show services ipsec-vpn ipsec security-associations

Service set

Name of the service set for which the IPsec security associations are defined. If appropriate, includes the outside service interface VRF name.

Rule

Name of the rule set applied to the security association.

Term

Name of the IPsec term applied to the security association.

Tunnel index

Numeric identifier of the specific IPsec tunnel for the security association.

Local gateway

Gateway address of the local system.

Remote gateway

Gateway address of the remote system.

IPsec inside interface

Name of the logical interface hosting the IPsec tunnels.

Tunnel MTU

MTU of the IPsec tunnel.

Total uptime

Total amount of time that an IPsec tunnel has been up across security association rekeys.

Local identity

Protocol, address or prefix, and port number of the local entity of the IPsec association. The format is id-type-name (proto-name:port-number,[0..id-data-len] = iddata-presentation). The protocol is always displayed as any because it is not user-configurable in the IPsec rule. Similarly, the port number field in the output is always displayed as 0 because it is not user-configurable in the IPsec rule. The value of the id-data-len parameter can be one of the following, depending on the address configured in the IPsec rule:

• For an IPv4 address, the length is 4 and the value displayed is 3.

• For a subnet mask of an IPv4 address, the length is 8 and the value displayed is 7.

• For a range of IPv4 addresses, the length is 8 and the value displayed is 7.

• For an IPv6 address prefix, the length is 16 and the value displayed is 15.

• For a subnet mask of an IPv6 address prefix, the length is 32 and the value displayed is 31.

• For a range of IPv6 address prefixes, the length is 32 and the value displayed is 31.

The value of the id-data-presentation field denotes the IPv4 address or IPv6 prefix details. If the fully qualified domain name (FQDN) is specified instead of the address for the local peer of the IPsec association, it is displayed instead of the address details.

Remote identity

Protocol, address or prefix, and port number of the remote entity of the IPsec association. The format is id-type-name (proto-name:port-number,[0..id-data-len] = iddata-presentation). The protocol is always displayed as any because it is not user-configurable in the IPsec rule. Similarly, the port number field in the output is always displayed as 0 because it is not user-configurable in the IPsec rule. The value of the id-data-len parameter can be one of the following, depending on the address configured in the IPsec rule:

• For an IPv4 address, the length is 4 and the value displayed is 3.

• For a subnet mask of an IPv4 address, the length is 8 and the value displayed is 7.

• For a range of IPv4 addresses, the length is 8 and the value displayed is 7.

• For an IPv6 address prefix, the length is 16 and the value displayed is 15.

• For a subnet mask of an IPv6 address prefix, the length is 32 and the value displayed is 31.

• For a range of IPv6 address prefixes, the length is 32 and the value displayed is 31.

The value of the id-data-presentation field denotes the IPv4 address or IPv6 prefix details. If the fully qualified domain name (FQDN) is specified instead of the address for the remote peer of the IPsec association, it is displayed instead of the address details.

Primary remote gateway

IP address of the configured primary remote peer.

Backup remote gateway

IP address of the configured backup remote peer.

State

State of the primary or backup interface: Active, Offline, or Standby. Both ES PICs are initialized to Offline. For primary and backup peers, State can be Active or Standby. If both peers are in a state of Standby, no connection exists yet between the two peers.

Failover counter

Number of times a PIC switched between primary and backup interfaces, or the number of times the tunnel switched between the primary and remote peers since the software has been activated.

Direction

Direction of the security association: inbound or outbound.

SPI

Value of the security parameter index.

AUX-SPI

Value of the auxiliary security parameter index.

• When the value of Protocol is AH or ESP, AUX-SPI is always 0.

• When the value of Protocol is AH+ESP, AUX-SPI is always a positive integer.

Mode

Mode of the security association:

• transport—Protects single host-to-host protections.

• tunnel—Protects connections between security gateways.

Type

Type of security association:

• manual—Security parameters require no negotiation. They are static, and are configured by the user.

• dynamic—Security parameters are negotiated by the IKE protocol. Dynamic security associations are not supported in transport mode.

State

Status of the security association:

• Installed—The security association is installed in the security association database. (For transport mode security associations, the value of State must always be Installed.)

• Not installed—The security association is not installed in the security association database.

Protocol

Protocol supported:

• transport mode supports Encapsulation Security Protocol (ESP) or Authentication Header (AH).

• tunnel mode supports ESP or AH+ESP.

Authentication

Type of authentication used: hmac-md5-96, hmac-sha1-96, or none.

Encryption

Type of encryption algorithm used: can be 3des-cbc, aes-cbc (128 bits), aes-cbc (192 bits), aes-cbc (256 bits), aes-gcm (128 bits), aes-gcm(192 bits), aes-gcm (256 bits), des-cbc, or None.

Soft lifetime

Hard lifetime

Each lifetime of a security association has two display options, hard and soft, one of which must be present for a dynamic security association. The hard lifetime specifies the lifetime of the SA. The soft lifetime, which is derived from the hard lifetime, informs the IPsec key management system that the SA is about to expire. This information allows the key management system to negotiate a new SA before the hard lifetime expires.

• Expires in seconds seconds—Number of seconds left until the security association expires.

• Expires in kilobytes  kilobytes—Number of kilobytes left until the security association expires.

Anti-replay service

State of the service that prevents packets from being replayed: Enabled or Disabled.

SA lifetime

Configured hard lifetime (total lifetime), in seconds, for the security association.

Replay window size

Configured size, in packets, of the antireplay service window: 32 or 64. The antireplay window size protects the receiver against replay attacks by rejecting old or duplicate packets. If the replay window size is 0, antireplay service is disabled.

disable-natt

Configure to disable NAT-T functionality. By default the NAT-T is enabled.

nat-keepalive

Specify the interval at which NAT keepalive packets can be sent so that NAT translation continues.