cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1503
Views
0
Helpful
0
Replies
Highlighted
Beginner

Interpretation of show crypto ipsec sa peer x.x.x.x platform command, Ipsec flapping

Hi guys how are you? Hope fine. I'm struggling a little bit with some IPsec tunnels that we have. The problem is the one that follows: We have a set of 300 devices more or less that connect to an ASR10002 via IPsec tunnels (devices are One Access routers, it is not a Cisco only environment). Tunnel concentrator characteristics below:

cisco ASR1002-X (2RU-X) processor (revision 2KP) with 3751430K/6147K bytes of memory.
6 Gigabit Ethernet interfaces
32768K bytes of non-volatile configuration memory.
8388608K bytes of physical memory.
6684671K bytes of eUSB flash at bootflash:.

Thing is that we are experiencing IPsec tunnel flapping like 7 or 8 times during the day. I came across the command in the title a day ago and I could see the following output (ips are hidden for security purposes):

CVPN1.DC1#show crypto ipsec sa peer X.X.X.X platform

interface: Virtual-Access265
    Crypto map tag: Virtual-AccessXXX-head-0, local addr 84.246.218.7

   protected vrf: 085087
   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   current_peer X.X.X.X port 4500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 512454, #pkts encrypt: 512454, #pkts digest: 512454
    #pkts decaps: 568985, #pkts decrypt: 568985, #pkts verify: 568985
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 84.246.218.7, remote crypto endpt.: 37.70.175.166
     plaintext mtu 1406, path mtu 1476, ip mtu 1476, ip mtu idb GigabitEthernet0/0/0
     current outbound spi: 0xC83D42A1(3359457953)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0x95979B26(2509740838)
        transform: esp-256-aes esp-sha256-hmac ,
        in use settings ={Tunnel UDP-Encaps, }
        conn id: 36715, flow_id: HW:34715, sibling_flags FFFFFFFF80000048, crypto map: Virtual-AccessXXX-head-0
        sa timing: remaining key lifetime (k/sec): (4228950/1961)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0xC83D42A1(3359457953)
        transform: esp-256-aes esp-sha256-hmac ,
        in use settings ={Tunnel UDP-Encaps, }
        conn id: 36716, flow_id: HW:34716, sibling_flags FFFFFFFF80000048, crypto map: Virtual-AccessXXX-head-0
        sa timing: remaining key lifetime (k/sec): (4429035/1961)
        IV size: 16 bytes
        replay detection support: Y
        Status: ACTIVE(ACTIVE)

     outbound ah sas:

     outbound pcp sas:
------------------ show platform software ipsec fp active flow identifier 34715 ------------------

=========== Flow id: 34715
               mode: tunnel
          direction: inbound
           protocol: esp
                SPI: 0x95979b26
      local IP addr: X.X.X.X
     remote IP addr: X.X.X.X
   crypto device id: 0
      crypto map id: 35244
             SPD id: 4186
         QFP SPD id: 1032
    ACE line number: 1
      QFP SA handle: 1297
IOS XE interface id: 5619
     interface name: Virtual-AccessXXX
   Crypto SA ctx id: 0x000000002d804bc4
             cipher: AES-256
               auth: SHA256
 initial seq.number: 0
      timeout, mins: 0
              flags: exp time;exp traffic;NAT-T;
Time limits

    soft limit(sec): 3407
    hard limit(sec): 3467
Traffic limits

     soft limit(kb): 4008960
     hard limit(kb): 4608000
-- NAT-T

     local UDP port: 4500
    remote UDP port: 4500
     inline_tagging: DISABLED
 anti-replay window: 64
SPI Selector:

   remote addr low: 0.0.0.0
  remote addr high: 0.0.0.0
    local addr low: X.X.X.X
   local addr high: X.X.X.X
Classifier: range

   src IP addr low: 0.0.0.0
  src IP addr high: 255.255.255.255
   dst IP addr low: 0.0.0.0
  dst IP addr high: 255.255.255.255
      src port low: 0
     src port high: 65535
      dst port low: 0
     dst port high: 65535
      protocol low: 0
     protocol high: 255
------------- Statistics

            octets(delta): 0
      total octets(delta): 4330445287
           packets(delta): 0
   dropped packets(delta): 0
      replay drops(delta): 0
      auth packets(delta): 0
        auth fails(delta): 0
 encrypted packets(delta): 0
     encrypt fails(delta): 0
---------- End statistics

       object state: active
--------------- AOM

         cpp aom id: 33820417
         cgm aom id: 0
          n2 aom id: 33820414
          if aom id: 0

