close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

English

show services ipsec-vpn ipsec security-associations

date_range 19-Nov-23

arrow_backward

arrow_forward

Syntax

content_copy zoom_out_map
show services ipsec-vpn ipsec security-associations 
<brief | detail | extensive> 
<service-set service-set-name>

Description

(Adaptive services interface only) Display IPsec security associations for the specified service set. If no service set is specified, the security associations for all service sets are displayed.

Options

none	Display standard information about IPsec security associations for all service sets.
brief \| detail \| extensive	(Optional) Display the specified level of output.
service-set `service-set-name`	(Optional) Display information about a particular service set.

Required Privilege Level

view

Output Fields

Table 1 lists the output fields for the show services ipsec-vpn ipsec security-associations command. Output fields are listed in the approximate order in which they appear.

Table 1: show services ipsec-vpn ipsec security-associations Output Fields
Field Name	Field Description	Level of Output
`Service set`	Name of the service set for which the IPsec security associations are defined. If appropriate, includes the outside service interface VRF name.	All levels
`Rule`	Name of the rule set applied to the security association.	`detail extensive`
`Term`	Name of the IPsec term applied to the security association.	`detail extensive`
`Tunnel index`	Numeric identifier of the specific IPsec tunnel for the security association.	`detail extensive`
`Local gateway`	Gateway address of the local system.	All levels
`Remote gateway`	Gateway address of the remote system.	All levels
`IPsec inside interface`	Name of the logical interface hosting the IPsec tunnels.	All levels
`Tunnel MTU`	MTU of the IPsec tunnel.	All levels
`Total uptime`	Total amount of time that an IPsec tunnel has been up across security association rekeys.	`detail`
`Local identity`	Protocol, address or prefix, and port number of the local entity of the IPsec association. The format is `id-type-name (proto-name:port-number,[0..id-data-len] = iddata-presentation)`. The protocol is always displayed as any because it is not user-configurable in the IPsec rule. Similarly, the port number field in the output is always displayed as 0 because it is not user-configurable in the IPsec rule. The value of the `id-data-len` parameter can be one of the following, depending on the address configured in the IPsec rule: For an IPv4 address, the length is 4 and the value displayed is 3. For a subnet mask of an IPv4 address, the length is 8 and the value displayed is 7. For a range of IPv4 addresses, the length is 8 and the value displayed is 7. For an IPv6 address prefix, the length is 16 and the value displayed is 15. For a subnet mask of an IPv6 address prefix, the length is 32 and the value displayed is 31. For a range of IPv6 address prefixes, the length is 32 and the value displayed is 31. The value of the `id-data-presentation` field denotes the IPv4 address or IPv6 prefix details. If the fully qualified domain name (FQDN) is specified instead of the address for the local peer of the IPsec association, it is displayed instead of the address details.	All levels
`Remote identity`	Protocol, address or prefix, and port number of the remote entity of the IPsec association. The format is `id-type-name (proto-name:port-number,[0..id-data-len] = iddata-presentation)`. The protocol is always displayed as any because it is not user-configurable in the IPsec rule. Similarly, the port number field in the output is always displayed as 0 because it is not user-configurable in the IPsec rule. The value of the `id-data-len` parameter can be one of the following, depending on the address configured in the IPsec rule: For an IPv4 address, the length is 4 and the value displayed is 3. For a subnet mask of an IPv4 address, the length is 8 and the value displayed is 7. For a range of IPv4 addresses, the length is 8 and the value displayed is 7. For an IPv6 address prefix, the length is 16 and the value displayed is 15. For a subnet mask of an IPv6 address prefix, the length is 32 and the value displayed is 31. For a range of IPv6 address prefixes, the length is 32 and the value displayed is 31. The value of the `id-data-presentation` field denotes the IPv4 address or IPv6 prefix details. If the fully qualified domain name (FQDN) is specified instead of the address for the remote peer of the IPsec association, it is displayed instead of the address details.	All levels
