Show crypto isakmp sa command shows empty output in Cisco CSR 1000v

[mkumar29@in.ibm.com]

I have used below components to configure IPSec VPN between CSR and Fortigate.

IKEv2 Proposal
IKEv2 Policy
KEv2 Profile
IKEv2 Keyring
Crypto Map

crypto ikev2 keyring KR-1
peer SITE-2
address <x.x.x.x>
pre-shared-key <xxxx>

crypto ikev2 proposal 1
encryption aes-cbc-256
integrity sha256
group 14

crypto ikev2 policy 1
proposal 1

crypto ipsec transform-set <TS-Name> esp-aes 256 esp-sha256-hmac
mode tunnel

crypto ikev2 profile <3rd party>-Profile
match identity remote address <peer ip> 255.255.255.255
authentication local pre-share
authentication remote pre-share
keyring local KR-1

crypto map <name> ipsec-isakmp
set peer <peer ip>
set security-association lifetime seconds 28800
set transform-set <3rd party TS>
set ikev2-profile <3rd party>-Profile
match address <3rd party> - ACL

ACL has been defined with local and remote encryption

[Deepak Kumar]

Hi,

As this is IKev2 then commands are changed as:

• show crypto ikev2 sa - Displays the state of the phase 1 Security Association (SA).
• show crypto ipsec sa - Displays the state of phase 2 SA.

[mkumar29@in.ibm.com]

Thanks Deepak for pointing out commands

I have one more query, Why in Show crypto ikev2 sa -  multiple tunnel ID with same local and remote IP address with status as READY appears

[Deepak Kumar]

Hi,

Please share output so I can explain bit more.

[mkumar29@in.ibm.com]

Hi

As requested

I have attached the file and pasted here as well, and from other end (Fortigate), error is showing NO_PROPOSAL_CHOSEN

xxxx#show crypto ikev2 sa

IPv4 Crypto IKEv2 SA

Tunnel-id Local Remote fvrf/ivrf Status
943 A.A.A.A/500 B.B.B.B/500 none/none READY
Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 86400/82459 sec

Tunnel-id Local Remote fvrf/ivrf Status
14330 A.A.A.A/500 B.B.B.B/500 none/none READY
Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 86400/25099 sec

Tunnel-id Local Remote fvrf/ivrf Status
9897 A.A.A.A/500 B.B.B.B/500 none/none READY
Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 86400/44570 sec

Tunnel-id Local Remote fvrf/ivrf Status
7056 A.A.A.A/500 B.B.B.B/500 none/none READY
Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 86400/56655 sec

Tunnel-id Local Remote fvrf/ivrf Status
6419 A.A.A.A/500 B.B.B.B/500 none/none READY
Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 86400/59298 sec

Tunnel-id Local Remote fvrf/ivrf Status
4105 A.A.A.A/500 B.B.B.B/500 none/none READY
Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 86400/68682 sec

Tunnel-id Local Remote fvrf/ivrf Status
19227 A.A.A.A/500 B.B.B.B/500 none/none READY
Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 86400/5081 sec

Tunnel-id Local Remote fvrf/ivrf Status
2998 A.A.A.A/500 B.B.B.B/500 none/none READY
Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK
Life/Active Time: 86400/73462 sec

Tunnel-id Local Remote fvrf/ivrf Status
14114 A.A.A.A/500 B.B.B.B/500 none/none READY
Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:14, Auth sign: PSK, Auth verify: PSK
--More--

Regards

Manoj Kumar