Cisco CRS User Manual page 145

IPSec Commands
Usage Guidelines
If no optional argument or keyword is used, all SAs are displayed within a flow. Within a flow, the SAs are
listed by protocol (Encapsulating Security Payload [ESP] or Authentication Header [AH]) and direction
(inbound or outbound).
The detail keyword provides additional information only for SAs that are configured in a software crypto
engine. The SAs are configured by using tunnel-ipsec and transport.
Task ID
Task ID
crypto
Examples The following sample output is from the show crypto ipsec sa command:
RP/0/RP0/CPU0:router# show crypto ipsec sa
SSA id:
Node id:
SA Type:
interface:
profile
local
remote ident (addr/mask/prot/port) : (0.0.0.0/0.0.0.0/512/0)
local crypto endpt: 0.0.0.0, remote crypto endpt: 0.0.0.0, vrf default
#pkts tx
#bytes tx
#pkts encrypt
#pkts digest
#pkts encrpt fail:0
#pkts digest fail:0
#pkts replay fail:0
#pkts tx errors
outbound esp sas:
inbound esp sas:
This table describes the significant fields shown in the display.
OL-24740-01
510
0/1/0
MANUAL
service-ipsec22
: p7
ident (addr/mask/prot/port) : (0.0.0.0/0.0.0.255/512/0)
:0
:0
:0
:0
:0
spi: 0x322(802)
transform: esp-3des-md5
in use settings = Tunnel
sa agreed lifetime: 3600s, 4194303kb
sa timing: remaining key lifetime: 3142303931sec/0kb
sa DPD: disable, mode none, timeout 0s
sa idle timeout: disable, 0s
sa anti-replay (HW accel): enable, window 64
spi: 0x322(802)
transform: esp-3des-md5
in use settings = Tunnel
sa agreed lifetime: 3600s, 4194303kb
sa timing: remaining key lifetime: 3142303931sec/0kb
sa DPD: disable, mode none, timeout 0s
sa idle timeout: disable, 0s
sa anti-replay (HW accel): enable, window 64
Cisco IOS XR System Security Command Reference for the Cisco CRS Router, Release 4.1
Operations
read
#pkts rx :0
#bytes rx :0
#pkts decrypt :0
#pkts verify :0
#pkts decrpt fail:0
#pkts verify fail:0
#pkts rx errors :0
show crypto ipsec sa
135