show crypto ipsec sa
Displays the current state and statistics of IPsec security associations (SAs) to verify VPN tunnel establishment and monitor encrypted traffic.
Definition: show crypto ipsec sa is a Cisco IOS privileged exec command. Displays the current state and statistics of IPsec security associations (SAs) to verify VPN tunnel establishment and monitor encrypted traffic.
Overview
The `show crypto ipsec sa` command is a critical diagnostic tool for any network engineer working with IPsec VPNs on Cisco IOS devices. It displays the current state and statistics of all IPsec Security Associations (SAs) that have been negotiated between peers. An SA is a set of parameters (encryption algorithm, authentication method, keys, SPI, etc.) that defines how traffic is secured for a given session.
This command is essential for verifying that a VPN tunnel is properly established, monitoring encrypted traffic flows, and troubleshooting common issues such as mismatched crypto profiles, expired keys, or packet drops. Unlike `show crypto isakmp sa`, which shows the IKE phase 1 (management) tunnel, `show crypto ipsec sa` focuses on the actual data-plane SAs (phase 2) that protect user traffic. You would reach for this command when a VPN tunnel appears to be up (IKE phase 1 is active) but traffic is not passing, or when you need to confirm which traffic is being encrypted and with which transforms.
It fits into the broader troubleshooting workflow after verifying reachability and IKE phase 1 status. The output is buffered and can be lengthy if many SAs exist; you can filter by peer or traffic selector using parameters. The command requires privileged EXEC mode (enable) and does not affect the running configuration.
Understanding the output fields—such as `encaps`, `decaps`, `pkts encrypt`, `pkts decrypt`, and error counters—is key to diagnosing problems like replay attacks, anti-replay window failures, or SA lifetime expirations. This command is indispensable for both CCNA and CCNP candidates who must master IPsec VPN operation and troubleshooting.
show crypto ipsec saWhen to Use This Command
- Verify that an IPsec VPN tunnel is up and active after configuration.
- Troubleshoot why encrypted traffic is not passing through a VPN tunnel.
- Monitor packet encryption/decryption counts and error counters for a specific SA.
- Check the lifetime and expiration status of an IPsec SA to anticipate rekey events.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| peer | A.B.C.D | Specifies the IP address of the remote peer to filter SAs. Only SAs with that peer are displayed. Common mistake: using the wrong peer address (e.g., NAT-translated address instead of the actual peer). |
| map | WORD | Filters SAs by the crypto map name. Useful when multiple crypto maps exist on the device. The name must match exactly (case-sensitive). |
| identity | WORD | Filters SAs by the identity (traffic selector) string. Typically used with advanced configurations. Not commonly used in basic setups. |
| detail | Displays detailed information about each SA, including anti-replay counters, lifetime details, and path MTU. Use this when troubleshooting packet drops or replay errors. |
Command Examples
Basic display of all IPsec SAs
show crypto ipsec sainterface: Tunnel0
Crypto map tag: CMAP, local addr 192.168.1.1
protected vrf: (none)
local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.0.0.0/255.255.255.0/0/0)
current_peer 203.0.113.5 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 1500, #pkts encrypt: 1500, #pkts digest: 1500
#pkts decaps: 1200, #pkts decrypt: 1200, #pkts verify: 1200
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 192.168.1.1, remote crypto endpt.: 203.0.113.5
plaintext mtu 1400, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0
current outbound spi: 0xABCD1234(2882401844)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0x5678EF01(1450745345)
transform: esp-aes 256 esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2001, flow_id: SW:1, sibling_flags 80000040, crypto map: CMAP
sa timing: remaining key lifetime (k/sec): (4500000/2879)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xABCD1234(2882401844)
transform: esp-aes 256 esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2002, flow_id: SW:2, sibling_flags 80000040, crypto map: CMAP
sa timing: remaining key lifetime (k/sec): (4500000/2879)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:The output shows one IPsec SA pair (inbound and outbound) for tunnel Tunnel0. 'local ident' and 'remote ident' define the traffic selectors. '#pkts encaps/encrypt' shows outbound encrypted packets; '#pkts decaps/decrypt' shows inbound decrypted packets. 'current outbound spi' is the Security Parameter Index for outbound. 'inbound esp sas' and 'outbound esp sas' show the transform set (esp-aes 256 esp-sha-hmac), remaining lifetime in kilobytes and seconds, and status (ACTIVE).
