ipsec sa and acl question

[ronald.su]

hello, I wondering if ACL line number is equal sa number?

Scenario:

NY office has 1 subnet 192.168.0.0/24 and CA office has 2 subnets : 172.16.0.0/12 and 10.0.0.0/8

NY and CA have a ipsec vpn.

I wanna know it will generate 2 ipsec phase 2 sa ? 

[Milos_Jovanovic · Accepted solution]

Hi @ronald.su,

No, ACL line number is not necessarily equal to established SAs (assuming that is what you are asking). It is possible that you have 5 different ACL entries, and that only one SA is established (e.g. one that is #3 in your ACL). but, it is also possible to have all 5 SAs established.

BR,

Milos