The way to check IPSec on ASR

 On ASR platform, there is not exact the same as IOS platform to check the IPSEC
  

• On the IOS:

GM1#show crypto ipsec sa

interface: Serial1/0
    Crypto map tag: gm1map, local addr 10.1.13.2

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)
   current_peer 0.0.0.0 port 848
     PERMIT, flags={}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0
    #pkts not decompressed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 10.1.13.2, remote crypto endpt.: 0.0.0.0
     path mtu 1500, ip mtu 1500, ip mtu idb Serial1/0
     current outbound spi: 0x0(0)
     PFS (Y/N): N, DH group: none

     local crypto endpt.: 10.1.13.2, remote crypto endpt.: 0.0.0.0
     path mtu 1500, ip mtu 1500, ip mtu idb Serial1/0
     current outbound spi: 0x8BF147EF(2347845615)
     PFS (Y/N): N, DH group: none

     inbound esp sas:
      spi: 0x8BF147EF(2347845615)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 1, flow_id: SW:1, sibling_flags 80000040, crypto map: gm1map
        sa timing: remaining key lifetime (sec): (192)
        Kilobyte Volume Rekey has been disabled
        IV size: 8 bytes
        replay detection support: Y  replay window size: 4
        Status: ACTIVE(ACTIVE)

     inbound ah sas:

     inbound pcp sas:

     outbound esp sas:
      spi: 0x8BF147EF(2347845615)
        transform: esp-3des esp-sha-hmac ,
        in use settings ={Tunnel, }
        conn id: 2, flow_id: SW:2, sibling_flags 80000040, crypto map: gm1map
        sa timing: remaining key lifetime (sec): (192)
        Kilobyte Volume Rekey has been disabled
        IV size: 8 bytes
        replay detection support: Y  replay window size: 4
        Status: ACTIVE(ACTIVE)

     outbound ah sas:

     outbound pcp sas:
GM1#

• But on the IOS-XR:

>>>>>>>> to show the  Isakmp sa <<



RP/0/RSP0/CPU0:bnciro2a#   show crypto isakmp sa
Wed Jan 11 10:22:19.974 CET

IPv4 Crypto ISAKMP SA
         dst                 src              state         status
    10.23.203.65        10.23.203.82          Up           ACTIVE



RP/0/RSP0/CPU0:bnciro2a#show crypto session


Crypto map tag: G-VPN-MAP-td_m2m_sec_ref
Interface:
  TenGigE0_1_1_0.2624
Session status: UP_ACTIVE
Peer: 10.23.203.65 port 848
IKEv1 SA: local 10.23.203.82/848 remote 10.23.203.65/848 Active
IPSEC FLOW:  permit ipv4 any any
    Active SAs: 2



Crypto map tag: G-VPN-BLOCK_PRODUCTION_WAN
Interface:
  TenGigE0_1_1_0
Session status: UP_ACTIVE
Peer: 10.23.203.65 port 848
IKEv1 SA: local 10.23.203.82/848 remote 10.23.203.65/848 Active
IPSEC FLOW:  permit ipv4 any any
    Active SAs: 2



Crypto map tag: G-VPN-MAP-tm_sig_sec_ref
Interface:
  TenGigE0_1_1_0.2610
Session status: UP_ACTIVE
Peer: 10.23.203.65 port 848
IKEv1 SA: local 10.23.203.82/848 remote 10.23.203.65/848 Active
IPSEC FLOW:  permit ipv4 any any
    Active SAs: 2


>>>>>>>> to show the  IPSEC sa <<

RP/0/RSP0/CPU0:bnciro2a#show crypto ipsec-tunnel sa
Wed Jan 11 10:12:21.844 CET



Interface:
  TenGigE0_2_1_1.404     Protected vrf: DSA_A-B
  Crypto map tag: G-VPN-MAP-DSA_A-B_BCK

  TenGigE0_2_0_3.404     Protected vrf: DSA_A-B
  TenGigE0_2_1_1.405     Protected vrf: DSA_A-C
  Crypto map tag: G-VPN-MAP-DSA_A-C

  TenGigE0_2_0_3.405     Protected vrf: none
  Crypto map tag: G-VPN-MAP-DSA_A-C_BCK

  local addr 10.23.203.82
  local and remote  ident (prot/srcaddr/mask/dstaddr/

mask/srcport/dstport):
        ipv4 any any  0 0
  Group: dsa_sec_mobile
  current_peer: 0.0.0.0 port 848

  #pkts  in: 5701024678, #pkts encrypt: 5703695586, #pkts digest: 5703695586
  #pkts out: 5703695586, #pkts decrypt: 5701024678, #pkts verify: 5701024678
  #pkts encrypt errors: 0, #pkts digest errors: 0
  #pkts decrypt errors: 0, #pkts verify errors: 0
  #pkts  in selector errors: 0, #pkts  in h/w submission errors: 0, #pkts in h/w processing errors: 0
  #pkts out selector errors: 0, #pkts out h/w submission errors: 0, #pkts out h/w processing errors: 0

  local crypto endpt.: 10.23.203.82, remote crypto endpt.: 0.0.0.0
  current outbound spi: 0x88CD5E38(2295160376)
  PFS (Y/N): N, DH group: None

  inbound esp sas:
   spi: 0x88CD5E38(2295160376)
    transform:   esp_aes_256 esp_sha256_hmac
    in use settings ={Tunnel}
    sa timing: remaining key lifetime (sec): (16953.120352)
    replay detection support: N
    Status: ACTIVE(ACTIVE)

  outbound esp sas:
   spi: 0x88CD5E38(2295160376)
    transform:   esp_aes_256 esp_sha256_hmac
    in use settings ={Tunnel}
    sa timing: remaining key lifetime (sec): (16953.120352)
    replay detection support: N
    Status: ACTIVE(ACTIVE)

  inbound esp sas:
   spi: 0x11B9A8F9(297380089)
    transform:   esp_aes_256 esp_sha256_hmac
    in use settings ={Tunnel}
    sa timing: remaining key lifetime (sec): (60165.84048)
    replay detection support: N
    Status: ACTIVE(ACTIVE)

  outbound esp sas:
   spi: 0x11B9A8F9(297380089)
    transform:   esp_aes_256 esp_sha256_hmac
    in use settings ={Tunnel}
    sa timing: remaining key lifetime (sec): (60165.84048)
    replay detection support: N
    Status: ACTIVE(ACTIVE)