Detailed display for a specific peer
show crypto ipsec sa peer 203.0.113.5interface: Tunnel0
Crypto map tag: CMAP, local addr 192.168.1.1
protected vrf: (none)
local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (10.0.0.0/255.255.255.0/0/0)
current_peer 203.0.113.5 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 1500, #pkts encrypt: 1500, #pkts digest: 1500
#pkts decaps: 1200, #pkts decrypt: 1200, #pkts verify: 1200
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 0, #recv errors 0
local crypto endpt.: 192.168.1.1, remote crypto endpt.: 203.0.113.5
plaintext mtu 1400, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0
current outbound spi: 0xABCD1234(2882401844)
PFS (Y/N): N, DH group: none
inbound esp sas:
spi: 0x5678EF01(1450745345)
transform: esp-aes 256 esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2001, flow_id: SW:1, sibling_flags 80000040, crypto map: CMAP
sa timing: remaining key lifetime (k/sec): (4500000/2879)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE
outbound esp sas:
spi: 0xABCD1234(2882401844)
transform: esp-aes 256 esp-sha-hmac ,
in use settings ={Tunnel, }
conn id: 2002, flow_id: SW:2, sibling_flags 80000040, crypto map: CMAP
sa timing: remaining key lifetime (k/sec): (4500000/2879)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVEFiltering by peer shows only SAs associated with that remote IP. This is useful when multiple VPN tunnels exist. The output is identical in structure to the basic display but limited to the specified peer.
Understanding the Output
The output is organized per interface and crypto map. Key fields: 'local ident' and 'remote ident' define the traffic selectors (subnets/protocols/ports) that trigger encryption. '#pkts encaps' and '#pkts encrypt' count outbound packets; '#pkts decaps' and '#pkts decrypt' count inbound packets.
Large discrepancies may indicate asymmetric routing or ACL misconfiguration. '#send errors' and '#recv errors' should be zero; non-zero values indicate problems. 'current outbound spi' is the SPI used for outbound packets.
Under 'inbound esp sas' and 'outbound esp sas', check 'Status: ACTIVE' for a healthy SA. 'remaining key lifetime (k/sec)' shows how much traffic (in kilobytes) and time (seconds) remain before rekey. If lifetime approaches zero, the SA will expire.
'transform' shows the encryption and authentication algorithms. 'PFS (Y/N)' indicates Perfect Forward Secrecy usage. 'replay detection support: Y' is normal.
If 'Status' is not ACTIVE or counters are not incrementing, the tunnel may be down or misconfigured.
Configuration Scenarios
Site-to-Site VPN between two branch routers
Two branch offices need to securely communicate over the internet. Each router has a public IP and a private LAN behind it. The goal is to establish an IPsec tunnel encrypting all traffic between the two LANs.
Topology
Branch1 (Gi0/0: 203.0.113.1)---Internet---(Gi0/0: 198.51.100.1) Branch2
Branch1 LAN: 192.168.1.0/24
Branch2 LAN: 192.168.2.0/24Steps
- 1.Step 1: Configure ISAKMP policy on both routers: crypto isakmp policy 10, authentication pre-share, encryption aes 256, hash sha, group 14, lifetime 86400.
- 2.Step 2: Set pre-shared key: crypto isakmp key cisco123 address 198.51.100.1 (on Branch1) and vice versa.
- 3.Step 3: Define ACL for interesting traffic: access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255.
- 4.Step 4: Create IPsec transform set: crypto ipsec transform-set AES256-SHA esp-aes 256 esp-sha-hmac.
- 5.Step 5: Create crypto map: crypto map CMAP 10 ipsec-isakmp, set peer 198.51.100.1, set transform-set AES256-SHA, match address 100.
- 6.Step 6: Apply crypto map to outside interface: interface GigabitEthernet0/0, crypto map CMAP.
! Branch1 configuration crypto isakmp policy 10 authentication pre-share encryption aes 256 hash sha group 14 lifetime 86400 crypto isakmp key cisco123 address 198.51.100.1 ! access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 ! crypto ipsec transform-set AES256-SHA esp-aes 256 esp-sha-hmac ! crypto map CMAP 10 ipsec-isakmp set peer 198.51.100.1 set transform-set AES256-SHA match address 100 ! interface GigabitEthernet0/0 ip address 203.0.113.1 255.255.255.0 crypto map CMAP
Verify: Use `show crypto ipsec sa peer 198.51.100.1` on Branch1. Expected output shows an SA with status ACTIVE, encaps/decaps counters incrementing when traffic flows, and no errors.
