Cisco Catalyst SD-WAN High Availability Configuration Guide, Releases 26.x and Later

PDF

Cisco Catalyst SD-WAN High Availability Configuration Guide, Releases 26.x and Later

Verify the resilient data plane

Updated: October 14, 2026

Want to summarize with AI?

Log in

Provides commands and example output for verifying resilient-tunnel diagnostics, the IKEv2 security association, the BGP neighbor, and a resilient BGP route.

Objective

Use the verification commands and example output to confirm that the resilient tunnels are operational, the required IKEv2 and BGP sessions are established, and resilient BGP routes are installed.

Verify the resilient-tunnel diagnostics

Use the following commands to verify the operational state, statistics, and control state of the resilient tunnels.

Display detailed status for the resilient tunnels:

Device# show platform software sdwan srtm details
SD-WAN SRTM Detailed Status
============================

SRTM Mode: ACTIVE

Total Resilient Tunnels: 1

Tunnel: Tunnel20
  Interface Index: 22
  VRF: 1
  Source Interface: GigabitEthernet0/0/0
  Admin State: UP
  Line Protocol: UP

  Crypto Status:
    IKEv2 SA: UP (count: 1)
    IPsec SA: UP (count: 2)
    Peer IP: 200.100.1.118

  BGP Status:
    State: ESTABLISHED
    Neighbor: 172.16.20.1
    Admin Distance: 0
    Prefixes Received: YES

  Operational: YES
  SRTM Control: Allows UP

Display statistics for the resilient tunnels:

Device# show platform software sdwan srtm statistics
SD-WAN SRTM Statistics
======================

Current SRTM Mode: ACTIVE
Total Resilient Tunnels: 1

Statistics:
  Mode Changes: 1
  Registry Callback Invocations: 9
  Tunnels Activated: 1
  Tunnels Deactivated: 0

Display the resilient-tunnel control state maintained by the Cisco Catalyst SD-WAN daemon:

Device# show platform software sdwan vdaemon srtm
SD-WAN vDaemon SRTM Status
===========================

State: ACTIVE (previous: INACTIVE)
BFD: all-down=TRUE
Controllers: vsmart=0 any-up=FALSE
Last-Resort: configured=FALSE active=FALSE
Cold-boot: phase=FALSE delay=300 sec
Timers: lr-delay=120 sec stabilization=15 sec

Last activation: 2026-08-18T18:59:30+0000
Last exit: Never

Statistics:
  Activations: 1
  Exits: 0
  State transitions: 1
  BFD events: down=0 up=0
  Controller events: down=0 up=0
  Oper up sent: 1
  Oper down sent: 1

Resilient tunnel inventory is maintained by IOSd.

Verify the IKEv2 security association

Use the following command to verify that the branch and hub Cisco IOS XE Catalyst SD-WAN devices have established an IKEv2 security association:

Device# show crypto ikev2 sa
IPv4 Crypto IKEv2 SA
Tunnel-id Local Remote fvrf/ivrf Status
1 200.100.1.107/500 200.100.1.118/500 none/1 READY
Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 86400/42163 sec
CE id: 1031, Session-id: 16
Local spi: 3EC4C6313A3FE829 Remote spi: C0BB083A1640E1D9
IPv6 Crypto IKEv2 SA

Verify the BGP neighbor

Use the following command to verify that the resilient BGP neighbor is established in service VRF 1:

Device# show bgp vpnv4 unicast vrf 1 summary
BGP router identifier 200.100.1.107, local AS number 65011
BGP table version is 33, main routing table version 33
2 network entries using 528 bytes of memory
2 path entries using 272 bytes of memory
3/2 BGP path/bestpath attribute entries using 960 bytes of memory
1 BGP AS-PATH entries using 24 bytes of memory
1 BGP extended community entries using 24 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 1808 total bytes of memory
BGP activity 17/15 prefixes, 17/15 paths, scan interval 60 secs
2 networks peaked at 18:59:34 Aug 18 2026 UTC (2w5d ago)
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
172.16.20.1     4        65005    4433    4420       33    0    0 11:41:27        1
resilient-spoke# show ip bgp vpnv4 vrf 1 summary
BGP router identifier 200.100.1.107, local AS number 65011
BGP table version is 33, main routing table version 33
2 network entries using 528 bytes of memory
2 path entries using 272 bytes of memory
3/2 BGP path/bestpath attribute entries using 960 bytes of memory
1 BGP AS-PATH entries using 24 bytes of memory
1 BGP extended community entries using 24 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 1808 total bytes of memory
BGP activity 17/15 prefixes, 17/15 paths, scan interval 60 secs
2 networks peaked at 18:59:34 Aug 18 2026 UTC (2w5d ago)
Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
172.16.20.1     4        65005    4436    4423       33    0    0 11:41:52        1

Verify a resilient BGP route

Use the following command to verify that a resilient BGP route is installed in service VRF 1:

Device# show ip route vrf 1 10.10.0.0
Routing Table: 1
Routing entry for 10.10.0.0/16
  Known via "bgp 65011", distance 253, metric 0
  Last update from 172.16.20.1 00:03:42 ago
  * 172.16.20.1, from 172.16.20.1, 00:03:42 ago
      Route metric is 0, traffic share count is 1