show ip crypto-list

Last Updated : Aug 28, 2026 |
Displays all or specific crypto-list configurations.
Prolog information
Metadata
Keywords:

Syntax

show ip crypto-list [{list-number | {active-list | all} [detail] }]

Parameters

Parameter
Description
Possible Values
Default Value
list-number
The ID of the crypto-list for which to display configuration information
active-list
Keyword specifying to show all active crypto-lists
all
Keyword specifying to show all crypto-lists
detail
Keyword specifying to display detailed configuration information

User level

read-only

Context

general, interface:Dialer (L2, L2-L3)

Examples

To display the configuration of a specific crypto-list:
Gxxx-001(super)# show ip crypto-list 901
Index Description                     Status     Owner
----- ------------------------------- ---------  ------
901   VPN_via_leased_Line             valid      other
Local address: 210.210.210.210
Rules:
  Index Protocol     IP               Wildcard        Action  Crypto map
  ----- -------- --- ---------------- --------------- ------- ---------
  10     Any     Src  100.1.0.0       0.0.255.255     protect 1
                 Dst  10.1.1.0        0.0.0.255
  20     Any     Src  100.1.0.0       0.0.255.255     protect 1
                 Dst  10.1.11.0       0.0.0.255
  30     Any     Src  100.1.0.0       0.0.255.255     protect 2
                 Dst  10.2.1.0        0.0.0.255
  40     Any     Src  100.1.0.0       0.0.255.255     protect 2
                 Dst  10.2.11.0       0.0.0.255
  50     Any     Src  100.1.0.0       0.0.255.255     protect 3
                 Dst  10.3.1.0        0.0.0.255
  60     Any     Src  100.1.0.0       0.0.255.255     protect 3
                 Dst  10.3.11.0       0.0.0.255
  70     Any     Src  100.1.0.0       0.0.255.255     protect 22
                 Dst  100.2.0.0       0.0.255.255
  80     Any     Src  100.1.0.0       0.0.255.255     protect 23
                 Dst  100.3.0.0       0.0.255.255
  90     Any     Src  100.1.1.0       0.0.0.255       protect 24
                 Dst  100.4.0.0       0.0.255.255
  100    Any     Src  100.1.11.0      0.0.0.255       protect 24
                 Dst  100.4.0.0       0.0.255.255
  Deflt  Any     Src  Any                             bypass  -
                 Dst  Any
Applicable crypto maps:
  Id  Description         Remote peer/group   Transform-set   DSCP C-cnl
  --  ------------------  ------------------  --------------- ---- ----
   1  VoIP_2_HQ           101.101.101.110     ts1             copy No
   2  VoIP_2_Reg_1        102.102.102.151     ts2             copy No
   3  VoIP_2_Reg_2        reg2voip.vpn.com    ts3             copy No
  22  VoIP_2_B2           165.100.10.220      ts7             copy No
  23  VoIP_2_B3           152.152.152.230     ts17            copy No
To display all crypto-lists:
Gxxx-001(super)# show ip crypto-list
Index Description                     Status     Owner
----- ------------------------------- ---------  -----
900   Default Crypto List             valid      other
901   VPN_via-lease_Line              valid      other

Output fields

Name
Description
Index
The index of the crypto-list
Description
The user-defined description of the crypto-list
Status
Whether the crypto-list is valid or invalid. A crypto-list is valid if and only if all the crypto maps it points to exist and are valid. A crypto map is valid if and only if it is fully configured with all the obligatory parameters, and points to a valid ISAKMP peer.
Owner
This field exists for legacy purposes, and is not currently relevant
Local Address
The configured local address for the crypto-list. Can be either an IP address or an interface name.
Rules
The table of ip-rules, as follows:
Index
The index number of the ip-rule. Deflt indicates the default ip-rule.
Protocol
This field is reserved for future use
IP
The source or destination IP address of the rule. For each rule, the source IP is displayed first and the destination IP is displayed in the next line.
Wildcard
The source or destination wildcard of the rule. For each rule, the source wildcard is displayed first and the destination wildcard is displayed in the next line.
Action
Whether to protect traffic that matches the source and destination addresses, or bypass protection
Crypto map
The ID of the crypto map specifying how to protect traffic
Applicable crypto maps
The table of crypto maps pointed to by this crypto-list, as follows:
ID
Crypto map ID
Description
Crypto map description
Remote peer / Group
IP address or name of remote peer, or name of Peer Group
Transform-set
The name of the transform-set to which this crypto map points
DSCP
The tunnel DSCP configuration, which can be either
C-cnl
Whether IPSec continuous channel is enabled (
  • )
    		•