VPNs and tunnels
0 of 38 nailed
Cisco IOS18
show crypto isakmp sa- Lists IKEv1 (ISAKMP) SAs with peer addresses and state. QM_IDLE means phase 1 is complete; MM_NO_STATE or MM_KEY_EXCH point at policy or key problems.
Example
Output R1# show crypto isakmp sa IPv4 Crypto ISAKMP SA dst src state conn-id status 203.0.113.2 198.51.100.1 QM_IDLE 1001 ACTIVE show crypto ikev2 sa- Lists IKEv2 SAs with local and remote address and port, FVRF and IVRF, status (READY when up), the negotiated algorithms and the lifetime used.
show crypto ipsec sa- Shows each IPsec SA pair with local and remote selectors, peer, encaps and decaps counters, SPIs, transform, mode and remaining lifetime.
show crypto ipsec sa peer 203.0.113.2- Limits the IPsec SA output to one peer. The quickest way to compare encaps and decaps counters on a busy headend.
show crypto session- One summary per peer. UP-ACTIVE means IKE and IPsec SAs are up, UP-IDLE means only the IKE SA is up, DOWN means nothing is negotiated.
Example
Output R1# show crypto session Crypto session current status Interface: Tunnel0 Profile: IKEV2-BRANCH Session status: UP-ACTIVE Peer: 203.0.113.2 port 500 Session ID: 1 IKEv2 SA: local 198.51.100.1/500 remote 203.0.113.2/500 Active IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 0.0.0.0/0.0.0.0 Active SAs: 2, origin: crypto map show crypto map- Lists crypto map entries with their peers, crypto ACLs, transform sets, PFS setting and the interfaces they are applied to.
show access-lists VPN-TRAFFIC- Shows the crypto ACL lines, so you can compare them side by side with the peer's. They must be mirror images.
clear crypto sa peer 203.0.113.2- Deletes the IPsec SAs to one peer so they renegotiate. Use after collecting evidence; it interrupts traffic to that peer.
clear crypto ikev2 sa- Deletes IKEv2 SAs, and with them their Child SAs. Options narrow it to a local or remote address.
debug crypto condition peer ipv4 203.0.113.2- Restricts crypto debugs to one peer. Set it before any crypto debug on a router with many tunnels.
debug crypto isakmp- Shows IKEv1 negotiation step by step, including which phase 1 policy matched and why quick mode was rejected.
debug crypto ipsec- Shows IPsec SA creation and deletion and proposal checks, such as "proxy identities not supported" for mismatched crypto ACLs.
debug crypto ikev2- Shows IKEv2 exchanges, proposal and identity matching, authentication results and Child SA creation.
show dmvpn- Lists DMVPN peers per tunnel interface with NBMA and tunnel addresses, state, uptime and attributes such as S (static), D (dynamic) and N (NATed).
show ip nhrp- Shows the NHRP cache, mapping tunnel addresses (and shortcut prefixes) to NBMA addresses, with type, flags and expiry.
show ip nhrp nhs detail- On a spoke, shows each configured next hop server and whether registrations to it are being answered.
show interfaces Tunnel0- Shows tunnel source and destination, tunnel mode, transport MTU, protection profile, line protocol and traffic counters.
ping 10.2.0.10 source GigabitEthernet0/0/1 size 1400 df-bit- Sends LAN-sourced pings with DF set at a chosen size, which matches the crypto policy and finds the largest packet the tunnel passes.
Junos3
show security ike security-associations- Lists IKE SAs on an SRX with the remote address, state (UP or DOWN), initiator and responder cookies and mode.
show security ipsec security-associations- Lists IPsec SAs on an SRX with SPIs, algorithms, remaining lifetime, gateway and the bound tunnel interface.
show security ipsec statistics- Shows ESP encrypted and decrypted byte and packet counts plus errors such as authentication and replay failures.
PAN-OS3
show vpn ike-sa- Lists IKE SAs on a Palo Alto firewall per gateway, with algorithms, lifetime and whether phase 1 is established.
show vpn ipsec-sa- Lists IPsec SAs per tunnel with SPIs, algorithms and remaining lifetime.
test vpn ike-sa gateway GW-BRANCH- Forces the firewall to start IKE negotiation with the named gateway, instead of waiting for interesting traffic.
FortiOS3
diagnose vpn ike gateway list- Shows each IKE gateway on a FortiGate with peer address, IKE version, NAT-T state, and phase 1 and phase 2 status.
diagnose vpn tunnel list- Shows each IPsec tunnel with its selectors, SPIs, algorithms and encrypt and decrypt counters.
get vpn ipsec tunnel summary- One line per IPsec tunnel with the peer and how many selectors are up, a quick health check.
Linux3
wg show- Shows each WireGuard interface and peer with public key, endpoint, allowed IPs, latest handshake and bytes sent and received.
ip xfrm state- Lists the kernel IPsec SAs (the SAD) with addresses, protocol, SPI, mode and algorithms, whichever IKE daemon created them.
swanctl --list-sas- Lists strongSwan IKE SAs and their Child SAs with state, algorithms, selectors and traffic counters.