4-17
VPN Acceleration Module 2+ (VAM2+) Installation and Configuration Guide
OL-5979-03
Chapter 4 Configuring the SA-VAM2+
Configuration Tasks
Monitoring and Maintaining IPSec
To clear (and reinitialize) IPSec security associations, use one of the following commands in global
configuration mode:
To view information about your IPSec configuration, use one or more of the following commands in
EXEC mode:
IPSec Configuration Example
The following example shows a minimal IPSec configuration where the security associations will be
established via IKE. For more information about IKE, see the “Configuring Internet Key Exchange
Security Protocol” chapter.
An IPSec access list defines which traffic to protect:
access-list 101 permit ip 10.0.0.0 0.0.0.255 10.2.2.0 0.0.0.255
A transform set defines how the traffic will be protected. In this example, transform set “myset1” uses
DES encryption and SHA for data packet authentication:
crypto ipsec transform-set myset1 esp-des esp-sha
Command
Purpose
Router(config)#
clear crypto sa
or
Router(config)#
clear crypto sa counters
or
Router(config)#
clear crypto sa peer
{
ip-address
|
peer-name
}
or
Router(config)#
clear crypto sa map
map-name
or
Router(config)#
clear crypto sa entry
destination-address protocol spi
Clears IPSec security associations.
Note
Using the
clear crypto sa
command without parameters
will clear out the full SA database, which will clear out
active security sessions. You may also specify the
peer
,
map
, or
entry
keywords to clear out only a subset of the
SA database. For more information, see the
clear crypto
sa
command.
Command
Purpose
Router#
show crypto ipsec transform-set
Displays your transform set configuration.
Router#
show crypto map
[
interface
interface
|
tag
map-name
]
Displays your crypto map configuration.
Router#
show crypto ipsec sa
[
map
map-name
|
address
|
identity
] [
detail
]
Displays information about IPSec security associations.
Router#
show crypto dynamic-map
[
tag
map-name
]
Displays information about dynamic crypto maps.
Router#
show crypto ipsec security-association
lifetime
Displays global security association lifetime values.
