show security ipsec security-associations
Syntax
show security ipsec security-associations <brief | detail> <family (inet | inet6)> <fpc slot-number pic slot-number> <index SA-index-number> <kmd-instance (all | kmd-instance-name)> <pic slot-number fpc slot-number> <sa-type shortcut> <traffic-selector traffic-selector-name> <vpn-name vpn-name> <ha-link-encryption>
Description
IPsec 보안 연결(SAS)에 대한 정보를 표시합니다.
Junos OS 릴리스에서는 20.1R2, 20.2R2, 20.3R2, 20.3R1 이상에서 명령을 실행할 때 터널 내의 모든 IPsec SA에 해당하는 새로운 출력 필드가 각 IPsec SA 정보로 show security ipsec security-associations detailIKE SA Index 표시됩니다. 을 show security ipsec security-associations detail (SRX5400, SRX5600, SRX5800) 참조합니다.
Options
| 없음 |
모든 SAS에 대한 정보를 표시합니다. |
brief | detail |
(선택 사항) 지정된 출력 수준을 표시합니다. 기본 설정은 |
family |
(선택 사항) 패밀리 에 의해 SAS를 표시합니다. 이 옵션은 출력을 필터링하는 데 사용됩니다.
|
fpc slot-numberpic slot-number |
(선택 사항) 지정된 FPC(Flexible PIC Concentrator) 슬롯 및 PIC 슬롯에 기존 IPsec SAS에 대한 정보를 표시합니다. 섀시 클러스터에서 운영 모드에서 CLI 명령을 실행할 때 |
index SA-index-number |
(선택 사항) 이 인덱스 번호로 식별된 지정된 SA에 대한 상세 정보를 표시합니다. 인덱스 번호가 포함된 모든 SAS 목록을 얻었다면 그 어떤 옵션도 사용하지 말고 명령어를 사용하세요. |
kmd-instance |
(선택 사항) FPC 슬롯 번호 및 PIC 슬롯 번호로 식별된 핵심 관리 프로세스(이 경우 KMD)에 기존 IPsec SAS에 대한 정보를 표시합니다.
|
pic slot-numberfpc slot-number |
(선택 사항) 지정된 PIC 슬롯 및 FPC 슬롯에 기존 IPsec SAS에 대한 정보를 표시합니다. |
sa-type |
(ADVPN용 옵션) 지정된 유형의 SA에 대한 정보를 표시합니다. |
traffic-selector traffic-selector-name |
(선택 사항) 지정된 트래픽 선택기에 대한 정보를 표시합니다. |
vpn-name vpn-name |
(선택 사항) 지정된 VPN에 대한 정보를 표시합니다. |
| ha 링크 암호화 |
(선택 사항) Interchassis 링크 터널과 관련된 정보만 표시합니다. ipsec(고가용성)show security ipsec security-associations ha-link-encryption (SRX5400, SRX5600, SRX5800) 및 show security ipsec sa detail ha-link-encryption (SRX5400, SRX5600, SRX5800) 을 확인하십시오. |
Required Privilege Level
보기
Output Fields
표 1 명령의 출력 필드를 나열하고, 명령에 대한 출력 필드를 나열하고. 의 출력 필드를 show security ipsec security-associations표 2show security ipsec sa표 3show security ipsec sa detail 나열합니다. 출력 필드는 대략적인 순서로 나열되어 있습니다.
|
필드 이름 |
필드 설명 |
출력 수준 |
|---|---|---|
|
|
활성 IPsec 터널의 총 개수. |
|
|
|
SA 인덱스 수. 이 번호를 사용하여 SA에 대한 추가 정보를 얻을 수 있습니다. |
모든 레벨 |
|
|
IKE(Internet Key Exchange) 피어 간의 교환을 보호하는 데 사용되는 암호화는 다음과 같습니다.
|
|
|
|
SPI(Security 매개 변수 인덱스) 식별자 SA는 SPI에 의해 고유하게 식별됩니다. 각 엔트리에는 VPN 이름, 원격 게이트웨이 주소, 각 방향의 SPIS, 암호화 및 인증 알고리즘 및 키가 포함됩니다. 피어 게이트웨이에는 각각 2개의 SAS가 있습니다. 각각은 협상의 두 단계에서 나타남 IKE(Internet Key Exchange) 및 IPsec. |
|
|
|
만료된 SA의 수명은 몇 초 또는 킬로바이트로 표시됩니다. |
|
|
|
Mon 필드는 VPN 모니터링 상태를 말합니다. VPN 모니터링이 활성화되면 이 필드가 |
|
|
|
루트 시스템. |
|
|
|
네트워크 주소 변환(네트워크 주소 변환(NAT))를 사용하는 경우 이 값은 4500입니다. 또는 표준 포트인 IKE(Internet Key Exchange) 500입니다. |
모든 레벨 |
|
|
원격 게이트웨이의 IP 주소입니다. |
|
|
|
논리적 시스템의 이름. |
|
|
|
VPN을 위한 IPsec 이름. |
|
|
|
State에는 두 가지 옵션이
|
|
|
|
로컬 시스템의 게이트웨이 주소. |
|
|
|
원격 시스템의 게이트웨이 주소. |
|
|
|
트래픽 선택의 이름. |
|
|
|
파트너 대상 게이트웨이와 통신할 수 있도록 로컬 피어의 ID 이 값은 IP 주소, 완벽하게 정해진 도메인 이름, 이메일 주소 또는 이름(DN)으로 지정됩니다. |
|
|
|
대상 피어 게이트웨이의 IP 주소. |
|
|
|
로컬 IP 범위, 원격 IP 범위, 소스 포트 범위, 대상 포트 범위 및 프로토콜을 정의합니다. |
|
|
|
용어에 대해 구성된 소스 포트 범위. |
|
|
|
용어에 대해 구성된 대상 포트 범위 |
|
|
|
IKE(Internet Key Exchange) 버전 또는 |
|
|
|
단편화되지 않는 상태: |
|
|
|
|
|
|
|
터널 이벤트 및 이벤트가 발생한 횟수 터널 이벤트에 대한 설명과 취할 수 있는 조치는 터널 이벤트를 참조하세요. |
|
|
|
SA를 위한 앵커 스레드 ID(SRX4600 시리즈 디바이스의 경우 옵션 |
|
|
|
SA 방향, 인바운드 또는 아웃바운드가 될 수 있습니다. |
|
|
|
보조 보안 매개 변수 인덱스(SPI)의 가치
|
|
|
|
SA 모드:
|
|
|
|
SA 유형:
|
|
|
|
SA 상태:
|
|
|
|
프로토콜 지원.
