S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
22-15
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
OL-9285-05
Chapter 22 Troubleshooting IPsec
IPsec Issues
Security Associations Do Not Re-Key
A lifetime counter (in seconds and bytes) is maintained as soon as an SA is created. When the time limit
expires, the SA is no longer operational and is automatically renegotiated (re-keyed) if traffic is present.
If there is no traffic, the SA will not be re-keyed and the tunnel will go down.
The re-key operation starts when the soft lifetime expires. That happens approximately 20 to 30 seconds
before the time-based lifetime expires, or when approximately 10 to 20 percent of the bytes are
remaining in the bytes-based lifetime.
To troubleshoot this problem, follow these steps:
Step 1
Verify that traffic was flowing when the soft SA lifetime expired.
Step 2
Verify that the configurations are still compatible.
Clearing Security Associations
To clear a specific SA, obtain the SA index value and issue the
clear crypto sa domain ipsec interface
gigabitethernet
slot/port
outbound
sa-index
command.
To obtain the SA index value, issue the
show crypto sad domain ipsec
command.
Debugging the IPsec Process
Use the following commands to print debug messages to the console:
•
debug ipsec erro
r for error messages.
•
debug ipsec warning
for warning messages.
•
debug ipsec config
for configuration messages.
•
debug ipsec flow
for SA related messages.
Debugging the IKE Process
Use the following commands to show the internal state of the IKE process:
•
show crypto ike domain ipsec initiator
•
show crypto ike domain ipsec sa
Obtaining Statistics from the IPsec Process
To obtain statistics from the IPsec process, issue the
show crypto global domain ipsec
command and
the
show crypto global domain ipsec interface gigabitethernet
slot
/
port
command. The
show crypto
global domain ipsec
command output displays statistics for all SAs. Command output follows:
MDSA#
show crypto global domain ipsec
IPSec global statistics:
