topic Re: Encryption domain in Network Security

Encryption domain

TroyBolton — Tue, 28 Apr 2020 12:49:03 GMT

Hello,

What command would I run on an ASA to show the encryption domain(s)?

Regards

Troy

Re: Encryption domain

Rob Ingram — Tue, 28 Apr 2020 12:58:37 GMT

Hi,
The ASA uses access-lists to define the interesting traffic to be encrypted and transmitted over a VPN tunnel. Find the crypto map entry, then note the ACL being used to "match address", this references the ACL, E.g.

crypto map MAP 10 match address SITE1_VPN

access-list SITE1_VPN extended permit ip 10.20.0.0 255.255.252.0 10.10.0.0 255.255.252.0

HTH

Re: Encryption domain

Marius Gunnerud — Tue, 28 Apr 2020 13:55:16 GMT

Several commands you can use, but the best one in my opinion is (where xxx.xxx.xxx.xxx is the public IP of the site to site peer):

show crypto ipsec sa peer xxx.xxx.xxx.xxx