|
|
|
|
사용되는 인증 유형 |
|
|
|
사용된 암호화 유형. Junos OS Release 19.4R2 계층 수준에서 암호화 알고리즘으로 구성하거나 명령의 인증 알고리즘 필드가 동일한 구성된 암호화 알고리즘을 |
|
|
|
소프트 수명은 IPsec 키 관리 시스템에 SA 만료를 알리고 있습니다. SA의 각 수명은 하드 및 소프트 등 2개의 디스플레이 옵션을 가지며, 그 중 하나는 동적 SA를 위해 반드시 제공되어야 합니다. 따라서 하드 수명이 만료되기 전에 키 관리 시스템이 새로운 SA를 협상할 수 있습니다.
|
|
|
|
하드 수명은 SA의 수명을 지정합니다.
|
|
|
|
남은 수명은 킬로바이트의 사용 제한을 지정합니다. 라이프사이즈가 지정되지 않은 경우 무제한으로 표시됩니다.
|
|
|
|
패킷이 재생되지 않도록 하는 서비스 상태 될 |
|
|
|
64비트 크기의 안티플레이 서비스 윈도우입니다. |
|
|
|
경로 기반 VPN이 연결되는 터널 인터페이스 |
|
|
|
시스템이 IP 헤더에서 내부 IP 헤더로 외부 DSCP 값을 복사하는지 나타냅니다. |
|
|
|
활성화된 IKE(Internet Key Exchange) 나타냅니다. |
|
|
|
상위 보안 연결 목록을 IKE(Internet Key Exchange) 나타냅니다. |
|
|
필드 이름 |
필드 설명 |
|---|---|
|
|
활성 IPsec 터널의 총 개수. |
|
|
SA 인덱스 수. 이 번호를 사용하여 SA에 대한 추가 정보를 얻을 수 있습니다. |
|
|
2단계 협상 동안 피어 간의 교환을 보호하는 IKE(Internet Key Exchange) 암호화는 다음과 같습니다.
|
|
|
SPI(Security 매개 변수 인덱스) 식별자 SA는 SPI에 의해 고유하게 식별됩니다. 각 엔트리에는 VPN 이름, 원격 게이트웨이 주소, 각 방향의 SPIS, 암호화 및 인증 알고리즘 및 키가 포함됩니다. 피어 게이트웨이에는 각각 2개의 SAS가 있습니다. 각각은 협상의 두 단계에서 나타남 1단계 및 2단계 |
|
|
만료된 SA의 수명은 몇 초 또는 킬로바이트로 표시됩니다. |
|
|
Mon 필드는 VPN 모니터링 상태를 말합니다. VPN 모니터링이 활성화된 경우 이 필드는 U(상부) 또는 D(아래)를 표시하게 됩니다. 하이픈(-)은 이 SA에 VPN 모니터링이 활성화되지 않았다는 뜻입니다. V는 IPSec 데이터 경로 검증이 진행 중입니다. |
|
|
루트 시스템. |
|
|
네트워크 주소 변환(네트워크 주소 변환(NAT))를 사용하는 경우 이 값은 4500입니다. 또는 표준 포트인 IKE(Internet Key Exchange) 500입니다. |
|
|
시스템의 게이트웨이 주소. |
|
필드 이름 |
필드 설명 |
|---|---|
|
|
SA 인덱스 수. 이 번호를 사용하여 SA에 대한 추가 정보를 얻을 수 있습니다. |
|
|
가상 시스템 이름. |
|
|
VPN을 위한 IPSec 이름. |
|
|
로컬 시스템의 게이트웨이 주소. |
|
|
원격 시스템의 게이트웨이 주소. |
|
|
파트너 대상 게이트웨이와 통신할 수 있도록 로컬 피어의 ID 이 값은 IP 주소, 완벽하게 정해진 도메인 이름, 이메일 주소 또는 이름(DN)으로 지정됩니다. |
|
|
대상 피어 게이트웨이의 IP 주소. |
|
|
IKE(Internet Key Exchange) 버전. 예를 들어 IKEv1, IKEv2를 들 수 있습니다. |
|
|
단편화되지 않는 상태: |
|
|
경로 기반 VPN이 연결되는 터널 인터페이스 |
| 터널 이벤트 | |
|
|
SA 방향, 인바운드 또는 아웃바운드가 될 수 있습니다. |
|
|
보조 보안 매개 변수 인덱스(SPI)의 가치
|
|
|
VPN 모니터링이 활성화된 경우 필드가 |
|
|
하드 수명은 SA의 수명을 지정합니다.
|
|
|
남은 수명은 킬로바이트의 사용 제한을 지정합니다. 라이프사이즈가 지정되지 않은 경우 무제한으로 표시됩니다. |
|
|
소프트 수명은 IPsec 키 관리 시스템에 SA 만료를 알리고 있습니다. SA의 각 수명은 하드 및 소프트 등 2개의 디스플레이 옵션을 가지며, 그 중 하나는 동적 SA를 위해 반드시 제공되어야 합니다. 따라서 하드 수명이 만료되기 전에 키 관리 시스템이 새로운 SA를 협상할 수 있습니다.
|
|
|
SA 모드:
|
|
|
SA 유형:
|
|
|
SA 상태:
전송 모드에서 상태의 값은 항상 설치됩니다. |
|
|
프로토콜 지원.
|
|
|
패킷이 재생되지 않도록 하는 서비스 상태 될 |
|
|
안티플레이 서비스 창의 구성된 크기입니다. 32 패킷 또는 64 패킷이 될 수 있습니다. 리플레이 창 크기가 0인 경우, Antireplay 서비스는 비활성화됩니다. 안티 리플레이 창 크기는 오래된 패킷이나 복제 패킷을 거부하여 리플레이 공격으로부터 수신기를 보호합니다. |
|
Interchassis Link Tunnel |
|
|
고가용성(HA) 링크 암호화 모드 |
고가용성 모드 지원. 멀티 |
Sample Output
한마디로 show 명령어 출력은 구성의 모든 값을 표시하지 않습니다. 구성의 하위 세트만 표시됩니다. 시스템의 나머지 구성은 타원(...)로 대체되었습니다.
