Cisco MDS 9000 Series Configuration Manual page 219

Configuring IPSec Network Security
Displays the Specified Crypto Map Information
switch# show crypto map domain ipsec tag cm100
Crypto Map "cm100" 1 ipsec
Displays SA Association for the Specified Interface
switch# show crypto sad domain ipsec interface gigabitethernet 4/1
interface: GigabitEthernet4/1
Crypto map tag: cm10, local addr. 10.10.10.1
protected network:
local ident (addr/mask): (10.10.10.0/255.255.255.0)
remote
current_peer: 10.10.10.4
current outbound spi: 0x30e000f (51249167), index: 0
current inbound spi: 0x30e0000 (51249152), index: 0
Displays All SA Associations
switch# show crypto sad domain ipsec
interface: GigabitEthernet4/1
Crypto map tag: cm10, local addr. 10.10.10.1
protected network:
local
remote
current_peer: 10.10.10.4
current outbound spi: 0x30e000f (51249167), index: 0
current inbound spi: 0x30e0000 (51249152), index: 0
Displays Information About the Policy Database
switch# show crypto spd domain ipsec
Policy Database for interface: GigabitEthernet4/1, direction: Both
# 0:
# 1:
# 2:
# 63:
Policy Database for interface: GigabitEthernet4/2, direction: Both
# 0:
Peer = Auto Peer
IP ACL = acl100
permit ip 10.10.100.0 255.255.255.0 10.10.100.0 255.255.255.0
Transform-sets: 3des-md5, des-md5,
Security Association Lifetime: 4500 megabytes/3600 seconds
PFS (Y/N): N
Interface using crypto map set cm100:
GigabitEthernet4/2
ident (addr/mask): (10.10.10.4/255.255.255.255)
local crypto endpt.: 10.10.10.1, remote crypto endpt.: 10.10.10.4
mode: tunnel, crypto algo: esp-3des, auth algo: esp-md5-hmac
lifetimes in seconds:: 3600
lifetimes in bytes:: 423624704
lifetimes in seconds:: 3600
lifetimes in bytes:: 423624704
ident (addr/mask): (10.10.10.0/255.255.255.0)
ident (addr/mask): (10.10.10.4/255.255.255.255)
local crypto endpt.: 10.10.10.1, remote crypto endpt.: 10.10.10.4
mode: tunnel, crypto algo: esp-3des, auth algo: esp-md5-hmac
lifetimes in seconds:: 3600
lifetimes in bytes:: 423624704
lifetimes in seconds:: 3600
lifetimes in bytes:: 423624704
deny udp any port eq 500 any
deny udp any any port eq 500
permit ip 10.10.10.0 255.255.255.0 10.10.10.0 255.255.255.0
deny ip any any
deny udp any port eq 500 any <-----------------------UDP default entry
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
Displaying IPsec Configurations
201