------------------ show platform hardware qfp active feature ipsec sa 1297 ------------------


QFP ipsec sa Information

         QFP sa  id: 1297
          pal sa id: 34715
         QFP spd id: 1032
          QFP sp id: 1292
            QFP spi: 0x95979b26(2147483647)
         crypto ctx: 0x000000002d804bc4
              flags: 0xcc00800 (Details below)
                   : src:IKE  valid:True  soft-life-expired:False  hard-life-expired:False
                   : replay-check:True  proto:0  mode:3  direction:0
                   : qos_preclassify:False  qos_group:False
                   : frag_type:BEFORE_ENCRYPT  df_bit_type:COPY
                   : sar_enable:False  getvpn_mode:SNDRCV_SA
                   : doing_translation:False  assigned_outside_rport:False
                   : inline_tagging_enabled:False
          qos_group: 0x0
                mtu: 0x0=0
            mtu_adj: 0x0=0
          sar_delta: 0
         sar_window: 0x0
         sibling_sa: 0x0
             sp_ptr: 0x4935a540
            sbs_ptr: 0x52c0ebc0
     local endpoint: X.X.X.X/32
    remote endpoint: X.X.X.X/32
   cgid.cid.fid.rid: 0.0.0.0
               ivrf: 2403
               fvrf: 2403
    trans udp sport: 0
    trans udp dport: 0
    first intf name: Virtual-AccessXXX
  Statistics:

                      pkts: 570
                     bytes: 0x564e8
          pkt internal err: 0
           pkt soft expiry: 0
           pkt hard expiry: 0
        pkt replay dropped: 0
               seq  number: 0x0
         pkt policy failed: 0
         pkt authen failed: 0
             crypto failed: 0
           pkt decap encap: 570
         bytes decap encap: 0x4bfb2
  pkt dropped after crypto: 0
        no attempt dropped: 0

------------------ show platform software ipsec fp active encryption-processor 0 context 2d804bc4 ------------------

=======  Context id: 0x004bc4
               ULAM: 0x000005
                LBM: 0x000016
 max context length: 32
         fetch size: 20
       SA push size: 15
          SA word 0: 0x000000fc949b23
        action bits: 0x001f92
          direction: inbound
               mode: tunnel
           protocol: esp
     authentication: SHA-256
    confidentiality: AES-256
       outer header: IPv4
       inner header: IPv4
          udp encap: true
Anti-replay enabled: true
Anti-replay parameters:

        window size: 64
   window base(ESN): 569185
 traffic hard limit: 4325717712
 traffic soft limit: 3712300752
         byte count: 388313097
       packet count: 569163

------------------ show platform software ipsec fp active flow identifier 34716 ------------------

=========== Flow id: 34716
               mode: tunnel
          direction: outbound
           protocol: esp
                SPI: 0xc83d42a1
      local IP addr: X.X.X.X
     remote IP addr: X.X.X.X
   crypto device id: 0
      crypto map id: 35244
             SPD id: 4186
         QFP SPD id: 1032
    ACE line number: 1
      QFP SA handle: 1301
IOS XE interface id: 5619
     interface name: Virtual-AccessXXX
       use path MTU: 1476
   Crypto SA ctx id: 0x000000002d404bc3
             cipher: AES-256
               auth: SHA256
 initial seq.number: 0
      timeout, mins: 0
              flags: exp time;exp traffic;NAT-T;
Time limits

    soft limit(sec): 3407
    hard limit(sec): 3467
Traffic limits

     soft limit(kb): 4008960
     hard limit(kb): 4608000
-- NAT-T

     local UDP port: 4500
    remote UDP port: 4500
     inline_tagging: DISABLED
Classifier: range

