Security Associations Do Not Re-Key; Clearing Security Associations; Debugging The Ipsec Process; Debugging The Ike Process - Cisco 9134 - MDS Multilayer Fabric Switch Troubleshooting Manual

Chapter 22 Troubleshooting IPsec
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m

Security Associations Do Not Re-Key

A lifetime counter (in seconds and bytes) is maintained as soon as an SA is created. When the time limit
expires, the SA is no longer operational and is automatically renegotiated (re-keyed) if traffic is present.
If there is no traffic, the SA will not be re-keyed and the tunnel will go down.
The re-key operation starts when the soft lifetime expires. That happens approximately 20 to 30 seconds
before the time-based lifetime expires, or when approximately 10 to 20 percent of the bytes are
remaining in the bytes-based lifetime.
To troubleshoot this problem, follow these steps:
Step 1 Verify that traffic was flowing when the soft SA lifetime expired.
Step 2 Verify that the configurations are still compatible.

Clearing Security Associations

To clear a specific SA, obtain the SA index value and issue the clear crypto sa domain ipsec interface
gigabitethernet slot/port outbound sa-index command.
To obtain the SA index value, issue the show crypto sad domain ipsec command.

Debugging the IPsec Process

Use the following commands to print debug messages to the console:
•
•
•
•

Debugging the IKE Process

Use the following commands to show the internal state of the IKE process:
•
•

Obtaining Statistics from the IPsec Process

To obtain statistics from the IPsec process, issue the show crypto global domain ipsec command and
the show crypto global domain ipsec interface gigabitethernet slot/port command. The show crypto
global domain ipsec command output displays statistics for all SAs. Command output follows:
MDSA# show crypto global domain ipsec
IPSec global statistics:
OL-9285-05
debug ipsec error for error messages.
debug ipsec warning for warning messages.
debug ipsec config for configuration messages.
debug ipsec flow for SA related messages.
show crypto ike domain ipsec initiator
show crypto ike domain ipsec sa
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
IPsec Issues
22-15