- show security ipsec security-associations (IPv4)
- show security ipsec security-associations (IPv6)
- show security ipsec security-associations index 511672
- show security ipsec security-associations index 131073 detail
- show security ipsec sa
- show security ipsec sa detail
- show security ipsec security-association
- show security ipsec security-associations brief
- show security ipsec security-associations detail
- show security ipsec security-associations family inet6
- show security ipsec security-associations fpc 6 pic 1 kmd-instance all (SRX Series Devices)
- show security ipsec security-associations detail (ADVPN Suggester, Static Tunnel)
- show security ipsec security-associations detail (ADVPN Partner, Static Tunnel)
- show security ipsec security-associations sa-type shortcut (ADVPN)
- show security ipsec security-associations sa-type shortcut detail (ADVPN)
- show security ipsec security-associations family inet detail
- show security ipsec security-associations detail (SRX4600)
- show security ipsec security-associations detail (SRX5400, SRX5600, SRX5800)
- show security ipsec security-associations ha-link-encryption (SRX5400, SRX5600, SRX5800)
- show security ipsec sa detail ha-link-encryption (SRX5400, SRX5600, SRX5800)
show security ipsec security-associations (IPv4)
user@host> show security ipsec security-associations Total active tunnels: 14743 Total Ipsec sas: 14743 ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway <511672 ESP:aes-cbc-128/sha1 0x071b8cd2 - root 500 21.0.45.152 >503327 ESP:aes-cbc-128/sha1 0x69d364dd 1584/ unlim - root 500 21.0.12.255 <503327 ESP:aes-cbc-128/sha1 0x0a577f2d 1584/ unlim - root 500 21.0.12.255 >512896 ESP:aes-cbc-128/sha1 0xd2f51c81 1669/ unlim - root 500 21.0.50.96 <512896 ESP:aes-cbc-128/sha1 0x071b8d9e 1669/ unlim - root 500 21.0.50.96 >513881 ESP:aes-cbc-128/sha1 0x95955834 1696/ unlim - root 500 21.0.54.57 <513881 ESP:aes-cbc-128/sha1 0x0a57860c 1696/ unlim - root 500 21.0.54.57 >505835 ESP:aes-cbc-128/sha1 0xf827b5c6 1598/ unlim - root 500 21.0.22.204 <505835 ESP:aes-cbc-128/sha1 0x0f43bf3f 1598/ unlim - root 500 21.0.22.204 >506531 ESP:aes-cbc-128/sha1 0x01694572 1602/ unlim - root 500 21.0.25.131 <506531 ESP:aes-cbc-128/sha1 0x0a578143 1602/ unlim - root 500 21.0.25.131 >512802 ESP:aes-cbc-128/sha1 0xdc292de4 1668/ unlim - root 500 21.0.50.1 <512802 ESP:aes-cbc-128/sha1 0x0a578558 1668/ unlim - root 500 21.0.50.1 >512413 ESP:aes-cbc-128/sha1 0xbe2c52d5 1660/ unlim - root 500 21.0.48.125 <512413 ESP:aes-cbc-128/sha1 0x1129580c 1660/ unlim - root 500 21.0.48.125 >505075 ESP:aes-cbc-128/sha1 0x2aae6647 1593/ unlim - root 500 21.0.19.213 <505075 ESP:aes-cbc-128/sha1 0x02dc5c50 1593/ unlim - root 500 21.0.19.213 >514055 ESP:aes-cbc-128/sha1 0x2b8adfcb 1704/ unlim - root 500 21.0.54.238 <514055 ESP:aes-cbc-128/sha1 0x0f43c49a 1704/ unlim - root 500 21.0.54.238 >508898 ESP:aes-cbc-128/sha1 0xbcced4d6 1619/ unlim - root 500 21.0.34.194 <508898 ESP:aes-cbc-128/sha1 0x1492035a 1619/ unlim - root 500 21.0.34.194 >505328 ESP:aes-cbc-128/sha1 0x2a8d2b36 1594/ unlim - root 500 21.0.20.208 <505328 ESP:aes-cbc-128/sha1 0x14920107 1594/ unlim - root 500 21.0.20.208 >500815 ESP:aes-cbc-128/sha1 0xdd86c89a 1573/ unlim - root 500 21.0.3.47 <500815 ESP:aes-cbc-128/sha1 0x1129507f 1573/ unlim - root 500 21.0.3.47 >503758 ESP:aes-cbc-128/sha1 0x64cc490e 1586/ unlim - root 500 21.0.14.172 <503758 ESP:aes-cbc-128/sha1 0x14920001 1586/ unlim - root 500 21.0.14.172 >504004 ESP:aes-cbc-128/sha1 0xde0b63ee 1587/ unlim - root 500 21.0.15.164 <504004 ESP:aes-cbc-128/sha1 0x071b87d4 1587/ unlim - root 500 21.0.15.164 >508816 ESP:aes-cbc-128/sha1 0x2703b7a5 1618/ unlim - root 500 21.0.34.112 <508816 ESP:aes-cbc-128/sha1 0x071b8af6 1618/ unlim - root 500 21.0.34.112 >511341 ESP:aes-cbc-128/sha1 0x828f3330 1644/ unlim - root 500 21.0.44.77 <511341 ESP:aes-cbc-128/sha1 0x02dc6064 1644/ unlim - root 500 21.0.44.77 >500456 ESP:aes-cbc-128/sha1 0xa6f1515d 1572/ unlim - root 500 21.0.1.200 <500456 ESP:aes-cbc-128/sha1 0x1491fddb 1572/ unlim - root 500 21.0.1.200 >512506 ESP:aes-cbc-128/sha1 0x4108f3a3 1662/ unlim - root 500 21.0.48.218 <512506 ESP:aes-cbc-128/sha1 0x071b8d5d 1662/ unlim - root 500 21.0.48.218 >504657 ESP:aes-cbc-128/sha1 0x27a6b8b3 1591/ unlim - root 500 21.0.18.41 <504657 ESP:aes-cbc-128/sha1 0x112952fe 1591/ unlim - root 500 21.0.18.41 >506755 ESP:aes-cbc-128/sha1 0xc0afcff0 1604/ unlim - root 500 21.0.26.100 <506755 ESP:aes-cbc-128/sha1 0x149201f5 1604/ unlim - root 500 21.0.26.100 >508023 ESP:aes-cbc-128/sha1 0xa1a90af8 1612/ unlim - root 500 21.0.31.87 <508023 ESP:aes-cbc-128/sha1 0x02dc5e3b 1612/ unlim - root 500 21.0.31.87 >509190 ESP:aes-cbc-128/sha1 0xee52074d 1621/ unlim - root 500 21.0.35.230 <509190 ESP:aes-cbc-128/sha1 0x0f43c16e 1621/ unlim - root 500 21.0.35.230 >505051 ESP:aes-cbc-128/sha1 0x24130b1c 1593/ unlim - root 500 21.0.19.188 <505051 ESP:aes-cbc-128/sha1 0x149200d9 1593/ unlim - root 500 21.0.19.188 >513214 ESP:aes-cbc-128/sha1 0x2c4752d1 1676/ unlim - root 500 21.0.51.158 <513214 ESP:aes-cbc-128/sha1 0x071b8dd3 1676/ unlim - root 500 21.0.51.158 >510808 ESP:aes-cbc-128/sha1 0x4acd94d3 1637/ unlim - root 500 21.0.42.56 <510808 ESP:aes-cbc-128/sha1 0x071b8c42 1637/ unlim - root 500 21.0.42.56
show security ipsec security-associations (IPv6)
user@host> show security ipsec security-associations Total active tunnels: 1 ID Algorithm SPI Life:sec/kb Mon vsys Port Gateway 131074 ESP:aes256/sha256 14caf1d9 3597/ unlim - root 500 2001:db8::1112 131074 ESP:aes256/sha256 9a4db486 3597/ unlim - root 500 2001:db8::1112