   src IP addr low: 0.0.0.0
  src IP addr high: 255.255.255.255
   dst IP addr low: 0.0.0.0
  dst IP addr high: 255.255.255.255
      src port low: 0
     src port high: 65535
      dst port low: 0
     dst port high: 65535
      protocol low: 0
     protocol high: 255
------------- Statistics

            octets(delta): 0
      total octets(delta): 4535332500
           packets(delta): 0
   dropped packets(delta): 0
      replay drops(delta): 0
      auth packets(delta): 0
        auth fails(delta): 0
 encrypted packets(delta): 0
     encrypt fails(delta): 0
---------- End statistics

       object state: active
  object bind state: active
--------------- AOM

         cpp aom id: 33820422
         cgm aom id: 33820421
          n2 aom id: 33820418
          if aom id: 0

------------------ show platform hardware qfp active feature ipsec sa 1301 ------------------


QFP ipsec sa Information

         QFP sa  id: 1301
          pal sa id: 34716
         QFP spd id: 1032
          QFP sp id: 1292
            QFP spi: 0xc83d42a1(2147483647)
         crypto ctx: 0x000000002d404bc3
              flags: 0x4e40000 (Details below)
                   : src:IKE  valid:True  soft-life-expired:False  hard-life-expired:False
                   : replay-check:False  proto:0  mode:3  direction:1
                   : qos_preclassify:False  qos_group:False
                   : frag_type:AFTER_ENCRYPT  df_bit_type:COPY
                   : sar_enable:False  getvpn_mode:SNDRCV_SA
                   : doing_translation:False  assigned_outside_rport:False
                   : inline_tagging_enabled:False
          qos_group: 0x0
                mtu: 0x57e=1406
            mtu_adj: 0x568=1384
          sar_delta: 0
         sar_window: 0x0
         sibling_sa: 0x0
             sp_ptr: 0x4935a540
            sbs_ptr: 0x52b7f3c0
     local endpoint: X.X.X.X/32
    remote endpoint: X.X.X.X/32
   cgid.cid.fid.rid: 4186.35244.35244.2275147777
               ivrf: 2403
               fvrf: 2403
    trans udp sport: 0
    trans udp dport: 0
    first intf name: Virtual-AccessXXX
  Statistics:

                      pkts: 638
                     bytes: 0xc65d
          pkt internal err: 0
           pkt soft expiry: 0
           pkt hard expiry: 0
        pkt replay dropped: 0
               seq  number: 0x0
         pkt policy failed: 0
         pkt authen failed: 0
             crypto failed: 0
           pkt decap encap: 638
         bytes decap encap: 0x18058
  pkt dropped after crypto: 0
        no attempt dropped: 0

------------------ show platform software ipsec fp active encryption-processor 0 context 2d404bc3 ------------------

=======  Context id: 0x004bc3
               ULAM: 0x000005
                LBM: 0x000015
 max context length: 32
         fetch size: 22
       SA push size: 17
          SA word 0: 0x57e04e0fd249b21
        action bits: 0x001fa4
          direction: outbound
               mode: tunnel
           protocol: esp
     authentication: SHA-256
    confidentiality: AES-256
       outer header: IPv4
       inner header: IPv4
          udp encap: true
                mfs: 1406
   seq number reuse: false
    sequence number: 512735
 traffic hard limit: 4532515374
 traffic soft limit: 3919098414
         byte count: 183279251
       packet count: 512735

If you at the last lines I think there's a problem with ipsec traffic limit (lines in red). It seems we are reaching the limits there and the tunnel is coming down. Thing is that I'm not sure about that and I can't find any doc regarding that command and the meaning of its output. So I have the following questions...

1 - Can anyone confirm my thoughts? Did anyone treat a problem like this one before?

2 - Does anyone have sites, docs or any source where I can check the meaning of the output I've sent?

3 - If tunnel traffic reaches the limit (if there's a limit configured) does the concentrator bring the tunnel down and traffic and connections are lost or does it bring another tunnel up seamlessly without interrupting the service?

Any information regarding this will be apreciated. Thanks in advance for your help guys.

Regards,

Luis

 

 

Everyone's tags (5)