CISCO ASA VPN Debug

Anzeigen der SA

• ciscoasa(config)# show crypto ikev1 sa

IKEv1 SAs:

   Active SA: 1
    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)
Total IKE SA: 1

1   IKE Peer: 192.168.252.5
    Type    : L2L             Role    : responder 
    Rekey   : no              State   : MM_ACTIVE 

Debugging

• debug crypto isakmp 127
• debug crypto ipsec 127

Debugging ausschalten

• no debug all

ikev1 statistiken

• show crypto ikev1 stats

Global IKEv1 Statistics
  Active Tunnels:              1
  Previous Tunnels:           13
  In Octets:               24412
  In Packets:                141
  In Drop Packets:            35
  In Notifys:                 53
  In P2 Exchanges:            13
  In P2 Exchange Invalids:     0
  In P2 Exchange Rejects:     12
  In P2 Sa Delete Requests:    0
  Out Octets:              18044
  Out Packets:               117
  Out Drop Packets:            0
  Out Notifys:               118
  Out P2 Exchanges:            0
  Out P2 Exchange Invalids:    0
  Out P2 Exchange Rejects:     0
  Out P2 Sa Delete Requests:   0
  Initiator Tunnels:           0
  Initiator Fails:             0
  Responder Fails:             0
  System Capacity Fails:       0
  Auth Fails:                  0
  Decrypt Fails:               0
  Hash Valid Fails:            0
  No Sa Fails:                 0

IKEV1 Call Admission Statistics
  Max In-Negotiation SAs:                 25
  In-Negotiation SAs:                      0
  In-Negotiation SAs Highwater:            1
  In-Negotiation SAs Rejected:             0

Links

• http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113574-tg-asa-ipsec-ike-debugs-main-00.html