show ip crypto-list

Last Updated : Nov 06, 2012 |

Displays all or specific crypto-list configurations.

Syntax

show ip crypto-list [{list-number | {active-list | all} [detail] }]

Parameters

Parameter

Description

Possible Values

Default Value

list-number

The ID of the crypto-list for which to display configuration information

active-list

Keyword specifying to show all active crypto-lists

all

Keyword specifying to show all crypto-lists

detail

Keyword specifying to display detailed configuration information

User level

read-only

Context

general, interface:Dialer (L2, L2-L3)

Examples

To display the configuration of a specific crypto-list:

Gxxx-001(super)# show ip crypto-list 901
Index Description                     Status     Owner
----- ------------------------------- ---------  ------
901   VPN_via_leased_Line             valid      other
Local address: 210.210.210.210
Rules:
  Index Protocol     IP               Wildcard        Action  Crypto map
  ----- -------- --- ---------------- --------------- ------- ---------
  10     Any     Src  100.1.0.0       0.0.255.255     protect 1
                 Dst  10.1.1.0        0.0.0.255
  20     Any     Src  100.1.0.0       0.0.255.255     protect 1
                 Dst  10.1.11.0       0.0.0.255
  30     Any     Src  100.1.0.0       0.0.255.255     protect 2
                 Dst  10.2.1.0        0.0.0.255
  40     Any     Src  100.1.0.0       0.0.255.255     protect 2
                 Dst  10.2.11.0       0.0.0.255
  50     Any     Src  100.1.0.0       0.0.255.255     protect 3
                 Dst  10.3.1.0        0.0.0.255
  60     Any     Src  100.1.0.0       0.0.255.255     protect 3
                 Dst  10.3.11.0       0.0.0.255
  70     Any     Src  100.1.0.0       0.0.255.255     protect 22
                 Dst  100.2.0.0       0.0.255.255
  80     Any     Src  100.1.0.0       0.0.255.255     protect 23
                 Dst  100.3.0.0       0.0.255.255
  90     Any     Src  100.1.1.0       0.0.0.255       protect 24
                 Dst  100.4.0.0       0.0.255.255
  100    Any     Src  100.1.11.0      0.0.0.255       protect 24
                 Dst  100.4.0.0       0.0.255.255
  Deflt  Any     Src  Any                             bypass  -
                 Dst  Any
Applicable crypto maps:
  Id  Description         Remote peer/group   Transform-set   DSCP C-cnl
  --  ------------------  ------------------  --------------- ---- ----
   1  VoIP_2_HQ           101.101.101.110     ts1             copy No
   2  VoIP_2_Reg_1        102.102.102.151     ts2             copy No
   3  VoIP_2_Reg_2        reg2voip.vpn.com    ts3             copy No
  22  VoIP_2_B2           165.100.10.220      ts7             copy No
  23  VoIP_2_B3           152.152.152.230     ts17            copy No

To display all crypto-lists:

Gxxx-001(super)# show ip crypto-list
Index Description                     Status     Owner
----- ------------------------------- ---------  -----
900   Default Crypto List             valid      other
901   VPN_via-lease_Line              valid      other

Output fields

Name

Description

Index

The index of the crypto-list

Description

The user-defined description of the crypto-list

Status

Whether the crypto-list is valid or invalid. A crypto-list is valid if and only if all the crypto maps it points to exist and are valid. A crypto map is valid if and only if it is fully configured with all the obligatory parameters, and points to a valid ISAKMP peer.

Owner

This field exists for legacy purposes, and is not currently relevant

Local Address

The configured local address for the crypto-list. Can be either an IP address or an interface name.

Rules

The table of ip-rules, as follows:

Index

The index number of the ip-rule. Deflt indicates the default ip-rule.

Protocol

This field is reserved for future use

IP

The source or destination IP address of the rule. For each rule, the source IP is displayed first and the destination IP is displayed in the next line.

Wildcard

The source or destination wildcard of the rule. For each rule, the source wildcard is displayed first and the destination wildcard is displayed in the next line.

Action

Whether to protect traffic that matches the source and destination addresses, or bypass protection

Crypto map

The ID of the crypto map specifying how to protect traffic

Applicable crypto maps

The table of crypto maps pointed to by this crypto-list, as follows:

ID

Crypto map ID

Description

Crypto map description

Remote peer / Group

IP address or name of remote peer, or name of Peer Group

Transform-set

The name of the transform-set to which this crypto map points

DSCP

The tunnel DSCP configuration, which can be either copy or a decimal number in the range [0-63]

C-cnl

Whether IPSec continuous channel is enabled (Yes) or disabled (No)