Watch out: Forgetting to apply the crypto map to the correct interface (outside interface) is a common mistake. Also, ensure the ACL is mirrored on both sides (source/destination reversed).
Remote Access VPN with dynamic crypto map
A mobile user (VPN client) needs to connect to the corporate network. The router acts as a VPN headend with a dynamic crypto map to accept connections from any remote peer IP. The client uses a pre-shared key and obtains an IP from a local pool.
Topology
Client (dynamic IP)---Internet---(Gi0/0: 203.0.113.1) Corporate Router
Corporate LAN: 10.0.0.0/24Steps
- 1.Step 1: Configure ISAKMP policy with aggressive mode (optional) and pre-shared key: crypto isakmp policy 10, authentication pre-share, encryption aes 256, hash sha, group 2, lifetime 86400.
- 2.Step 2: Set pre-shared key for any peer: crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0.
- 3.Step 3: Create IPsec transform set: crypto ipsec transform-set AES256-SHA esp-aes 256 esp-sha-hmac.
- 4.Step 4: Create dynamic crypto map: crypto dynamic-map DYNAMIC 10, set transform-set AES256-SHA.
- 5.Step 5: Create static crypto map referencing the dynamic map: crypto map CMAP 10 ipsec-isakmp dynamic DYNAMIC.
- 6.Step 6: Apply crypto map to outside interface: interface GigabitEthernet0/0, crypto map CMAP.
! Corporate Router configuration crypto isakmp policy 10 authentication pre-share encryption aes 256 hash sha group 2 lifetime 86400 crypto isakmp key cisco123 address 0.0.0.0 0.0.0.0 ! crypto ipsec transform-set AES256-SHA esp-aes 256 esp-sha-hmac ! crypto dynamic-map DYNAMIC 10 set transform-set AES256-SHA ! crypto map CMAP 10 ipsec-isakmp dynamic DYNAMIC ! interface GigabitEthernet0/0 ip address 203.0.113.1 255.255.255.0 crypto map CMAP
Verify: After client connects, use `show crypto ipsec sa` to see an SA with peer address (client's public IP). The encaps/decaps counters should increment when traffic flows. Use `show crypto ipsec sa detail` to see the client's assigned IP (if using mode-config).
Watch out: Dynamic crypto maps do not allow setting a specific peer; the peer is learned from the client. Ensure the ISAKMP key is set for 0.0.0.0 to accept any peer. Also, aggressive mode may be needed if client IP is not known in advance.
Troubleshooting with This Command
When troubleshooting IPsec VPNs, `show crypto ipsec sa` is your go-to command for verifying the data-plane SAs. A healthy output shows at least one SA per direction (inbound and outbound) with status ACTIVE. Key fields to examine: `encaps` (packets encapsulated) and `decaps` (packets decapsulated) should increment when traffic is sent through the tunnel.
If these counters are zero, traffic is not matching the crypto ACL or the tunnel is not being used. The `pkts encrypt` and `pkts decrypt` counters reflect actual encryption/decryption operations. If they are incrementing but `encaps`/`decaps` are not, there may be an issue with the crypto engine.
Error counters like `drop`, `replay drop`, `auth fail`, and `integrity fail` are critical. A high `replay drop` count indicates anti-replay window issues (often due to packet reordering or asymmetric routing). `auth fail` suggests authentication problems (bad key or transform mismatch). `integrity fail` points to data corruption or tampering. A step-by-step diagnostic flow: 1) Check IKE phase 1 with `show crypto isakmp sa`; if not up, troubleshoot ISAKMP. 2) If phase 1 is up but phase 2 is not, check `show crypto ipsec sa` for missing SAs. 3) If SAs are present but no traffic, verify the crypto ACL matches the traffic you expect. 4) If counters increment but traffic fails, examine error counters and use `debug crypto ipsec` (with caution) to see detailed errors.
Correlate with `show crypto engine connections active` to see hardware acceleration status. Also, check `show crypto ipsec sa detail` for anti-replay window size and lifetime remaining. Common symptoms: SAs in `ACTIVE` state but no traffic means the ACL is too restrictive; SAs in `IDLE` state indicate no traffic for a while; SAs in `DEAD` state mean the tunnel has been torn down.
Use `clear crypto sa` to reset SAs if needed, but be aware it will disrupt active tunnels. Always verify the peer address matches the expected remote gateway; NAT can cause mismatches. Finally, ensure the crypto map is applied to the correct interface and that the interface is up/up.
