show ipsec security-associations

Security association

Name of the security association.

Interface family

Status of the interface family of the security association. If the interface family field is absent, it is a transport mode security association. The interface family can have one of three options:

• Up—The security association is referenced in the interface family and the interface family is up.

• Down—The security association is referenced in the interface family and the interface family is down.

• No reference—The security association is not referenced in the interface family.

Local gateway

Gateway address of the local system.

Remote gateway

Gateway address of the remote system.

Local identity

Prefix and port number of the local end

Remote identity

Prefix and port number of the remote end.

Direction

Direction of the security association: inbound or outbound.

SPI

Value of the security parameter index.

AUX-SPI

Value of the auxiliary security parameter index.

• When the value is AH or ESP, AUX-SPI is always 0.

• When the value isAH+ESP, AUX-SPI is always a positive integer.

State

Status of the security association:

• Installed—The security association is installed in the security association database. (For transport mode security associations, the value of State must always be Installed.)

• Not installed—The security association is not installed in the security association database.

Mode

Mode of the security association:

• transport—Protects single host-to-host protections.

• tunnel—Protects connections between security gateways.

Type

Type of security association:.

• manual—Security parameters require no negotiation. They are static, and are configured by the user.

• dynamic—Security parameters are negotiated by the IKE protocol. Dynamic security associations are not supported in transport mode.

Protocol

Protocol supported:

• transport mode—Supports Encapsulation Security Protocol (ESP) or Authentication Header (AH).

• tunnel mode—Supports ESP or AH+ESP.

Authentication

Type of authentication used: hmac-md5-96, hmac-sha1-96, or None.

Encryption

Type of encryption used: des-cbc, 3des-csc, or None.

Soft lifetime

Hard lifetime

(dynamic output only) Each lifetime of a security association has two display options, hard and soft, one of which must be present for a dynamic security association. The hard lifetime specifies the lifetime of the SA. The soft lifetime, which is derived from the hard lifetime, informs the IPsec key management system that the SA is about to expire. This allows the key management system to negotiate a new SA before the hard lifetime expires.

• Expires in seconds seconds—Number of seconds left until the security association expires.

• Expires in kilobytes kilobytes—Number of kilobytes left until the security association expires.

Anti-replay service

State of the service that prevents packets from being replayed: Enabled or Disabled.

Replay window size

Configured size, in packets, of the antireplay service window: 32 or 64. The antireplay window size protects the receiver against replay attacks by rejecting old or duplicate packets. If the replay window size is 0, the antireplay service is disabled.