Cisco Cisco ASA 5580 Adaptive Security Appliance Leaflet

思科 ASA 系列命令参考，S 命令

第 7 章      show failover 至 show ipsec stats traffic 命令

      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0

      #pkts decaps: 18, #pkts decrypt: 18, #pkts verify: 18

      #pkts compressed: 0, #pkts decompressed: 0

      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0

      #post-frag successes: 0, #post-frag failures: 0, #fragments created: 0

      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0

      #TFC rcvd: 0, #TFC sent: 0

      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0

      #send errors: 0, #recv errors: 4

     local crypto endpt.: 75.2.1.23/4500, remote crypto endpt.: 75.2.1.60/64251

      path mtu 1342, ipsec overhead 62(44), override mtu 1280, media mtu 1500

      PMTU time remaining (sec): 0, DF policy: copy-df

      ICMP error validation: disabled, TFC packets: disabled

      current outbound spi: D9C00FC2

      current inbound spi : 4FCB6624

    inbound esp sas:

      spi: 0x4FCB6624 (1338730020)

         transform: esp-3des esp-sha-hmac no compression

         in use settings ={RA, Transport,  NAT-T-Encaps, GRE, IKEv2, }

         slot: 0, conn_id: 8192, crypto-map: def

         sa timing: remaining key lifetime (sec): 28387

         IV size: 8 bytes

         replay detection support: Y

         Anti replay bitmap:

          0x0003FFFF 0xFFFFFFFF

    outbound esp sas:

      spi: 0xD9C00FC2 (3653242818)

         transform: esp-3des esp-sha-hmac no compression

         in use settings ={RA, Transport,  NAT-T-Encaps, GRE, IKEv2, }

         slot: 0, conn_id: 8192, crypto-map: def

         sa timing: remaining key lifetime (sec): 28387

         IV size: 8 bytes

        replay detection support: Y

         Anti replay bitmap:

          0x00000000 0x00000001

以下示例在全局配置模式下输入，它显示

 IPsec SA，包括用于将隧道标识为 OSPFv3 的使用中

设置。

ciscoasa(config)# show ipsec sa

interface: outside2

    Crypto map tag: def, local addr: 10.132.0.17

      local ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)

      remote ident (addr/mask/prot/port): (172.20.0.21/255.255.255.255/0/0)

      current_peer: 172.20.0.21

      dynamic allocated peer ip: 10.135.1.5

      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0

      #pkts decaps: 1145, #pkts decrypt: 1145, #pkts verify: 1145

      #pkts compressed: 0, #pkts decompressed: 0

      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0

      #pre-frag successes: 2, #pre-frag failures: 1, #fragments created: 10

      #PMTUs sent: 5, #PMTUs rcvd: 2, #decapstulated frags needing reassembly: 1

      #send errors: 0, #recv errors: 0

      local crypto endpt.: 10.132.0.17, remote crypto endpt.: 172.20.0.21

      path mtu 1500, ipsec overhead 60, media mtu 1500

      current outbound spi: DC15BF68