Monitoring IPSec Tunnel Profiles

This section contains information about troubleshooting and monitoring dynamic IPSec subscribers.

System Event Logs

To troubleshoot and monitor dynamic IPSec subscribers, use the following system event log:

ipsecIdDb—IPsec ID database
ipsecXcfgSM—IPsec Xauth/ModeCfg state machine
ipsecP1Throttler—Ongoing Phase 1 negotiations

For more information about using event logs, see the JunosE System Event Logging Reference Guide.

show Commands

To display user information for dynamic IPSec tunnel profiles or subscribers, use the following show commands.

show ipsec tunnel profile

Use to display information about all existing IPSec tunnel profiles or a specified tunnel profile.
Use the detail keyword to display detailed information about the tunnel profile.

Example 1

host1#show ipsec tunnel profile
IPsec tunnel profile ipsec-spg is active with no subscriber
1 IPsec tunnel profile found

Example 2

host1#show ipsec tunnel profile detail ipsec-spg
IPsec tunnel profile ipsec-spg is active with no subscriber
  Extended-authentication: pap, no re-authentication
  Peer IP characteristics configuration: enabled
  Virtual router: default
  Local IP address: 10.227.5.31
  Local IKE identity: 10.227.5.31
  Peer  IKE identity: IP network: not allowed
                      username: *
                      domain-name: spg.juniper.net
                      DN: not allowed
  Maximum subscribers: no limit
  Domain suffix: @spg
  IP profile: ip-spg
  Local IPsec identity: subnet 0.0.0.0 0.0.0.0, proto 0, port 0
  Peer IPsec identity: invalid identity
  Lifetime: between 1800 and 7200 seconds, and between 100000 and 500000 KB
  Reachable networks: none
  PFS not configured
  Transforms:, tunnel-esp-3des-sha1
  Subscribers rejected due to maximum subscribers limit: 0
  Completed sessions: 43, totaling 4873 seconds, statistics:
  ipsec stats:
    outbound:
      outboundUserPacketsReceived = 88
      outboundUserOctetsReceived  = 74544
      outboundAccPacketsReceived = 88
      outboundAccOctetsReceived = 79168
      outboundOtherTxErrors = 0
      outboundPolicyErrors = 0
    inbound:
      inboundUserPacketsReceived = 88
      inboundUserOctetsReceived  = 74880
      inboundAccPacketsReceived  = 88
      inboundAccOctetsReceived   = 79488
      inboundAuthenticationErrors= 0
      inboundReplayErrors = 0
      inboundPolicyErrors = 0
      inboundOtherRxErrors = 0
      inboundDecryptErrors = 0
      inboundPadErrors = 0

See show ipsec tunnel profile.

show subscribers

Use to display the active subscribers on the router.
Field descriptions
- User Name—Name of the subscriber
- Type—Type of subscriber: atm, ip, ipsec, ppp, tnl (tunnel), tst (test)
- Addr | Endpt—IP or IPv6 address and source of the address: l2tp, local, dhcp, radius, user. For local, dhcp, radius, and user endpoints, the address is that of the user. When the endpoint is l2tp, the address is that of the LNS.
- Virtual Router—Name of the virtual router context
- Interface—Interface specifier over which the subscriber is connected
- Login Time—Date, in YY/MM/DD format, and time the subscriber logged in
- Circuit Id—User's circuit ID value specified by PPPoE
- Remote Id—User's remote ID value specified by PPPoE

Example

host1#show subscribers
                             Subscriber List
                             ----------------
                                                           Virtual
      User Name           Type         Addr|Endpt           Router
-----------------------   -----   --------------------   ------------
xcfgUser1@vpn1            ipsec   10.227.5.106/local     vpn1   
      User Name                      Interface                          
-----------------------   -------------------------------- 
xcfgUser1@vpn1            FastEthernet 5/2.4                                      
      User Name               Login Time           Circuit Id      
-----------------------   -------------------   ------------------- 
xcfgUser1@vpn1            06/05/12 10:58:42     0.4.1.10.fe.25.3b.0 
     User Name               Remote Id      
-----------------------   ----------------
xcfgUser1@vpn1            (800) 555-1212

See show subscribers.