Configuration Guide for Cisco NCS 1004, IOS XR Release 25.x.x

Verify the PPK configuration

Updated: July 31, 2026

Want to summarize with AI?

Learn how to verify the configuration and operational status of PPK-based quantum-safe encryption on your NCS 1004 device using CLI commands.

Ensure that PPK (Post-Quantum Key) features are correctly configured and active on your device for quantum-safe encryption.

Follow these steps to verify the PPK configuration.

Procedure

	1.	Use the show ikev2 sa detail command to display information about the current IKEv2 security associations. Example: RP/0/1/CPU0:ios#show ikev2 sa detail IKE SA ID : 866 ------------------------------------------------------------------------------- Local : 192.0.2.34/500 Remote : 192.0.2.40/500 Status(Description) : READY (Negotiation done) Role : Initiator Fvrf : Default Encryption/Keysize : AES-CBC/256 PRF/Hash/DH Group : SHA512/SHA512/19 Authentication(Sign/Verify) : PSK/PSK Life/Active Time(sec) : 86400/21 Session ID : 5 Local SPI : C18D2946B0C4259C Remote SPI : 5D1BD398AEB3A1E1 Local ID : 192.0.2.34 Remote ID : 192.0.2.40 Quantum resistance : Enabled with manual PPK The Quantum resistance parameter in the output of the command indicates that manual PPK-based quantum-safe encryption is enabled. Note Both manual and dynamic PPK options can be used for viewing IKEv2 details.
	2.	Use the show ikev2 statistics command to display the statistics and counters related to IKEv2 sessions Example: `RP/0/1/CPU0:ios#show ikev2 statistics Thu Jun 8 13:30:06.360 IST ................................ NO_NAT : 2 0 0 0 PPK COUNTERS ============================================================================================= PPK ERRORS --------------------------------------------------------------------------------------------- PPK_ID_MISMATCH : 0 PPK_RETRIEVE_FAIL : 0 PPK_AUTH_FAIL : 0`
	3.	Use the show ikev2 summary command to display the IKEv2 session summary of NCS 1004. Example: `RP/0/1/CPU0:ios#show ikev2 summary Thu Jun 8 12:54:30.969 IST IKEv2 SA Summary ------------------------------------------------- Total SA (Active/Negotiating) : 2 (2/0) Total Outgoing SA (Active/Negotiating): 2 (2/0) Total Incoming SA (Active/Negotiating): 0 (0/0) Total QR SA (Dynamic/Manual) : 2 (1/1)`
	4.	Use the show ikev2 profile command to display the details for each IKEv2 profile. Example: RP/0/1/CPU0:ios#show ikev2 profile Tue Jun 6 18:00:20.277 IST Profile Name : p4 =============================================================================== Keyring : k4 Fvrf : Default Lifetime(Sec) : 86400 DPD Interval(Sec) : 4 DPD Retry Interval(Sec) : 2 Match ANY : NO Total Match remote peers : 1 Addr/Prefix : 198.51.100.19/255.255.255.0 Number of Trustpoints : 0 Local auth method : PSK Number of remote auth methods : 1 Auth Method : PSK PPK Keyring : Not Configured Profile Name : ppk_d =============================================================================== Keyring : Not Configured Fvrf : Default Lifetime(Sec) : 86400 DPD Interval(Sec) : 4 DPD Retry Interval(Sec) : 2 Match ANY : NO Total Match remote peers : 0 Number of Trustpoints : 0 Local auth method : NULL Number of remote auth methods : 0 PPK Keyring : ppk_d Profile Name : ppk_m ============================================================== Keyring : Not Configured Fvrf : Default Lifetime(Sec) : 86400 DPD Interval(Sec) : 4 DPD Retry Interval(Sec) : 2 Match ANY : NO Total Match remote peers : 0 Number of Trustpoints : 0 Local auth method : NULL Number of remote auth methods : 0 PPK Keyring : ppk_m
	5.	Use the show keyring command to display the configured keyring details on NCS 1004. Example: RP/0/1/CPU0:ios#show keyring Tue Jun 6 18:00:28.272 IST Keyring Name : k4 =============================================================================== Total Peers : 1 ------------------------------------------------------------------------------- Peer Name : init IP Address : 198.51.100.19 Subnet Mask : 255.255.255.0 Local PSK : Configured Remote PSK : Configured PPK Mode : Not Configured PPK Mandatory : Not Configured Keyring Name : ppk_m =============================================================================== Total Peers : 1 ------------------------------------------------------------------------------- Peer Name : init IP Address : Not Configured Subnet Mask : Not Configured Local PSK : Not Configured Remote PSK : Not Configured PPK Mode : Manual PPK Mandatory : No Keyring Name : ppk_m_req =============================================================================== Total Peers : 1 ------------------------------------------------------------------------ Peer Name : init IP Address : Not Configured Subnet Mask : Not Configured Local PSK : Not Configured Remote PSK : Not Configured PPK Mode : Manual PPK Mandatory : Yes Keyring Name : ppk_d =============================================================================== Total Peers : 1 ------------------------------------------------------------------------------- Peer Name : init IP Address : Not Configured Subnet Mask : Not Configured Local PSK : Not Configured Remote PSK : Not Configured PPK Mode : Dynamic PPK Mandatory : No Keyring Name : ppk_d_req =============================================================================== Total Peers : 1 ------------------------------------------------------------------------------- Peer Name : init IP Address : Not Configured Subnet Mask : Not Configured Local PSK : Not Configured Remote PSK : Not Configured PPK Mode : Dynamic PPK Mandatory : Yes
	6.	Use the show ikev2 session detail command to display information about the current IKEv2 session. Example: RP/0/1/CPU0:ios#show ikev2 session detail Fri Feb 2 11:21:09.131 IST Session ID : 3 =============================================================================== Status : UP-ACTIVE IKE Count : 1 Child Count : 1 IKE SA ID : 11625 ------------------------------------------------------------------------------- Local : 192.0.2.3/500 Remote : 192.0.2.1/500 Status(Description) : READY (Negotiation done) Role : Initiator Fvrf : Default Encryption/Keysize : AES-CBC/256 PRF/Hash/DH Group : SHA512/SHA512/19 Authentication(Sign/Verify) : PSK/PSK Life/Active Time(sec) : 200/115 Session ID : 3 Local SPI : E8F0716FF44EA1C3 Remote SPI : B1046E13B805178E Local ID : 192.0.2.3 Remote ID : 192.0.2.1 Quantum resistance : Enabled with manual PPK Child SA ------------------------------------------------------------------------------- Local Selector : 0.0.0.0/0 - 255.255.255.255/65535 Remote Selector : 0.0.0.0/0 - 255.255.255.255/65535 ESP SPI IN/OUT : 0xf5e2a1c2 / 0x12bb94fd Encryption : AES-CBC Keysize : 256 ESP HMAC : SHA384

What to do next

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Verify the PPK configuration

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

What to do next