ccna book in pdf

ccna book in pdf.8.4.7 Verifying IPSec Configuration and Troubleshooting8.4.7.1 Commands to Verify IPSec Configuration and Perform TroubleshootingVPNs can be complex and sometimes do not work as expected. Out of this, there are a variety of commands that can be used to verify the operation of the VPN and to perform troubleshooting if necessary. The best time to become familiar with these commands and their output is when the network is operating normally. This way, anomalies can be detected when troubleshooting with these commands.8.4.7.2 The IPSec show CommandUse the showcryptomap command to view all configured cryptomaps; this command verifies the configuration and displays the SA survival period. Many of the same settings can also be viewed using the command show running-config. Use the command show crypto isakmp policy to display the configured IKE policy and the default IKE policy settings. This command240 Chapter 8 Implementing Virtual Private Networksis useful because it can display all ISAKMP (IKE) configuration information. Use the command showcryptoipsectransform-set to display all configured transform sets. It is important to verify the strength of the IPSec protection policy since the transform set determines the level of protection available to the data as it travels through the tunnel.8.4.7.3 Verifying Security Federation-A more useful command is showcrypto ipsecsao If the output shows that an SA has been established, the rest of the configuration is assumed to be correct. The pkts encrypt and p as s decrypt values in the output message indicate that traffic is flowing through the tunnel. -An equally useful command is show crypto isakmp sa, which displays all current IKE SAs. for example, the status QM_IDLE indicates an active IKE SA.8.4.7.4 Troubleshooting VPN Connections