show security ipsec security-associations index 511672
user@host> show security ipsec security-associations index 511672
ID: 511672 Virtual-system: root, VPN Name: ipsec_vpn
Local Gateway: 20.0.0.1, Remote Gateway: 21.0.45.152
Traffic Selector Name: ts
Local Identity: ipv4(191.45.151.0-191.45.151.255)
Remote Identity: ipv4(40.45.151.0-40.45.151.255)
Version: IKEv2
DF-bit: clear, Copy-Outer-DSCP Disabled, Bind-interface: st0.0, Policy-name: IPSEC_POL
Port: 500, Nego#: 0, Fail#: 0, Def-Del#: 0 Flag: 0
Multi-sa, Configured SAs# 0, Negotiated SAs#: 0
Location: FPC 0, PIC 1, KMD-Instance 0
Anchorship: Thread 10
Direction: inbound, SPI: 0x835b8b42, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 1639 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 1257 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
Direction: outbound, SPI: 0x071b8cd2, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 1639 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 1257 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
show security ipsec security-associations index 131073 detail
user@host> show security ipsec security-associations index 131073 detail
ID: 131073 Virtual-system: root, VPN Name: IPSEC_VPN1
Local Gateway: 4.0.0.1, Remote Gateway: 5.0.0.1
Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
Version: IKEv2
DF-bit: clear, Copy-Outer-DSCP Disabled, Bind-interface: st0.1
Port: 500, Nego#: 18, Fail#: 0, Def-Del#: 0 Flag: 0x600a39
Multi-sa, Configured SAs# 9, Negotiated SAs#: 9
Tunnel events:
Mon Apr 23 2018 22:20:54 -0700: IPSec SA negotiation successfully completed (1 times)
Mon Apr 23 2018 22:20:54 -0700: IKE SA negotiation successfully completed (2 times)
Mon Apr 23 2018 22:20:18 -0700: User cleared IKE SA from CLI, corresponding IPSec SAs cleared (1 times)
Mon Apr 23 2018 22:19:55 -0700: IPSec SA negotiation successfully completed (2 times)
Mon Apr 23 2018 22:19:23 -0700: Tunnel is ready. Waiting for trigger event or peer to trigger negotiation (1 times)
Mon Apr 23 2018 22:19:23 -0700: Bind-interface's zone received. Information updated (1 times)
Mon Apr 23 2018 22:19:23 -0700: External interface's zone received. Information updated (1 times)
Direction: inbound, SPI: 2d8e710b, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 1930 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 1563 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha-256, Encryption: aes256-cbc
Anti-replay service: counter-based enabled, Replay window size: 64
Multi-sa FC Name: default
Direction: outbound, SPI: 5f3a3239, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 1930 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 1563 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha-256, Encryption: aes-256-cbc
Anti-replay service: counter-based enabled, Replay window size: 64
Multi-sa FC Name: default
Direction: inbound, SPI: 5d227e19, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 1930 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 1551 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha-256, Encryption: aes-256-cbc
Anti-replay service: counter-based enabled, Replay window size: 64
Multi-sa FC Name: best-effort
Direction: outbound, SPI: 5490da, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 1930 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 1551 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha-256, Encryption: aes-256-cbc
Anti-replay service: counter-based enabled, Replay window size: 64
...Junos OS Release 18.2R1 시작하여 CLI 클래스 이름을 포함한 모든 show security ipsec security-associations index index-number detail 자식 SA 세부 정보가 표시됩니다.
show security ipsec sa
user@host> show security ipsec sa Total active tunnels: 2 ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway >67108885 ESP:aes-gcm-256/None fdef4dab 2918/ unlim - root 500 2001:db8:3000::2 >67108885 ESP:aes-gcm-256/None e785dadc 2918/ unlim - root 500 2001:db8:3000::2 >67108887 ESP:aes-gcm-256/None 34a787af 2971/ unlim - root 500 2001:db8:5000::2 >67108887 ESP:aes-gcm-256/None cf57007f 2971/ unlim - root 500 2001:db8:5000::2
show security ipsec sa detail
user@host> show security ipsec sa detail
ID: 500201 Virtual-system: root, VPN Name: IPSEC_VPN
Local Gateway: 2.0.0.1, Remote Gateway: 2.0.0.2
Local Identity: ipv4(0.0.0.0-255.255.255.255)
Remote Identity: ipv4(0.0.0.0-255.255.255.255)
Version: IKEv1
DF-bit: clear, Copy-Outer-DSCP Disabled, Bind-interface: st0.1, Policy-name: IPSEC_POL
Port: 500, Nego#: 0, Fail#: 0, Def-Del#: 0 Flag: 0
Multi-sa, Configured SAs# 0, Negotiated SAs#: 0
Location: FPC 0, PIC 1, KMD-Instance 0
Anchorship: Thread 1
Distribution-Profile: default-profile
Direction: inbound, SPI: 0x0a25c960, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 91 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 44 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: 3des-cbc
Anti-replay service: counter-based enabled, Replay window size: 64
tunnel-establishment: establish-tunnels-responder-only-no-rekey
Direction: outbound, SPI: 0x43e34ad3, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 91 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 44 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: 3des-cbc
Anti-replay service: counter-based enabled, Replay window size: 64
tunnel-establishment: establish-tunnels-responder-only-no-rekey
...Junos OS Release 19.1R1 시작하면 CLI 구성된 옵션을 tunnel-establishmentshow security ipsec sa detailipsec vpn establish-tunnels 표시합니다.
