Viewing security associations

What security associations are

A security association is a collection of information that determines how security is handled in a transfer of information. Each association lasts for the time assigned by the server.

Displaying security associations

To view the currently active security associations on a filer, complete the following step.

Step	Action
1	Enter the following command: ipsec sa show [spi \| [-s src_ip -t dst_ip -p {esp\|ah}]] [-v] spi specifies the security parameter index. `-s` src_ip specifies the address of the source of the secure communication as an IP address or IP address range. `-t` dst_ip specifies the address of the destination of the secure communication in the same format specified for the source. `-p` specifies the protocol to be used, either `esp` (encapsulating security payload, based on RFC 2405) or `ah` (authentication header, based on RFC 2402) `-v` specifies the verbose (full) output.

Step

Action

Enter the following command:

ipsec sa show [spi | [-s src_ip -t dst_ip -p {esp|ah}]] 

[-v]

spi specifies the security parameter index.

-s src_ip specifies the address of the source of the secure communication as an IP address or IP address range.

-t dst_ip specifies the address of the destination of the secure communication in the same format specified for the source.

-p specifies the protocol to be used, either esp (encapsulating security payload, based on RFC 2405) or ah (authentication header, based on RFC 2402)

-v specifies the verbose (full) output.

Example

The following example displays security association information for the device that has a source IP address of 10.56.19.172:

ipsec sa show 1 -s 10.56.19.172 -p esp

Alg/State/Spi Current Bytes/CreatedTime SrcIPAddr->DstIPAddr

------------- ------------------------- --------------------

esp/M/0001388 0/20 Aug 2002 17:28:19    10.56.19.172->10.56.19.173

The values for state are:

M Mature and active

D Dead

d Dying

L Larval (uninitiated)