Administration of the Avaya G350 Media Gateway - Avaya Support

IPSec VPN maintenanceTip:●●Use the show crypto ipsec sa list list-id [rule rule-id] [detail] CLIcommand to display the IPsec SA configuration by list ID and rule ID.Tip:The detail option in the various show crypto ipsec sa CLI commands,provides detailed counters information on each IPSec SA. To pinpoint the sourceof a problem, it is useful to check for a counter whose value grows with time.Use the clear crypto sa counters command to clear the crypto SA counters.IPSec VPN interventionYou can use the following clear CLI commands to intervene in IPSec VPN configuration:●●Use the clear crypto sa command to clear all IPSec SAs (security associationstructures).Use the clear crypto isakmp command to flush a specific entry in the ISAKMPdatabase or the entire ISAKMP database.Note:Note:If you wish to clear both an ISAKMP connection and the IPSec SAs, therecommended order of operations is:First clear the IPSec SAs using the clear crypto sa all command,then clear the ISAKMP SA using the clear crypto isakmp command.IPSec VPN loggingIPSec VPN logging allows you to view the start and finish of IKE phase 1 and IKE phase 2negotiations. Most importantly, it displays the configuration of both peers, so that you canpinpoint the problem in case of a mismatch between the IPSec VPN configuration of the peers.To view the IPSec VPN syslog:1. Use the set logging session enable command to enable syslog on the session.G350-001# set logging session enableDone!CLI-Notification: write: set logging session enableIssue 3 January 2005 219