show security ipsec security-association
user@host>show security ipsec security-association Total active tunnels: 1 Total IPsec sas: 1 ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway <500006 ESP:aes-gcm-128/aes128-gcm 0x782b233c 1432/ unlim - root 500 2.0.0.2
show security ipsec security-associations brief
user@host> show security ipsec security-associations brief Total active tunnels: 2 Total Ipsec sas: 18 ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway <131073 ESP:aes256/sha256 89e5098 1569/ unlim - root 500 5.0.0.1 >131073 ESP:aes256/sha256 fcee9d54 1569/ unlim - root 500 5.0.0.1 <131073 ESP:aes256/sha256 f3117676 1609/ unlim - root 500 5.0.0.1 >131073 ESP:aes256/sha256 6050109f 1609/ unlim - root 500 5.0.0.1 <131073 ESP:aes256/sha256 e01f54b1 1613/ unlim - root 500 5.0.0.1 >131073 ESP:aes256/sha256 29a05dd6 1613/ unlim - root 500 5.0.0.1 <131073 ESP:aes256/sha256 606c90f6 1616/ unlim - root 500 5.0.0.1 >131073 ESP:aes256/sha256 9b5b059d 1616/ unlim - root 500 5.0.0.1 <131073 ESP:aes256/sha256 b8116d6d 1619/ unlim - root 500 5.0.0.1 >131073 ESP:aes256/sha256 b7ed6bfd 1619/ unlim - root 500 5.0.0.1 <131073 ESP:aes256/sha256 4f5ce754 1619/ unlim - root 500 5.0.0.1 >131073 ESP:aes256/sha256 af8984b6 1619/ unlim - root 500 5.0.0.1 ...
show security ipsec security-associations detail
user@host> show security ipsec security-associations detail
ID: 500009 Virtual-system: root, VPN Name: IPSEC_VPN
Local Gateway: 2.0.0.2, Remote Gateway: 2.0.0.1
Local Identity: ipv4(0.0.0.0-255.255.255.255)
Remote Identity: ipv4(0.0.0.0-255.255.255.255)
Version: IKEv1
PFS group: DH-group-14
DF-bit: clear, Copy-Outer-DSCP Disabled, Bind-interface: st0.1, Policy-name: IPSEC_POL
Port: 500, Nego#: 0, Fail#: 0, Def-Del#: 0 Flag: 0
Multi-sa, Configured SAs# 0, Negotiated SAs#: 0
Location: FPC 0, PIC 0, KMD-Instance 0
Anchorship: Thread 0
Distribution-Profile: default-profile
IKE SA Index: 2068
Direction: inbound, SPI: 0xba7bb1f2, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 146 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 101 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: des-cbc
Anti-replay service: counter-based enabled, Replay window size: 64
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-on-traffic
Direction: outbound, SPI: 0x41650a1b, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 146 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 101 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha1-96, Encryption: des-cbc
Anti-replay service: counter-based enabled, Replay window size: 64
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-on-trafficshow security ipsec security-associations family inet6
user@host> show security ipsec security-associations family inet6
Virtual-system: root
Local Gateway: 2001:db8:1212::1111, Remote Gateway: 2001:db8:1212::1112
Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
DF-bit: clear
Direction: inbound, SPI: 14caf1d9, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 3440 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 2813 seconds
Mode: tunnel, Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha-256, Encryption: aes256-cbc
Anti-replay service: counter-based enabled, Replay window size: 64
Direction: outbound, SPI: 9a4db486, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 3440 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 2813 seconds
Mode: tunnel, Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha-256, Encryption: aes256-cbc
Anti-replay service: counter-based enabled, Replay window size: 64 show security ipsec security-associations fpc 6 pic 1 kmd-instance all (SRX Series Devices)
user@host> show security ipsec security-associations fpc 6 pic 1 kmd-instance all Total active tunnels: 1 ID Gateway Port Algorithm SPI Life:sec/kb Mon vsys <2 192.168.1.2 500 ESP:aes256/sha256 67a7d25d 28280/unlim - 0 >2 192.168.1.2 500 ESP:aes256/sha256 a23cbcdc 28280/unlim - 0
show security ipsec security-associations detail (ADVPN Suggester, Static Tunnel)
user@host> show security ipsec security-associations detail ID: 70516737 Virtual-system: root, VPN Name: ZTH_HUB_VPN Local Gateway: 192.168.1.1, Remote Gateway: 192.168.1.2 Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Version: IKEv2 DF-bit: clear Bind-interface: st0.1 Port: 500, Nego#: 5, Fail#: 0, Def-Del#: 0 Flag: 0x608a29 Tunnel events: Tue Nov 03 2015 01:24:27 -0800: IPSec SA negotiation successfully completed (1 times) Tue Nov 03 2015 01:24:27 -0800: IKE SA negotiation successfully completed (4 times) Tue Nov 03 2015 01:23:38 -0800: User cleared IPSec SA from CLI (1 times) Tue Nov 03 2015 01:21:32 -0800: IPSec SA negotiation successfully completed (1 times) Tue Nov 03 2015 01:21:31 -0800: IPSec SA delete payload received from peer, corresponding IPSec SAs cleared (1 times) Tue Nov 03 2015 01:21:27 -0800: IPSec SA negotiation successfully completed (1 times) Tue Nov 03 2015 01:21:13 -0800: Tunnel configuration changed. Corresponding IKE/IPSec SAs are deleted (1 times) Tue Nov 03 2015 01:19:27 -0800: IPSec SA negotiation successfully completed (1 times) Tue Nov 03 2015 01:19:27 -0800: Tunnel is ready. Waiting for trigger event or peer to trigger negotiation (1 times) Location: FPC 0, PIC 3, KMD-Instance 2 Direction: inbound, SPI: 43de5d65, AUX-SPI: 0 Hard lifetime: Expires in 1335 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 996 seconds Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-sha-256, Encryption: aes256-cbc (256 bits) Anti-replay service: counter-based enabled , Replay window size: 64 Location: FPC 0, PIC 3, KMD-Instance 2 Direction: outbound, SPI: 5b6e157c, AUX-SPI: 0 Hard lifetime: Expires in 1335 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 996 seconds Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-sha-256, Encryption: aes256-cbc (256 bits) Anti-replay service: counter-based enabled , Replay window size: 64
show security ipsec security-associations detail (ADVPN Partner, Static Tunnel)
