I want to find out which phase 2 is associated with a particular phase 1 on cisco ASA device.

There are several phase 1 and phase 2 on the device. With the following commands, I can see the active SAs :

   show crypto isakamp sa details
   show crypto ipsec sa details

But there is only one active for each phase. The configuration itself does not explicitly say "This phase 2 is associated with this phase 1" like Fortigate 60D from Fortinet for example.

Referring to this doc on cisco website, I understand VPNs tunnels are established after trying each phase configuration until a match is found.

Is there a way to know on cisco ASA devices which phase 2 is associated with a particular phase 1 ?

2 Answers 2


Another useful vpn show command is:

show vpn-sessiondb detail l2l

ASA Command Reference Guide

This should give you what you are looking for. This command gives quite a bit of information for each tunnel that is negotiated. This can also be utilized to view other types of VPNs. The syntax may be slightly different depending on code version.

  • After some tries, I think it will always only show active tunnels. But At least, with this command, I can find out on the association between a phase 1 and several phase 2. Feb 23, 2016 at 22:09

One way is to display it with the specific peer ip.

Check Phase 1 Tunnel

ASA#show crypto isakmp sa detail | b [peer IP add]

Check Phase 2 Tunnel

ASA#show crypto ipsec sa peer [peer IP add]

Display the PSK

ASA#more system:running-config | b tunnel-group [peer IP add]

Display Uptime, etc.

ASA#sh vpn-sessiondb detail l2l | b [peer IP add]
  • Thanks for the tips. I had already tried the command above "sh vpn-sessiondb"and it is great for troubleshooting the configuration but it did not help me to find out which crypto map sequence is used on which isakamp policy. Feb 23, 2016 at 22:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.