close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

English

show security host-vpn security-associations

date_range 19-Nov-23

arrow_backward

arrow_forward

Syntax

content_copy zoom_out_map
show security host-vpn security-associations
<connection-name>

Description

Display the protection details about a specified security association or all security associations.

Options

connection-name

Specify for which connection the connection information is to be displayed. If no connection-name is specified, information for all security associations is displayed.

Additional Information

The Security Parameters Index (SPI) is an arbitrary value which is used (together with the destination IP address) to identify the security association of the receiving party. Each IPsec datagram has a special field for the SPI. All datagrams in the SA will use the same SPI value in this field.

Required Privilege Level

view

Output Fields

Table 1 describes the output fields for the how security host-vpn security-associations command. Output fields are listed in the approximate order in which they appear.

Table 1: show security host-vpn security-associations Output Fields
Field Name	Description
`IKE SA`	Name of the security association connection.
`ID`	Identifier of the security association.
`State`	State of the parent SA connection. Values include the following: `CREATED`—IKE SA just got created, but is not yet initiating or responding. `CONNECTING`—IKE SA gets initiated actively or passively. `DESTROYING`—IKE SA object gets destroyed. `ESTABLISHED`— IKE SA is fully established. `PASSIVE`—IKE SA is managed externally and does not process messages. `REKEYING`—IKE SA rekeying is in progress.
`(I:R)`	Initiator and responder cookie.
`local`	Local endpoint information and identities.
`remote`	Remote endpoint information and identities.
`crypto`	Negotiated encryption details in effect (one for each IKE SA and child SA).
`established`	How long ago the SA was established, and when it rekeys.
`Child SA`	Name of the child SA.
`State`	State of the child SA connection. Values include the following: `CREATED`—Child SA is just created, but is not yet installed. `DESTROYING`—Child SA object gets destroyed. `INSTALLED`— Child SA is installed and in use. `REKEYING`—Child SA rekeying is in progress.
`mode`	IPsec mode: (`transport \| tunnel`).
`in spi`	Inbound SPI values. Also, shows the number of bytes and packets encrypted.
`out spi`	Outbound SPI values. Also, shows the number of bytes and packets encrypted.
`local ts`	The local traffic selector (that is, what local traffic is protected).
`remote ts`	The remote traffic selector (that is, what remote traffic is protected).

Sample Output