user@host> show security ipsec security-associations detail ID: 67108872 Virtual-system: root, VPN Name: ZTH_SPOKE_VPN Local Gateway: 192.168.1.2, Remote Gateway: 192.168.1.1 Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Version: IKEv2 DF-bit: clear, Bind-interface: st0.1 Port: 500, Nego#: 0, Fail#: 0, Def-Del#: 0 Flag: 0x8608a29 Tunnel events: Tue Nov 03 2015 01:24:26 -0800: IPSec SA negotiation successfully completed (1 times) Tue Nov 03 2015 01:24:26 -0800: IKE SA negotiation successfully completed (4 times) Tue Nov 03 2015 01:23:37 -0800: IPSec SA delete payload received from peer, corresponding IPSec SAs cleared (1 times) Tue Nov 03 2015 01:21:31 -0800: IPSec SA negotiation successfully completed (1 times) Tue Nov 03 2015 01:21:31 -0800: Tunnel is ready. Waiting for trigger event or peer to trigger negotiation (1 times) Tue Nov 03 2015 01:18:26 -0800: Key pair not found for configured local certificate. Negotiation failed (1 times) Tue Nov 03 2015 01:18:13 -0800: CA certificate for configured local certificate not found. Negotiation not initiated/successful (1 times) Direction: inbound, SPI: 5b6e157c, AUX-SPI: 0 Hard lifetime: Expires in 941 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 556 seconds Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-sha-256, Encryption: aes256-cbc (256 bits) Anti-replay service: counter-based enabled, Replay window size: 64 Direction: outbound, SPI: 43de5d65, AUX-SPI: 0 Hard lifetime: Expires in 941 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 556 seconds Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-sha-256, Encryption: aes256-cbc (256 bits) Anti-replay service: counter-based enabled, Replay window size: 64
show security ipsec security-associations sa-type shortcut (ADVPN)
user@host> show security ipsec security-associations sa-type shortcut Total active tunnels: 1 ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway <268173318 ESP:aes256/sha256 6f164ee0 3580/ unlim - root 500 192.168.0.111 >268173318 ESP:aes256/sha256 e6f29cb0 3580/ unlim - root 500 192.168.0.111
show security ipsec security-associations sa-type shortcut detail (ADVPN)
user@host> show security ipsec security-associations sa-type shortcut detail
node0:
--------------------------------------------------------------------------
ID: 67108874 Virtual-system: root, VPN Name: ZTH_SPOKE_VPN
Local Gateway: 192.168.1.2, Remote Gateway: 192.168.1.2
Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
Auto Discovery VPN:
Type: Shortcut, Shortcut Role: Initiator
Version: IKEv2
DF-bit: clear, Bind-interface: st0.1
Port: 4500, Nego#: 0, Fail#: 0, Def-Del#: 0 Flag: 0x40608a29
Tunnel events:
Tue Nov 03 2015 01:47:26 -0800: IPSec SA negotiation successfully completed (1 times)
Tue Nov 03 2015 01:47:26 -0800: Tunnel is ready. Waiting for trigger event or peer to trigger negotiation (1 times)
Tue Nov 03 2015 01:47:26 -0800: IKE SA negotiation successfully completed (1 times)
Direction: inbound, SPI: b7a5518, AUX-SPI: 0
Hard lifetime: Expires in 1766 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 1381 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha-256, Encryption: aes256-cbc (256 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
Direction: outbound, SPI: b7e0268, AUX-SPI: 0
Hard lifetime: Expires in 1766 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 1381 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha-256, Encryption: aes256-cbc (256 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
show security ipsec security-associations family inet detail
user@host> show security ipsec security-associations family inet detail ID: 131073 Virtual-system: root, VPN Name: ike-vpn Local Gateway: 192.168.1.1, Remote Gateway: 192.168.1.2 Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0) Version: IKEv1 DF-bit: clear , Copy-Outer-DSCP Enabled Bind-interface: st0.99 Port: 500, Nego#: 116, Fail#: 0, Def-Del#: 0 Flag: 0x600a29 Tunnel events: Fri Oct 30 2015 15:47:21 -0700: IPSec SA rekey successfully completed (115 times) Fri Oct 30 2015 11:38:35 -0700: IKE SA negotiation successfully completed (12 times) Mon Oct 26 2015 16:41:07 -0700: IPSec SA negotiation successfully completed (1 times) Mon Oct 26 2015 16:40:56 -0700: Tunnel is ready. Waiting for trigger event or peer to trigger negotiation (1 times) Mon Oct 26 2015 16:40:56 -0700: External interface's address received. Information updated (1 times) Location: FPC 0, PIC 1, KMD-Instance 1 Direction: inbound, SPI: 81b9fc17, AUX-SPI: 0 Hard lifetime: Expires in 1713 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 1090 seconds Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-sha-256, Encryption: aes256-cbc (256 bits) Anti-replay service: counter-based enabled , Replay window size: 64 Location: FPC 0, PIC 1, KMD-Instance 1 Direction: outbound, SPI: 727f629d, AUX-SPI: 0 Hard lifetime: Expires in 1713 seconds Lifesize Remaining: Unlimited Soft lifetime: Expires in 1090 seconds Mode: Tunnel(0 0), Type: dynamic, State: installed Protocol: ESP, Authentication: hmac-sha-256, Encryption: aes256-cbc (256 bits) Anti-replay service: counter-based enabled , Replay window size: 64
show security ipsec security-associations detail (SRX4600)
user@host> show security ipsec security-associations detail
ID: 131073 Virtual-system: root, VPN Name: ike-vpn
Local Gateway: 62.1.1.3, Remote Gateway: 62.1.1.2
Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
Version: IKEv2
DF-bit: clear, Bind-interface: st0.0
Port: 500, Nego#: 25, Fail#: 0, Def-Del#: 0 Flag: 0x600a29
Tunnel events:
Fri Jan 12 2007 07:50:10 -0800: IPSec SA rekey successfully completed (23 times)
Location: FPC 0, PIC 0, KMD-Instance 0
Anchorship: Thread 6
Direction: inbound, SPI: 812c9c01, AUX-SPI: 0
Hard lifetime: Expires in 2224 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 1598 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha-256, Encryption: aes256-cbc (256 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
Location: FPC 0, PIC 0, KMD-Instance 0
Anchorship: Thread 7
Direction: outbound, SPI: c4de0972, AUX-SPI: 0
Hard lifetime: Expires in 2224 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 1598 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha-256, Encryption: aes256-cbc (256 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
show security ipsec security-associations detail (SRX5400, SRX5600, SRX5800)
터널 내의 모든 IPsec SA에 상응하는 새로운 출력 필드가 각 IPsec SA 정보 아래에 IKE SA Index 표시됩니다.
