Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Crypto ISAKMP SA

Hi All,

I have configured a tunnel between 2 sites. I had originally configured Diffie Hellman Group 1 on the ISAKMP policy on remote and Hub end.

I have changed the DH group to 2 now. I can see that the Tunnels and Eigrp are up still, and traffic is flowing across as well (getting encrypted etc ).

But, when I do a "Show crypto isakmp sa", I do not get any output. Does that mean there is no SA running between these 2 devices?? How can the tunnels be UP if there is no SA?

Appreciate your reply.

Cheers

Navneet

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Silver

Re: Crypto ISAKMP SA

Navneet

There are perhaps 2 parts in the answer to your question.

1) there is an SA for ISAKMP and an SA for IPSec. Encryption of traffic uses the IPSec SA and not the ISAKMP SA. So it is possible that traffic is being encrypted because there is an IPSec SA while there may not be an ISAKMP SA.

2) an SA has a lifetime and then it expires. It is possible that there was an ISAKMP SA (which is required to negotiate the IPSec SA) and that the ISAKMP SA expired by the time you looked for it.

HTH

Rick

4 REPLIES
New Member

Re: Crypto ISAKMP SA

Appreciate if someone replies to the query above.

Thanks in advance

Regards

Navneet

Hall of Fame Super Silver

Re: Crypto ISAKMP SA

Navneet

There are perhaps 2 parts in the answer to your question.

1) there is an SA for ISAKMP and an SA for IPSec. Encryption of traffic uses the IPSec SA and not the ISAKMP SA. So it is possible that traffic is being encrypted because there is an IPSec SA while there may not be an ISAKMP SA.

2) an SA has a lifetime and then it expires. It is possible that there was an ISAKMP SA (which is required to negotiate the IPSec SA) and that the ISAKMP SA expired by the time you looked for it.

HTH

Rick

New Member

Re: Crypto ISAKMP SA

Hi rick,

Thanks for your reply!! I checked on the crypto ACLs and could see that the traffic count was increasing. Also, on the IPSEC SA, i could see the packets getting encrypted. So I guess, iam safe with the configs.

Thanks for your answer ;)

Cheers

Navneet

Hall of Fame Super Silver

Re: Crypto ISAKMP SA

Navneet

Probably you are safe with the configs. But be aware that there is a possibility that the IPSec SAs were negotiated with the old setting in the config. You could wait a bit and see if the SA expires and a new SA gets negotiated. Or you could clear the crypto IPSec SAs, send some traffic, and verify that new SAs get negotiated.

HTH

Rick

192
Views
0
Helpful
4
Replies