Cisco Systems SM-ISM, SA-ISA specification

Chapter 4 Configuring the ISA and ISM

Verifying Configuration

Peer = 172.21.114.67

Extended IP access list 141

access-list 141 permit ip

source: addr = 172.21.114.123/0.0.0.0

dest: addr = 172.21.114.67/0.0.0.0 Current peer: 172.21.114.67

Security-association lifetime: 4608000 kilobytes/120 seconds

PFS (Y/N): N

Transform sets={t1,}

The following is sample output for the show crypto ipsec sa command:

Router# show crypto ipsec sa interface: Ethernet0

Crypto map tag: router-alice, local addr. 172.21.114.123

local ident (addr/mask/prot/port): (172.21.114.123/255.255.255.255/0/0)

remote ident (addr/mask/prot/port): (172.21.114.67/255.255.255.255/0/0)

current_peer: 172.21.114.67 PERMIT, flags={origin_is_acl,}

#pkts encaps: 10, #pkts encrypt: 10, #pkts digest 10

#pkts decaps: 10, #pkts decrypt: 10, #pkts verify 10 #send errors 10, #recv errors 0

local crypto endpt.: 172.21.114.123, remote crypto endpt.: 172.21.114.67 path mtu 1500, media mtu 1500

current outbound spi: 20890A6F inbound esp sas:

spi: 0x257A1039(628756537) transform: esp-des esp-md5-hmac, in use settings ={Tunnel,}

slot: 0, conn id: 26, crypto map: router-alice

sa timing: remaining key lifetime (k/sec): (4607999/90)

IV size: 8 bytes

replay detection support: Y inbound ah sas:

outbound esp sas:

spi: 0x20890A6F(545852015) transform: esp-des esp-md5-hmac, in use settings ={Tunnel,}

slot: 0, conn id: 27, crypto map: router-alice