1

Not very good with ASAs so please have that in mind.
I need to replace an ASA but can't seem to get some info on Phase 1 and Phase 2. I can get everything from Phase 1 except the DH group (got PFS Group 1, how does this translate?) and from Phase 2 i can't also get the lifetime.

For this i got the following:
show crypto ips sa
interface: ISP2 Crypto map tag: outside_map, seq num: 1, local addr: 216.x.x.x

  access-list outside_cryptomap extended permit ip 10.10.x.x 255.255.255.0 192.168.16.0 255.255.255.0 
  local ident (addr/mask/prot/port): (10.10.x.x/255.255.255.0/0/0)
  remote ident (addr/mask/prot/port): (192.x.x.x/255.255.255.0/0/0)
  current_peer: 66.x.x.x


  #pkts encaps: 1475193, #pkts encrypt: 1475193, #pkts digest: 1475193
  #pkts decaps: 998141, #pkts decrypt: 998141, #pkts verify: 998141
  #pkts compressed: 0, #pkts decompressed: 0
  #pkts not compressed: 1475193, #pkts comp failed: 0, #pkts decomp failed: 0
  #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
  #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
  #TFC rcvd: 0, #TFC sent: 0
  #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
  #send errors: 0, #recv errors: 0

  local crypto endpt.: 216.x.x.x/0, remote crypto endpt.: 66.x.x.x/0
  path mtu 1500, ipsec overhead 58(36), media mtu 1500
  PMTU time remaining (sec): 0, DF policy: copy-df
  ICMP error validation: disabled, TFC packets: disabled
  current outbound spi: 48186D7D
  current inbound spi : F51B80AE

inbound esp sas:
  spi: 0xxxxxx (xxxxxxx)
     transform: esp-3des esp-sha-hmac no compression 
     in use settings ={L2L, Tunnel, PFS Group 1, IKEv1, }
     slot: 0, conn_id: 4096, crypto-map: outside_map
     sa timing: remaining key lifetime (kB/sec): (4361108/20145)
     IV size: 8 bytes
     replay detection support: Y
     Anti replay bitmap: 
      0xFFFFFFFF 0xFFFFFFFF
outbound esp sas:
  spi: 0xxxxxxxx (xxxxxxxxx)
     transform: esp-3des esp-sha-hmac no compression 
     in use settings ={L2L, Tunnel, PFS Group 1, IKEv1, }
     slot: 0, conn_id: 4096, crypto-map: outside_map
     sa timing: remaining key lifetime (kB/sec): (4341378/20145)
     IV size: 8 bytes
     replay detection support: Y
     Anti replay bitmap: 
      0x00000000 0x00000001

I have the show run and also the output of: show crypto ikev1 sa detail
show crypto ips sa
show vpn-sessiondb detail l2l

What commands do i need to be running to get everything i need?

Thanks,

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Apr 1, 2018 at 21:27

1 Answer 1

Reset to default
1

You can get most of the configuration with show running-config. For IPSec VPN Pre-Shared Key, you would see it from the output of more system:running-config command.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.