Juniper JUNOSE 11.2.X IP SERVICES Configuration Manual page 322

JunosE 11.2.x IP Services Configuration Guide
host1# show ipsec ike-sa
IKE Phase 1 SA's:
Local:Port Remote:Port
21.227.9.8:500 21.227.9.10:500
21.227.9.8:4500 21.227.9.11:4500
21.227.9.8:4500 21.227.9.11:14500
show ipsec option
296
AM_DONE_R—Responder has finished aggressive mode negotiation
MM_SA_I—Initiator has sent initial main mode SA payload to the responder
MM_SA_R—Responder has sent a response to the initial main mode SA
MM_KE_I—Initiator has sent initial main mode key exchange to the responder
MM_KE_R—Responder has sent a response to the key exchange
MM_FINAL_I—Initiator has sent the final packet in the main mode negotiation
MM_FINAL_R—Responder has finished main mode negotiation
MM_DONE_I—Initiator has finished main mode negotiation
DONE—Phase 1 SA negotiation is complete, as evidenced by receipt of some phase
2 messages
Local Cookie—Unique identifier (SPI) for the local phase 1 IKE SA
Remote Cookie—Unique identifier (SPI) for the remote phase 1 IKE SA
Example
The following example displays the IKE phase 1 SAs for three remote client PCs that
are accessing an E Series router (IP address 21.227.9.8).
The first client PC listed (IP address 21.227.9.10) is not located behind a NAT device,
and is therefore not using NAT-T to access the router. This PC appears in the
Remote:Port column with its own IP address (21.227.9.10) and UDP port number 500.
The remaining two client PCs are located behind a NAT device that has IP address
21.227.9.11, and are using NAT-T to access the router. These PCs appear in the
Remote:Port column with the same IP address (21.227.9.11) but with two different UDP
port numbers, 4500 and 14500.
Time(Sec) State
26133
28774
28729
See show ipsec ike-sa.
See show ike sa.
Use to display whether NAT-T is enabled or disabled on the current virtual router.
The show ipsec option command also displays the status of dead peer detection
(DPD) on the virtual router. For information about configuring and monitoring DPD,
see "Configuring IPSec" on page 119.
Example
Local Cookie
DONE 0x87a943562124c711 0xafa2cf4a260399a4
DONE 0x01f9efa234d45ad8 0xada4cb7cafee9243
DONE 0x0c5ccb6b94b00051 0xe975c0ae3b9ca8bf
Copyright © 2010, Juniper Networks, Inc.
Remote Cookie