`Primary remote gateway`	IP address of the configured primary remote peer.	All levels
`Backup remote gateway`	IP address of the configured backup remote peer.	All levels
`State`	State of the primary or backup interface: `Active`, `Offline`, or `Standby`. Both ES PICs are initialized to `Offline`. For primary and backup peers, `State` can be `Active` or `Standby`. If both peers are in a state of `Standby`, no connection exists yet between the two peers.	All levels
`Failover counter`	Number of times a PIC switched between primary and backup interfaces, or the number of times the tunnel switched between the primary and remote peers since the software has been activated.	All levels
`Direction`	Direction of the security association: `inbound` or `outbound`.	All levels
`SPI`	Value of the security parameter index.	All levels
`AUX-SPI`	Value of the auxiliary security parameter index. When the value of `Protocol` is `AH` or `ESP`, `AUX-SPI` is always `0`. When the value of `Protocol` is `AH+ESP`, `AUX-SPI` is always a positive integer.	All levels
`Mode`	Mode of the security association: `transport`—Protects single host-to-host protections. `tunnel`—Protects connections between security gateways.	`detail extensive`
`Type`	Type of security association: `manual`—Security parameters require no negotiation. They are static, and are configured by the user. `dynamic`—Security parameters are negotiated by the IKE protocol. Dynamic security associations are not supported in transport mode.	`detail extensive`
`State`	Status of the security association: `Installed`—The security association is installed in the security association database. (For transport mode security associations, the value of State must always be Installed.) `Not installed`—The security association is not installed in the security association database.	`detail extensive`
`Protocol`	Protocol supported: `transport` mode supports Encapsulation Security Protocol (`ESP`) or Authentication Header (`AH`). `tunnel` mode supports `ESP` or `AH+ESP`.	All levels
`Authentication`	Type of authentication used: `hmac-md5-96`, `hmac-sha1-96`, or `none`.	`detail extensive`
`Encryption`	Type of encryption algorithm used: can be `3des-cbc`, `aes-cbc (128 bits)`, `aes-cbc (192 bits)`, `aes-cbc (256 bits)`, `aes-gcm (128 bits)`, `aes-gcm(192 bits)`, `aes-gcm (256 bits)`, `des-cbc`, or `None`. Note: In Junos FIPS mode, AES-GCM is not supported in Junos OS Release 17.3R1. Starting in Junos OS Release 17.4R1, AES-GCM is supported in Junos FIPS mode.	`detail`
`Soft lifetime` `Hard lifetime`	Each lifetime of a security association has two display options, hard and soft, one of which must be present for a dynamic security association. The hard lifetime specifies the lifetime of the SA. The soft lifetime, which is derived from the hard lifetime, informs the IPsec key management system that the SA is about to expire. This information allows the key management system to negotiate a new SA before the hard lifetime expires. `Expires in` `seconds` `seconds`—Number of seconds left until the security association expires. `Expires in` `kilobytes` `kilobytes`—Number of kilobytes left until the security association expires.	`detail extensive`
`Anti-replay service`	State of the service that prevents packets from being replayed: `Enabled` or `Disabled`.	`detail extensive`
`SA lifetime`	Configured hard lifetime (total lifetime), in seconds, for the security association.	`detail`
`Replay window size`	Configured size, in packets, of the antireplay service window: `32` or `64`. The antireplay window size protects the receiver against replay attacks by rejecting old or duplicate packets. If the replay window size is `0`, antireplay service is disabled.	`detail`
`disable-natt`	Configure to disable NAT-T functionality. By default the NAT-T is enabled.	All levels.
`nat-keepalive`	Specify the interval at which NAT keepalive packets can be sent so that NAT translation continues.	All levels.

