Which command can be used to verify that IPsec tunnels are established and to display the number of encrypted and decrypted packets for individual connections?
- show crypto map
- show crypto sockets
- show crypto pki
- show crypto isakmp sa detail
- show crypto ipsec sa detail
Explanation: The show crypto ipsec sa command (and its detailed version) is the primary tool used to verify the status of IPsec Security Associations (SAs) and monitor data-plane activity. According to the sources, this command provides comprehensive information for individual connections, including the local and remote crypto endpoints, the current outbound and inbound SPIs, and the specific transform sets being utilized.
Crucially, it displays real-time statistics for traffic passing through the tunnel, specifically showing the number of packets that have been encapsulated, encrypted, decapsulated, and decrypted. In the provided configuration examples, this command is used to confirm that a tunnel is operational by observing these counters increase after a successful ping.
While show crypto isakmp sa is also a vital verification command, the sources specify that it is used to validate the status of IKE peering (Phase 1) rather than the packet-level encryption statistics of the IPsec tunnel itself.
Related exam: Modules 17 – 20: Checkpoint Exam: Virtualization and Network Services Answers (CCNP ENCOR v9)
