How to verify ISAKMP Aggressive mode using show command only?

[solidusin]

How to verify ISAKMP Aggressive mode using show command only?

[Marvin Rhoads]

"show crypto isakmp sa".

For active VPNs, part of the output will indicate either MM (Main Mode) or AM (Agressive Mode).

[solidusin]

I have tried all the relevant show commands but couldn't find AM anywhere

However, yes of course, the debug output does clearly show that.

but I wanted to find out the existing ISAKMP aggressive mode SA

Thanks in advance for further help!

[Marvin Rhoads]

Can you share your show command debug output? Is this a LAN-LAN or remote access VPN?

LAN-LAN will only be able to use AM (not generally recommended) in conjunction with certificates for authentication. PSK authentication method cannot use AM and must instead be MM.

[solidusin]

I have attached a text file in original discussion that has more information and debug output

[Marvin Rhoads]

Ah OK, my mistake. I was thinking ASA - I believe you are using an IOS-based VPN.

The state after establishment should be "QM Idle" (quick mode) - whether the Phase 1 was MM or AM.

I think you'll only see the AM in the debugs (like you have) or if you watch the output of the "show cry isa sa" command during establishment of the Phase 1 SA. If you're quick, you may see it cycle through as shown in this reference:

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-cr-book/sec-cr-s3.html#wp5743341910

[S M85]

Was searching for the same thing while working on my lab. 

Like Marvin said, you can't see this in IOS. If you do a isakmp debug you will notice this. 

MP:(1003):Input = IKE_MESG_FROM_PEER, IKE_AM_EXCH
ISAKMP:(1003):Old State = IKE_READY New State = IKE_R_AM2

AM -> aggressive mode. 

[aamberkar]

Please share the debug command for this output.