show security group-vpn server kek security-associations

Index

Index number of an SA. This number is an internally generated number you can use to display information about a single SA.

Remote Address

Identifier of the remote/peer. Because there could be multiple members, the remote address always contains the IP address 0.0.0.0.

State

State of the KEK security associations:

• DOWN—SA is not active.
• UP—SA is active.

Initiator cookie

Random number generated by the server. This is used when the server needs to push data to a member or send heartbeats to a member, or a member needs to reply to the server.

Responder cookie

Random number generated by the server. This is used when the server needs to push data to a member or send heartbeats to a member, or a member needs to reply to the server.

GroupId

Group identifier.

KEK Peer

IP address of the destination peer with which the local peer communicates. For KEK SAs, it always contains 0.0.0.0 which means any IP address.

Role

For the server, it is always initiator.

Authentication method

RSA is the supported authentication method.

Local

Address of the local peer.

Remote

Address of the remote peer.

Lifetime

Number of seconds remaining until the IKE SA expires.

Algorithms

Internet Key Exchange (IKE) algorithms used to encrypt and secure exchanges between the peers during the Phase 2 process:

• Sig-hash—Type of authentication algorithm used.
  • sha1—Secure Hash Algorithm 1(sha1) authentication.
  • md5—MD5 authentication.
• Encryption—Type of encryption algorithm used.
  • aes-256-cbc—Advanced Encryption Standard (AES) 256-bit encryption.
  • aes-192-cbc— AES192-bit encryption
  • aes-128-cbc—AES 128-bit encryption.
  • 3des-cbc—3 Data Encryption Standard (DES) encryption.
  • des-cbc—DES encryption.

Traffic statistics

• Input bytes—Number of bytes received.
• Output bytes—Number of bytes transmitted.
• Input packets—Number of packets received.
• Output packets—Number of packets transmitted.

Server Info Version

Identify the latest set of information maintained in the server.

The following fields are the configured server-member-communication options:

Server Heartbeat Interval

Interval in seconds at which the server sends heartbeats to group members.

Server Activation Delay

Number of seconds before a group member can use a new key when the member reregisters with the server.

Server Multicast Group

Multicast IP address to which the server sends rekey messages.

Server Replay Window

Antireplay time in seconds. This is 0 if antireplay is disabled.

Retransmission Period

Number of seconds between a rekey transmission and the first retransmission when there is no reply from the member.

Number of Retransmissions

For unicast communications, the number of times the server retransmits rekey messages to a member when there is no reply. For multicast communications, the number of copies of a message the server sends to members.

Lifetime Seconds

Configured lifetime, in seconds, for the KEK.

Group Key Push sequence number

Sequence number of the KEK SA groupkey-push message. This number is incremented with every groupkey-push message, including heartbeats.