Sample Output

show services ipsec-vpn ipsec security associations extensive
show services ipsec-vpn ipsec security associations detail
show services ipsec-vpn ipsec security associations (on ACX500 Routers)

show services ipsec-vpn ipsec security associations extensive

content_copy zoom_out_map
user@host> show services ipsec-vpn ipsec security-associations extensive 
Service set: service-set-1
  Rule: _junos_, Term: term-1, Tunnel index: 1
  Local gateway: 192.0.2.2, Remote gateway: 198.51.100.4
  IPSec inside interface: sp-2/0/0.1  Local identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
  Remote identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)
  Primary remote gateway: 192.0.2.1, State: Standby
  Backup remote gateway: 198.51.100.4, State: Active
  Failover counter: 1

   Direction: inbound, SPI: 3743521590, AUX-SPI: 0
   Mode: tunnel, Type: dynamic, State: Installed
   Protocol: ESP, Authentication: hmac-sha1-96, Encryption: 3des-cbc
   Soft lifetime: Expires in 23043 seconds
   Hard lifetime: Expires in 23178 seconds
   Anti-replay service: Enabled, Replay window size: 64

   Direction: outbound, SPI: 2551045240, AUX-SPI: 0
   Mode: tunnel, Type: dynamic, State: Installed
   Protocol: ESP, Authentication: hmac-sha1-96, Encryption: 3des-cbc
   Soft lifetime: Expires in 23043 seconds
   Hard lifetime: Expires in 23178 seconds
   Anti-replay service: Enabled, Replay window size: 64

disable-natt: No, nat-keepalive: 10

show services ipsec-vpn ipsec security associations detail

content_copy zoom_out_map
user@host> show services ipsec-vpn ipsec security-associations detail 
Service set: ipsec-sset-0, IKE Routing-instance: default

  Rule: ipsec-rule-0, Term: term0, Tunnel index: 1
  Local gateway: 192.0.2.1, Remote gateway: 192.0.2.2
  IPSec inside interface: ms-3/0/0.1, Tunnel MTU: 1500
  UDP encapsulate: Disabled, UDP Destination port: 0
  Local identity: ipv4_subnet(any:0,[0..7]=198.51.100.0/16)
  Remote identity: ipv4_subnet(any:0,[0..7]=203.0.113.0/16)
  NATT Detection: Not Detected, NATT keepalive interval: 0
  Total uptime:  0 days 0 hrs 1 mins 4 secs

  Direction: inbound, SPI: 4004530393, AUX-SPI: 0
  Mode: tunnel, Type: dynamic, State: Installed
  Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits)
  Soft lifetime: Expires in 27885 seconds
  Hard lifetime: Expires in 28736 seconds
  Anti-replay service: Enabled, Replay window size: 4096
  Copy ToS: Enabled
  Copy TTL: Disabled, TTL value: 64
  SA lifetime: 28800 seconds

  Direction: outbound, SPI: 1323638473, AUX-SPI: 0
  Mode: tunnel, Type: dynamic, State: Installed
  Protocol: ESP, Authentication: hmac-sha1-96, Encryption: aes-cbc (128 bits)
  Soft lifetime: Expires in 27885 seconds
  Hard lifetime: Expires in 28736 seconds
  Anti-replay service: Enabled, Replay window size: 4096
  Copy ToS: Enabled
  Copy TTL: Disabled, TTL value: 64
  SA lifetime: 28800 seconds

show services ipsec-vpn ipsec security associations (on ACX500 Routers)

content_copy zoom_out_map
user@host> show services ipsec-vpn ipsec security-associations 

Service set: SS_1, IKE Routing-instance: Customer-1
 
  Rule: rule_1, Term: 1, Tunnel index: 2
  Local gateway: 192.168.1.11, Remote gateway: 192.168.10.130
  IPSec inside interface: ms-0/2/0.8, Tunnel MTU: 1300
  UDP encapsulate: Disabled, UDP Destination port: 0
    Direction SPI         AUX-SPI     Mode       Type     Protocol
    inbound   2204677182  0           tunnel     dynamic  ESP      
    outbound  3015420439  0           tunnel     dynamic  ESP      
 
Service set: SS_2, IKE Routing-instance: Customer-1
 
  Rule: Customer-1_rule_1, Term: 1, Tunnel index: 1
  Local gateway: 192.168.1.12, Remote gateway: 192.168.20.130
  IPSec inside interface: ms-0/2/0.7, Tunnel MTU: 1300
  UDP encapsulate: Disabled, UDP Destination port: 0
    Direction SPI         AUX-SPI     Mode       Type     Protocol
    inbound   2093089828  0           tunnel     dynamic  ESP      
    outbound  2160146627  0           tunnel     dynamic  ESP      

Release Information

Command introduced before Junos OS Release 7.4.

arrow_backward PREVIOUS show services ipsec-vpn ike security-associations

NEXT arrow_forward show services ipsec-vpn ipsec statistics

Junos CLI Reference

ON THIS PAGE