Debugging Ipsec - Patton electronics OnSite 2800 Series User Manual

OnSite 2800 Series User Manual
Example: Display IPsec transformation profiles
2800(cfg)#show profile ipsec-transform
IPSEC transform profiles:
Name: AES_128
ESP Encryption: AES-CBC, Key length: 128
Example: Display IPsec policy profiles
2800(cfg)#show profile ipsec-policy-manual
Manually keyed IPsec policy profiles:
Name: ToBurg, Peer: 200.200.200.1, Mode: tunnel, transform-profile: AES_128
ESP SPI Inbound: 1111, Outbound: 2222
ESP Encryption Key Inbound: 1234567890ABCDEF1234567890ABCDEF
ESP Encryption Key Outbound: FEDCBA0987654321FEDCBA0987654321

Debugging IPsec

A debug monitor and an additional
Procedure: To debug IPsec connections
Mode: Configure
Step
1 node(cfg)#debug ipsec
2 node(cfg)#show ipsec security-associ-
optional ations
Example: IPsec Debug Output
2800(cfg)#debug ipsec
IPSEC monitor on
23:11:04 ipsec > Could not find security association for inbound ESP packet.
SPI:1201
Example: Display IPsec Security Associations
2800(cfg)#show ipsec security-associations
Active security associations:
Dir Type
Peer
Bytes (processed/lifetime) Seconds (age/lifetime)
VPN configuration task list
show command are at your disposal to debug IPsec problems.
Command
Policy Mode
SPI AH SPI ESP
Enables IPsec debug monitor
Summarizes the configuration information of all
IPsec connections. If an IPsec connection does
not show up, then one or more parameters are
missing in the respective Policy Profile.
The information 'Bytes (processed)' supports
debugging because it indicates whether IPsec
packets depart from ('OUT') or arrive at ('IN') the
OnSite router.
Udp-Encapsulation
AH ESP-Auth
6 • VPN configuration
Purpose
ESP-Enc
74