Query regarding site to site vpn

[shoaib sheikh]

Hello everyone,

When I am checking " show crypto ipsec sa " output, I am getting hits for packets decapsulated but no hits on packets decrypted. Does this suggest that my ASA is receiving the packets but not able to decrypt it ?

#pkts encaps: 1416, #pkts encrypt: 1416, #pkts digest: 1416
#pkts decaps: 706, #pkts decrypt: 0, #pkts verify: 0

[Murali]

Yes , did you try clearing the SA's ? also did you check any log messages?

[shoaib sheikh]

Hi Murali,

I have cleared the tunnel but it is still the same result.

#pkts encaps: 3, #pkts encrypt: 3, #pkts digest: 3
#pkts decaps: 2, #pkts decrypt: 0, #pkts verify: 0

still decrypt is showing zero, does it mean the phase 2 is still not up and both firewall are not getting agreed on encryption parameters for phase 2 ?

pls suggest

[Mohammed al Baqari]

If you paste the entire output of show cry ips sa we can see if phase 2 is up or not. 

ASA process the encrypted packets in phases, 1st decapsulate by taking off outside header, then decrypt the payload and finally check the hashing for integrity. That is simple words but the details process is complex and resource intensive.