Viewing security associations

Displaying security associations

You can use the ipsec sa show command to display any of the following:

The entire contents of the Security Associations Database (SAD)
An individual entry in the SAD identified by the Security Parameter Index (SPI)
To learn the SPI for a database entry, you must first display the entire contents of the SAD.
A group of entries that include all of the following:
- Source and destination addresses
- Security protocol (AH or ESP)
- Direction (relative to the filer)
- Upper-level protocols specified

To view the currently active security associations on a filer, complete the following step.

Step	Action
1	At the filer command line, enter the following command: *ipsec sa show [spi* \| options]**

The following example displays security association information for the device that has a source IP address of 10.56.19.172:

ipsec sa show 1 -s 10.56.19.172 -p esp

Alg/State/Spi Current Bytes/CreatedTime SrcIPAddr->DstIPAddr

------------- ------------------------- --------------------

esp/M/0001388 0/20 Aug 2002 17:28:19    10.56.19.172->10.56.19.173

The values for state are:

M Mature and active

D Dead

d Dying

L Larval (uninitiated)