified in the feature or features

•clear crypto session

•description (isakmp peer)

•show crypto isakmp peer

•show crypto session

For information about these commands, see the Cisco IOS Security Command Reference at

http://www.cisco.com/en/US/docs/ios/security/command/reference/sec_book.html.

For information about all Cisco IOS commands, see the Command Lookup Tool at

http://tools.cisco.com/Support/CLILookup or the Master Command List.


Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

© 2007 Cisco Systems, Inc. All rights reserved.