CCNA Exam Tips
CCNA exam tip: The 'show crypto ipsec sa' command is used to verify that IPsec SAs have been established; if no SAs appear, the tunnel is not up.
CCNA exam tip: Pay attention to the '#pkts encaps' and '#pkts decaps' counters; if they are not incrementing when traffic is sent, the tunnel may not be matching the interesting traffic ACL.
CCNA exam tip: The 'Status: ACTIVE' line is critical; if it shows 'ACTIVE' the SA is up; if missing or 'IDLE', the tunnel is down.
CCNA exam tip: The 'remaining key lifetime' values help determine if the SA is about to expire; a rekey will occur automatically, but if the lifetime reaches zero, the SA is deleted.
Common Mistakes
Mistake 1: Assuming the tunnel is up based on 'show crypto isakmp sa' alone; IPsec SAs must also be present. Always check 'show crypto ipsec sa'.
Mistake 2: Misinterpreting 'local ident' and 'remote ident'; these must match the crypto ACL exactly. If they show 0.0.0.0/0, the ACL may be misconfigured.
Mistake 3: Ignoring error counters; non-zero '#send errors' or '#recv errors' indicate problems like MTU issues or peer unreachability.
show crypto ipsec sa vs show crypto isakmp sa
Both 'show crypto ipsec sa' and 'show crypto isakmp sa' display Security Association (SA) information for IPsec VPN tunnels, but they operate at different phases of the VPN negotiation. 'show crypto ipsec sa' shows Phase 2 SAs (IPsec), while 'show crypto isakmp sa' shows Phase 1 SAs (IKE), leading to confusion when troubleshooting tunnel establishment.
| Aspect | show crypto ipsec sa | show crypto isakmp sa |
|---|---|---|
| Phase | Phase 2 (IPsec) SA | Phase 1 (IKE) SA |
| Scope | Encrypted data traffic details (spi, protocol, lifetime) | IKE tunnel negotiation state (MM_NO_STATE, MM_ACTIVE, etc.) |
| Statistics | Packet/byte counters, rekey history, anti-replay | No traffic statistics; shows peer authentication status |
| Common States | QM_IDLE (active), deleting (expiring) | MM_ACTIVE (established), MM_NO_STATE (waiting) |
| Troubleshooting Utility | Verify encrypted traffic flow and rekeys | Verify if IKE peer is reachable and authentication succeeded |
Use show crypto ipsec sa when you need to confirm that IPsec encryption is active, check which traffic flows are protected, or monitor packet counters and rekey events.
Use show crypto isakmp sa when you want to verify IKE Phase 1 tunnel establishment, diagnose authentication failures, or check the current IKE state with a remote peer.
Platform Notes
On IOS-XE (e.g., CSR1000v, ISR 4000 series), the `show crypto ipsec sa` command syntax and output are largely identical to classic IOS. However, IOS-XE may include additional fields like `pkts per second` or `crypto engine` details. The command is available in privileged EXEC mode.
On NX-OS (e.g., Nexus 9000 with IPsec), the equivalent command is `show crypto ipsec sa` but the output format differs significantly; NX-OS also supports `show crypto ipsec sa peer <ip>` and `show crypto ipsec sa detail`. On ASA firewalls, the equivalent is `show crypto ipsec sa` (or `show crypto ipsec sa detail`), but ASA uses a different configuration model (tunnel groups, crypto maps, etc.). The ASA output includes `pkts encaps` and `pkts decaps` but also `pkts encrypt` and `pkts decrypt` as separate counters.
On IOS-XR (e.g., ASR 9000), the command is `show crypto ipsec sa` but the output is structured differently and may require additional parameters like `location` for line cards. In IOS versions prior to 12.4, the command may not show all fields (e.g., anti-replay counters). In 15.x and later, the output is more detailed.
Always check the specific platform documentation, as some features (like IKEv2) may alter the output. For example, IKEv2 SAs may appear under `show crypto ipsec sa` but with different status indicators.
Related Commands
show crypto isakmp sa
Displays the current state of Internet Key Exchange (IKE) Security Associations (SAs) used for IPsec VPN tunnels, allowing verification of Phase 1 tunnel establishment.
show crypto map
Displays the configured crypto map entries, including their match criteria, peer addresses, and transform sets, used to verify IPsec VPN policy configuration.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions