In which configuration mode is show crypto map used?

The show crypto map command is entered in Privileged EXEC mode on Cisco IOS devices.

VPNPrivileged EXEC

show crypto map

Displays the configured crypto map entries, including their match criteria, peer addresses, and transform sets, used to verify IPsec VPN policy configuration.

Definition: show crypto map is a Cisco IOS privileged exec command. Displays the configured crypto map entries, including their match criteria, peer addresses, and transform sets, used to verify IPsec VPN policy configuration.

Overview

The 'show crypto map' command is a vital diagnostic tool in Cisco IOS that displays the configured crypto map entries on a router. Crypto maps are the core of IPsec VPN policy configuration, binding together the interesting traffic (access lists), the peer IP address, the transform set (encryption and hashing algorithms), and other parameters like lifetime and PFS (Perfect Forward Secrecy). This command is essential for verifying that the VPN policy is correctly applied to an interface and that all parameters are as intended.

It is typically used after configuring crypto maps or when troubleshooting IPsec connectivity issues. Unlike 'show crypto ipsec sa', which shows active security associations (SAs), 'show crypto map' reveals the static policy definitions. It is the first command to reach for when a VPN tunnel fails to establish, as it confirms whether the router's configuration matches the intended policy.

In the broader workflow, an engineer would first use 'show crypto map' to verify the policy, then 'show crypto isakmp sa' to check IKE phase 1, and finally 'show crypto ipsec sa' to inspect phase 2 SAs. The command outputs all crypto map entries, including those not currently active, and can be filtered by map name or interface. It requires privileged EXEC mode (enable).

The output is buffered and may be lengthy if many maps are configured; using 'show crypto map | begin <map-name>' helps. Changes to crypto maps are applied immediately to the running configuration, but the command does not affect the router's state. Understanding this command is crucial for CCNA and CCNP candidates as it directly relates to VPN configuration and troubleshooting scenarios in exams and real-world networks.

Syntax·Privileged EXEC

show crypto map

When to Use This Command

Verify that a crypto map is correctly applied to an interface after configuring a site-to-site VPN.
Troubleshoot why IPsec traffic is not being encrypted by checking the crypto map match criteria.
Confirm the peer IP address and transform set for an existing VPN tunnel.
Check the status of dynamic crypto maps for remote access VPNs.

Parameters

Parameter	Syntax	Required	Description
map-name	WORD	Optional	Optional name of a specific crypto map to display. If omitted, all crypto maps are shown. Use this to narrow output to a particular map, especially when many maps exist. Common mistake: misspelling the map name or using case-sensitive names.
interface	type number	Optional	Optional interface to display crypto maps applied to that interface. For example, 'GigabitEthernet0/0'. If omitted, all interfaces are shown. Useful for verifying which map is attached to a specific interface. Common mistake: forgetting that crypto maps are applied per interface.

Command Examples

Basic show crypto map output

show crypto map

Crypto Map "CMAP" 10 ipsec-isakmp
    Peer = 192.168.2.1
    Extended IP access list 100
        access-list 100 permit ip 10.0.1.0 0.0.0.255 10.0.2.0 0.0.0.255
    Current peer: 192.168.2.1
    Security association lifetime: 4608000 kilobytes/3600 seconds
    PFS (Y/N): N
    Transform sets={TSET,}
    Interfaces using crypto map CMAP:
        GigabitEthernet0/0

Line 1: Crypto map name 'CMAP' with sequence number 10, type ipsec-isakmp. Line 2: Peer IP address (VPN endpoint). Line 3-4: Extended ACL used to match traffic to encrypt. Line 5: Current active peer. Line 6: SA lifetime in kilobytes and seconds. Line 7: Whether Perfect Forward Secrecy is enabled (N=no). Line 8: Transform set(s) used. Line 9-10: Interface(s) where this crypto map is applied.

Show crypto map with dynamic map

show crypto map

Crypto Map "DYNAMIC" 1 ipsec-isakmp dynamic
    Peer = 0.0.0.0
    Extended IP access list 101
        access-list 101 permit ip any any
    Current peer: 0.0.0.0
    Security association lifetime: 4608000 kilobytes/3600 seconds
    PFS (Y/N): N
    Transform sets={TSET,}
    No interfaces bound yet

Line 1: Dynamic crypto map (no static peer). Line 2: Peer 0.0.0.0 means peer is not predefined. Line 3-4: ACL matches any IP traffic. Line 5: No current peer. Line 6-8: Standard lifetime and PFS settings. Line 9: Transform set. Line 10: No interface currently bound (dynamic maps are often attached via a static map).

Understanding the Output

The output lists each crypto map entry by name and sequence number. The type (ipsec-isakmp, ipsec-manual, dynamic) indicates how the map is configured. 'Peer' shows the remote VPN endpoint IP; 0.0.0.0 means dynamic.

The extended ACL defines which traffic triggers encryption. 'Current peer' is the active peer for the SA. Lifetime values (kilobytes/seconds) show when the SA will expire.

PFS indicates if Perfect Forward Secrecy is used. Transform sets list the encryption and authentication algorithms. The 'Interfaces using crypto map' line confirms which interface(s) the map is applied to.

For troubleshooting, ensure the ACL matches the desired traffic, the peer IP is correct, and the interface is listed. Missing interface means the map is not applied or the interface is down.

Configuration Scenarios

Site-to-Site IPsec VPN between Branch and Headquarters

A branch office router (R1) needs to establish a secure IPsec tunnel to the headquarters router (R2) to protect traffic between internal subnets 192.168.1.0/24 and 10.10.10.0/24.

Topology

R1(Gi0/0)---172.16.1.0/30---(Gi0/0)R2
R1 LAN: 192.168.1.0/24
R2 LAN: 10.10.10.0/24

Steps

1.Step 1: Enter privileged EXEC mode: R1> enable
2.Step 2: Enter global configuration mode: R1# configure terminal
3.Step 3: Define interesting traffic with an access list: R1(config)# access-list 100 permit ip 192.168.1.0 0.0.0.255 10.10.10.0 0.0.0.255
4.Step 4: Create an IKE policy (ISAKMP): R1(config)# crypto isakmp policy 10
5.Step 5: Set encryption and hash: R1(config-isakmp)# encryption aes 256; R1(config-isakmp)# hash sha256; R1(config-isakmp)# authentication pre-share; R1(config-isakmp)# group 14; R1(config-isakmp)# exit
6.Step 6: Configure pre-shared key: R1(config)# crypto isakmp key cisco123 address 172.16.1.2
7.Step 7: Create transform set: R1(config)# crypto ipsec transform-set TSET esp-aes 256 esp-sha256-hmac
8.Step 8: Create crypto map: R1(config)# crypto map CMAP 10 ipsec-isakmp
9.Step 9: Set peer, transform set, and match address: R1(config-crypto-map)# set peer 172.16.1.2; R1(config-crypto-map)# set transform-set TSET; R1(config-crypto-map)# match address 100; R1(config-crypto-map)# exit
10.Step 10: Apply crypto map to interface: R1(config)# interface GigabitEthernet0/0; R1(config-if)# crypto map CMAP; R1(config-if)# end

Configuration

! R1 configuration
access-list 100 permit ip 192.168.1.0 0.0.0.255 10.10.10.0 0.0.0.255
crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14
crypto isakmp key cisco123 address 172.16.1.2
crypto ipsec transform-set TSET esp-aes 256 esp-sha256-hmac
crypto map CMAP 10 ipsec-isakmp
 set peer 172.16.1.2
 set transform-set TSET
 match address 100
interface GigabitEthernet0/0
 crypto map CMAP

Verify: Use 'show crypto map' to verify the configuration. Expected output includes the crypto map name (CMAP), sequence number (10), peer (172.16.1.2), transform set (TSET), and access list (100). Also check 'show crypto map interface GigabitEthernet0/0' to confirm it is applied.

Watch out: A common mistake is forgetting to apply the crypto map to the interface. Without 'crypto map CMAP' under the interface, the VPN policy is not active and no tunnel will form.

Verifying Multiple Crypto Maps on a Hub Router

A hub router (Hub) has multiple crypto maps for different branch peers. The engineer needs to verify that each map is correctly configured and applied to the appropriate interface.

Topology

Hub(Gi0/0)---10.0.0.0/30---Branch1
Hub(Gi0/1)---10.0.1.0/30---Branch2
Hub LAN: 172.16.0.0/16

Steps

1.Step 1: Enter privileged EXEC mode: Hub> enable
2.Step 2: Display all crypto maps: Hub# show crypto map
3.Step 3: To filter for a specific map, use: Hub# show crypto map BRANCH1_MAP
4.Step 4: To see maps on a specific interface: Hub# show crypto map interface GigabitEthernet0/0
5.Step 5: Check that each map has the correct peer, transform set, and ACL.

Configuration

! Hub configuration (partial)
crypto map BRANCH1_MAP 10 ipsec-isakmp
 set peer 10.0.0.2
 set transform-set AES256_SHA
 match address 101
interface GigabitEthernet0/0
 crypto map BRANCH1_MAP
!
crypto map BRANCH2_MAP 10 ipsec-isakmp
 set peer 10.0.1.2
 set transform-set AES256_SHA
 match address 102
interface GigabitEthernet0/1
 crypto map BRANCH2_MAP

Verify: Use 'show crypto map' to see all maps. For each map, verify the peer IP, transform set, and ACL number. Use 'show crypto map interface Gi0/0' to confirm BRANCH1_MAP is applied to the correct interface.

Watch out: A common mistake is using the same crypto map name on multiple interfaces. Each interface must have its own unique crypto map or a map with different sequence numbers. Overlapping maps can cause unexpected behavior.

Troubleshooting with This Command

When troubleshooting IPsec VPN issues, 'show crypto map' is the first command to run after verifying basic connectivity. Healthy output shows each crypto map entry with a peer IP, transform set, and ACL. Problem indicators include missing entries (no crypto map applied), incorrect peer IP, wrong transform set, or an ACL that does not match the desired traffic.

For example, if the output shows 'peer: 0.0.0.0', the peer is not configured. If the transform set name is misspelled, it will show 'transform-set: (none)'. Focus on the 'match address' field: if the ACL is missing or incorrect, the router will not identify interesting traffic.

Common symptoms this command helps diagnose include: tunnel not coming up (check peer and transform set), traffic not encrypted (check ACL), or wrong peer (check peer IP). A step-by-step diagnostic flow: 1) Run 'show crypto map' to confirm the policy exists. 2) If no output, check that a crypto map is applied to the interface. 3) Verify the peer IP matches the remote router's public IP. 4) Ensure the transform set matches on both ends. 5) Check the ACL permits the correct source/destination subnets. 6) If the map looks correct but tunnel still fails, move to 'show crypto isakmp sa' for phase 1 and 'show crypto ipsec sa' for phase 2. Correlate 'show crypto map' with 'show crypto isakmp policy' to ensure IKE policies match.

Also, 'debug crypto ipsec' can be used but with caution. The command output also shows the 'security association lifetime' and 'PFS' settings; mismatches here can cause rekey failures. Always compare the output with the intended configuration to spot typos or missing parameters.

CCNA Exam Tips

Remember that 'show crypto map' displays both static and dynamic maps; dynamic maps show peer 0.0.0.0.

The ACL in the crypto map must match the interesting traffic; a common exam trick is to check if the ACL is correct.

If the interface is not listed under 'Interfaces using crypto map', the map is not applied or the interface is down.

Know that PFS (Perfect Forward Secrecy) is optional and can be enabled with 'set pfs'.

Common Mistakes

Confusing 'show crypto map' with 'show crypto ipsec sa' — the former shows configuration, the latter shows active SAs.

Forgetting that the ACL in the crypto map must be a numbered or named extended ACL; standard ACLs are not supported.

Assuming that a crypto map applied to an interface automatically creates an SA; traffic must match the ACL to trigger SA negotiation.

show crypto map vs show crypto ipsec sa

Both commands are essential for troubleshooting IPsec VPNs, but they serve different purposes: 'show crypto map' displays the static configuration of IPsec policies, while 'show crypto ipsec sa' shows dynamic runtime state of active tunnels. They are often confused because both are used in VPN troubleshooting, yet one is configuration-focused and the other is operational.

Aspect	show crypto map	show crypto ipsec sa
Scope	Crypto map configuration entries	Current IPsec security associations
Data Type	Static config (match criteria, peer, transform set)	Dynamic state (SPI, encrypt/decrypt counters, lifetime)
Persistence	Persists across reboots (config)	Lost on reboot or SA expiry (runtime)
Typical Use	Verify policy is correctly configured	Check tunnel is up and traffic is flowing

Use show crypto map when you need to verify that the IPsec policy is correctly defined, such as after configuration changes or to confirm match criteria and transform sets.

Use show ipsec sa when you need to confirm that a tunnel is established, check active security associations, or monitor packet encryption/decryption statistics.

Platform Notes

In IOS-XE (e.g., CSR1000v, ISR 4000), the 'show crypto map' command syntax and output are nearly identical to classic IOS. However, IOS-XE may display additional fields like 'IPsec profile' if using virtual tunnel interfaces (VTIs). The NX-OS equivalent is 'show crypto map' as well, but NX-OS uses a different configuration model (e.g., 'crypto map' is similar but with some syntax differences).

On ASA firewalls, the equivalent command is 'show crypto map' (same syntax) but the output format differs slightly; ASA also uses 'show crypto ipsec sa' for active SAs. In IOS-XR, the command is 'show crypto map' but the configuration is done via 'crypto ipsec policy' and 'crypto ipsec profile'; the output may show 'ipsec profile' instead of 'crypto map'. For IOS versions, the command has been consistent from 12.x to 16.x, but newer versions may include additional parameters like 'set security-association level per-host'.

Always check the specific IOS documentation for your version. On some platforms, the output may be truncated if many maps exist; use 'show crypto map | section <map-name>' to filter.

Related Commands

crypto map [name] [seq] ipsec-isakmp

Creates or modifies a crypto map entry for IPsec VPN configuration, defining the security policies and peer parameters for IKE and IPsec negotiations.

show crypto ipsec sa

Displays the current state and statistics of IPsec security associations (SAs) to verify VPN tunnel establishment and monitor encrypted traffic.

show crypto isakmp sa

Displays the current state of Internet Key Exchange (IKE) Security Associations (SAs) used for IPsec VPN tunnels, allowing verification of Phase 1 tunnel establishment.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions