IKE SA Index

Index number of an SA.

This number is an internally generated number you can use to display information about a single SA.

State

State of the IKE security associations:

• DOWN—SA has not been negotiated with the peer.
• UP—SA has been negotiated with the peer.

–

Responder cookie

Random number generated by the remote node and sent back to the initiator as a verification that the packets were received.

A cookie is aimed at protecting the computing resources from attack without spending excessive CPU resources to determine the cookie’s authenticity.

IKE SA Index

Index number of an SA.

This number is an internally generated number you can use to display information about a single SA.

State

State of the IKE security associations:

• DOWN—SA has not been negotiated with the peer.
• UP—SA has been negotiated with the peer.

–

Responder cookie

Random number generated by the remote node and sent back to the initiator as a verification that the packets were received.

A cookie is aimed at protecting the computing resources from attack without spending excessive CPU resources to determine the cookie’s authenticity.

Authentication Method

Path chosen for authentication.

–

Remote

Address of the remote peer.

–

Algorithm

IKE algorithms used to encrypt and secure exchanges between the peers during the IPsec Phase 2 process:

• Authentication—Type of authentication algorithm used.
  • sha1—Secure Hash Algorithm 1 (SHA-1) authentication.
  • md5—MD5 authentication.
• Encryption—Type of encryption algorithm used.
  • aes-256-cbc—Advanced Encryption Standard (AES) 256-bit encryption.
  • aes-192-cbc—Advanced Encryption Standard (AES) 192-bit encryption.
  • aes-128-cbc—Advanced Encryption Standard (AES) 128-bit encryption.
  • 3des-cbc—3 Data Encryption Standard (DES) encryption.
  • des-cbc—Data Encryption Standard (DES) encryption.
  • Pseudo random function—Cryptographically secure pseudorandom function family.

–

IPsec security associations

• number created—The number of SAs created.
• number deleted—The number of SAs deleted.

–

Message ID

Message identifier.

–

Remote identity

IPv4 address of the destination peer gateway.

–

Remote Address

IP address of the destination peer with which the local peer communicates.

–

Initiator Cookie

Random number, called a cookie, which is sent to the remote node when the IKE negotiation is triggered.

–

Mode

Negotiation method agreed upon by the two IPsec endpoints, or peers, used to exchange information. Each exchange type determines the number of messages and the payload types that are contained in each message. The modes, or exchange types, are:

• Main—The exchange is done with six messages. This mode, or exchange type, encrypts the payload, protecting the identity of the neighbor. The authentication method used is displayed: preshared keys or certificate.
• Aggressive—The exchange is done with three messages. This mode, or exchange type, does not encrypt the payload, leaving the identity of the neighbor unprotected.

–

By bytes

Provides total number of bytes encrypted and decrypted by the local system across the IPsec tunnel.

–

IPsec Statistics

Provides details of the IPsec statistics.

–

Gateway/Port

IP address of the remote gateway/port.

–

SPI

Security parameter index (SPI) identifier. An SA is uniquely identified by an SPI. Each entry includes the name of the VPN, the remote gateway address, the SPIs for each direction, the encryption and authentication algorithms, and keys. The peer gateways each have two SAs, one resulting from each of the two phases of negotiation: Phase I and Phase II.

–

Monitoring

Specifies if VPN-Liveliness Monitoring has been enabled/disabled. Enabled - ' U ', Disabled- '—'

–

Total configured SA

Total number of IPsec security associations (SAs) configured on the device.

–

Gateway

IP address of the remote gateway.

–

Algorithm

Cryptography used to secure exchanges between peers during the IKE Phase 2 negotiations:

• An authentication algorithm used to authenticate exchanges between the peers. Options are hmac-md5-95 or hmac-sha1-96.
• An encryption algorithm used to encrypt data traffic. Options are 3des-cbc, aes-128-cbc, aes-192-cbc, aes-256-cbc, or des-cbc.

–

Life: sec/kb

The lifetime of the SA, after which it expires, expressed either in seconds or kilobytes.

–

Vsys

The root system.

–

ESP Statistics

Encapsulation Security Protocol (ESP) statistics include the following:

• Encrypted bytes—Total number of bytes encrypted by the local system across the IPsec tunnel.
• Decrypted bytes—Total number of bytes decrypted by the local system across the IPsec tunnel.
• Encrypted packets—Total number of packets encrypted by the local system across the IPsec tunnel.
• Decrypted packets—Total number of packets decrypted by the local system across the IPsec tunnel.

–

Errors

Errors include the following

• AH authentication failures—Total number of authentication header (AH) failures. An AH failure occurs when there is a mismatch of the authentication header in a packet transmitted across an IPsec tunnel.
• Replay errors—Total number of replay errors. A replay error is generated when a duplicate packet is received within the replay window.
• ESP authentication failures—Total number of Encapsulation Security Payload (ESP) failures. An ESP failure occurs when there is an authentication mismatch in ESP packets.
• ESP decryption failures—Total number of ESP decryption errors.
• Bad headers—Total number of invalid headers detected.
• Bad trailers—Total number of invalid trailers detected.

–

Virtual System

The root system.

–

Remote Gateway

Gateway address of the remote system.

–

Remote identity

IPv4 address of the destination peer gateway.

–

Policy name

Name of the applicable policy.

–

SPI

Security parameter index (SPI) identifier. An SA is uniquely identified by an SPI. Each entry includes the name of the VPN, the remote gateway address, the SPIs for each direction, the encryption and authentication algorithms, and keys. The peer gateways each have two SAs, one resulting from each of the two phases of negotiation: Phase 1 and Phase 2.

–

Type

Type of the security association, either manual or dynamic.

• manual—Security parameters require no negotiation. They are static and are configured by the user.
• dynamic—Security parameters are negotiated by the IKE protocol. Dynamic security associations are not supported in transport mode.

–

Protocol

Protocol supported:

• Transport mode supports Encapsulation Security Protocol (ESP) and Authentication Header (AH).
• Tunnel mode supports ESP and AH.
  • Authentication—Type of authentication used.
  • Encryption—Type of encryption used.

–

Soft Lifetime

The soft lifetime informs the IPsec key management system that the SA is about to expire.

• Expires in seconds—Number of seconds left until the SA expires.
• Expires in kilobytes—Number of kilobytes left until the SA expires.

Each lifetime of a security association has two display options, hard and soft, one of which must be present for a dynamic security association. This allows the key management system to negotiate a new SA before the hard lifetime expires.

Anti Replay Service

State of the service that prevents packets from being replayed. It can be Enabled or Disabled.

–