user@host> show security ipsec security-associations detail
ID: 500005 Virtual-system: root, VPN Name: 85BX5-OAM
Local Gateway: 10.217.0.4, Remote Gateway: 10.200.254.118
Traffic Selector Name: TS_DEFAULT
Local Identity: ipv4(0.0.0.0-255.255.255.255)
Remote Identity: ipv4(10.181.235.224-10.181.235.224)
Version: IKEv2
PFS group: N/A
DF-bit: clear, Copy-Outer-DSCP Disabled, Bind-interface: st0.0, Policy-name: MACRO-IPSEC-POL
Port: 500, Nego#: 0, Fail#: 0, Def-Del#: 0 Flag: 0
Multi-sa, Configured SAs# 0, Negotiated SAs#: 0
Location: FPC 7, PIC 1, KMD-Instance 0
Anchorship: Thread 15
Distribution-Profile: default-profile
Direction: inbound, SPI: 0xe2eb3838, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 644 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 159 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: aes128-gcm, Encryption: aes-gcm (128 bits)
Anti-replay service: disabled
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-responder-only
IKE SA Index: 22
Direction: outbound, SPI: 0x4f7c3101, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 644 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 159 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: aes128-gcm, Encryption: aes-gcm (128 bits)
Anti-replay service: disabled
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-responder-only
IKE SA Index: 22
Direction: inbound, SPI: 0x30b6d66f, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 1771 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 1391 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: aes128-gcm, Encryption: aes-gcm (128 bits)
Anti-replay service: disabled
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-responder-only
IKE SA Index: 40
Direction: outbound, SPI: 0xd2db4108, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 1771 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 1391 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: aes128-gcm, Encryption: aes-gcm (128 bits)
Anti-replay service: disabled
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-responder-only
IKE SA Index: 40
show security ipsec security-associations ha-link-encryption (SRX5400, SRX5600, SRX5800)
Junos OS Release 20.4R1 고가용성(고가용성(HA)) 기능을 구성할 때 이 show 명령을 사용하여 interchassis 링크 터널 세부 정보만 볼 수 있습니다.
user@host> show security ipsec security-associations ha-link-encryption Total active tunnels: 1 Total IPsec sas: 91 ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway <495001 ESP:aes-gcm-256/aes256-gcm 0x0047658d 298/ unlim - root 500 23.0.0.2 >495001 ESP:aes-gcm-256/aes256-gcm 0x0046c5cd 298/ unlim - root 500 23.0.0.2 <495001 ESP:aes-gcm-256/aes256-gcm 0x0447658d 298/ unlim - root 500 23.0.0.2 >495001 ESP:aes-gcm-256/aes256-gcm 0x0446c5cd 298/ unlim - root 500 23.0.0.2 <495001 ESP:aes-gcm-256/aes256-gcm 0x0847658d 298/ unlim - root 500 23.0.0.2 >495001 ESP:aes-gcm-256/aes256-gcm 0x0846c5cd 298/ unlim - root 500 23.0.0.2 <495001 ESP:aes-gcm-256/aes256-gcm 0x0c47658d 298/ unlim - root 500 23.0.0.2 >495001 ESP:aes-gcm-256/aes256-gcm 0x0c46c5cd 298/ unlim - root 500 23.0.0.2 <495001 ESP:aes-gcm-256/aes256-gcm 0x1047658d 298/ unlim - root 500 23.0.0.2 >495001 ESP:aes-gcm-256/aes256-gcm 0x1046c5cd 298/ unlim - root 500 23.0.0.2 <495001 ESP:aes-gcm-256/aes256-gcm 0x1447658d 298/ unlim - root 500 23.0.0.2 >495001 ESP:aes-gcm-256/aes256-gcm 0x1446c5cd 298/ unlim - root 500 23.0.0.2 <495001 ESP:aes-gcm-256/aes256-gcm 0x1847658d 298/ unlim - root 500 23.0.0.2 >495001 ESP:aes-gcm-256/aes256-gcm 0x1846c5cd 298/ unlim - root 500 23.0.0.2 <495001 ESP:aes-gcm-256/aes256-gcm 0x1c47658d 298/ unlim - root 500 23.0.0.2 >495001 ESP:aes-gcm-256/aes256-gcm 0x1c46c5cd 298/ unlim - root 500 23.0.0.2 <495001 ESP:aes-gcm-256/aes256-gcm 0x2047658d 298/ unlim - root 500 23.0.0.2 >495001 ESP:aes-gcm-256/aes256-gcm 0x2046c5cd 298/ unlim - root 500 23.0.0.2 <495001 ESP:aes-gcm-256/aes256-gcm 0x2447658d 298/ unlim - root 500 23.0.0.2 >495001 ESP:aes-gcm-256/aes256-gcm 0x2446c5cd 298/ unlim - root 500 23.0.0.2 ...
show security ipsec sa detail ha-link-encryption (SRX5400, SRX5600, SRX5800)
Junos OS Release 20.4R1 고가용성(고가용성(HA)) 기능을 구성할 때 이 show 명령을 사용하여 interchassis 링크 터널 세부 정보만 볼 수 있습니다. Interchassis 링크 암호화 터널을 위해 생성된 다중 SAS를 표시합니다.
user@host> show security ipsec sa detail ha-link-encryption
ID: 495001 Virtual-system: root, VPN Name: L3HA_IPSEC_VPN
Local Gateway: 23.0.0.1, Remote Gateway: 23.0.0.2
Traffic Selector Name: __L3HA_IPSEC_VPN__multi_node__
Local Identity: ipv4(180.100.1.1-180.100.1.1)
Remote Identity: ipv4(180.100.1.2-180.100.1.2)
Version: IKEv2
PFS group: N/A
DF-bit: clear, Copy-Outer-DSCP Disabled, Bind-interface: st0.16000, Policy-name: L3HA_IPSEC_POL
Port: 500, Nego#: 0, Fail#: 0, Def-Del#: 0 Flag: 0
Multi-sa, Configured SAs# 0, Negotiated SAs#: 0
HA Link Encryption Mode: Multi-Node
Location: FPC -, PIC -, KMD-Instance -
Anchorship: Thread -
Distribution-Profile: default-profile
Direction: inbound, SPI: 0x00439cf8, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 294 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 219 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: aes256-gcm, Encryption: aes-gcm (256 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-immediately
Location: FPC 1, PIC 0, KMD-Instance 0
Anchorship: Thread 15
IKE SA Index: 4294966297
Direction: outbound, SPI: 0x004cfceb, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 294 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 219 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: aes256-gcm, Encryption: aes-gcm (256 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-immediately
Location: FPC 1, PIC 0, KMD-Instance 0
Anchorship: Thread 15
IKE SA Index: 4294966297
Direction: inbound, SPI: 0x04439cf8, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 294 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 219 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: aes256-gcm, Encryption: aes-gcm (256 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-immediately
Location: FPC 1, PIC 0, KMD-Instance 0
Anchorship: Thread 16
IKE SA Index: 4294966297
Direction: outbound, SPI: 0x044cfceb, AUX-SPI: 0
, VPN Monitoring: -
...show security ipsec security-associations detail (SRX Series devices and MX Series Routers)
릴리스 20.Junos OS 20.4R2, 21.1R1 이상에서 명령을 실행하여 VPN에 대한 트래픽 선택기 유형을 볼 수 show security ipsec security-associations detail 있습니다.
user@host> show security ipsec security-associations detail
ID: 500024 Virtual-system: root, VPN Name: S2S_VPN2
Local Gateway: 7.0.0.2, Remote Gateway: 2.0.0.1
Traffic Selector Name: ts1
Local Identity: ipv4(20.20.20.0-20.20.20.255)
Remote Identity: ipv4(10.10.10.0-10.10.10.255)
TS Type: traffic-selector
Version: IKEv2
PFS group: DH-group-14
DF-bit: clear, Copy-Outer-DSCP Disabled, Bind-interface: st0.2, Policy-name: IPSEC_POL
Port: 500, Nego#: 0, Fail#: 0, Def-Del#: 0 Flag: 0
Multi-sa, Configured SAs# 0, Negotiated SAs#: 0
Tunnel events:
Tue Jan 19 2021 04:43:49: IPsec SA negotiation succeeds (1 times)
Location: FPC 0, PIC 0, KMD-Instance 0
Anchorship: Thread 1
Distribution-Profile: default-profile
Direction: inbound, SPI: 0xf8642fae, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 1798 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 1397 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha256-128, Encryption: aes-cbc (256 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-immediately
IKE SA Index: 17
Direction: outbound, SPI: 0xb2a26969, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 1798 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 1397 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha256-128, Encryption: aes-cbc (256 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-immediately
IKE SA Index: 17
ID: 500025 Virtual-system: root, VPN Name: S2S_VPN1
Local Gateway: 7.0.0.1, Remote Gateway: 2.0.0.1
Local Identity: ipv4(0.0.0.0-255.255.255.255)
Remote Identity: ipv4(0.0.0.0-255.255.255.255)
TS Type: proxy-id
Version: IKEv2
PFS group: DH-group-14
DF-bit: clear, Copy-Outer-DSCP Disabled, Bind-interface: st0.1, Policy-name: IPSEC_POL
Port: 500, Nego#: 0, Fail#: 0, Def-Del#: 0 Flag: 0
Multi-sa, Configured SAs# 0, Negotiated SAs#: 0
Tunnel events:
Tue Jan 19 2021 04:44:41: IPsec SA negotiation succeeds (1 times)
Location: FPC 0, PIC 0, KMD-Instance 0
Anchorship: Thread 1
Distribution-Profile: default-profile
Direction: inbound, SPI: 0xe293762a, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 1755 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 1339 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha256-128, Encryption: aes-cbc (256 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-immediately
IKE SA Index: 18
Direction: outbound, SPI: 0x7aef9d7f, AUX-SPI: 0
, VPN Monitoring: -
Hard lifetime: Expires in 1755 seconds
Lifesize Remaining: Unlimited
Soft lifetime: Expires in 1339 seconds
Mode: Tunnel(0 0), Type: dynamic, State: installed
Protocol: ESP, Authentication: hmac-sha256-128, Encryption: aes-cbc (256 bits)
Anti-replay service: counter-based enabled, Replay window size: 64
Extended-Sequence-Number: Disabled
tunnel-establishment: establish-tunnels-immediately
IKE SA Index: 18
show security ipsec security-associations detail (SRX Series devices)
Junos OS Release 21.1R1에서부터 IPsec SA에 대해 정의된 여러 용어에 대한 대상 포트 범위, 로컬 ID, 원격 ID, 프로토콜, 소스 포트 범위 등 트래픽 셀렉터 세부 정보를 볼 수 있습니다.
이전 Junos Releases에서 IP 주소 또는 netmask을 사용하여 정의된 기존 IP 범위를 사용하여 특정 SA를 위한 트래픽 선택을 수행했습니다. 릴리스 Junos OS 21.1R1 이후의 릴리스 21.1R1에서 를 사용하여 지정한 프로토콜을 통해 추가 트래픽이 protocol_name. 또한 소스 및 대상 포트 번호에 대해 저지연 및 높은 포트 범위를 지정합니다.
user@host> show security ipsec security-associations detail ID: 500075 Virtual-system: root, VPN Name: pkn-r0-r1-ipsec-vpn-1 Local Gateway: 1.1.1.1, Remote Gateway: 1.1.1.2 Traffic Selector Name: ts1 Local Identity: Protocol Port IP 17/UDP 100-200 198.51.101.0-198.51.101.255 6/TCP 250-300 198.51.102.0-198.51.102.255 Remote Identity: Protocol Port IP 17/UDP 150-200 80.0.0.1-80.0.0.1 6/TCP 250-300 80.0.1.1-80.0.1.1 Version: IKEv2 DF-bit: clear, Copy-Outer-DSCP Disabled, Bind-interface: st0.0, Policy-name: pkn-r0-r1-ipsec-policy Port: 500, Nego#: 0, Fail#: 0, Def-Del#: 0 Flag: 0 Multi-sa, Configured SAs# 0, Negotiated SAs#: 0 Location: FPC 0, PIC 0, KMD-Instance 0 Anchorship: Thread 1 Distribution-Profile: default-profile Direction: inbound, SPI: ……… Direction: outbound, SPI: …………
Release Information
릴리스 8.5에 Junos OS 명령어가 도입되었습니다. Junos OS family 릴리스 11.1에 추가된 옵션 지원.
릴리스 vpn-name 날짜에 추가된 Junos OS 지원 11.4R3. 릴리스 날짜에 추가된 옵션 및 트래픽 셀러 Junos OS traffic-selector 지원 12.1X46-D10.
새로운 릴리스 릴리스에서 추가된 ADVPN(Auto Discovery VPN) Junos OS 지원 12.3X48-D10.
Junos OS Release 버전에 추가된 IPsec 데이터 경로 검증 15.1X49-D70.
Junos OS Release Junos OS 추가된 스레드 앵커 17.4R1.
명령 출력에는 Junos OS 릴리스 18.2R2 보안 연결(SAS)에 대한 스레드 앵커십 정보가 show security ipsec security-assocations detail 포함됩니다.
Junos OS Release 19.4R1 시작으로 show 명령어에 있는 보안 연결(SAS)을 표시하는 새로운 프로세스에서 CLI fc-name 옵션(COS Forward Class 이름)을 iked 해제했습니다. show security ipsec sa
릴리스 ha-link-encryption 날짜에 추가된 Junos OS 지원 20.4R1.