topic Re: proxy-id information through CLI -IPSEC Tunnels in General Topics

proxy-id information through CLI -IPSEC Tunnels

DNARNI — Thu, 16 Apr 2020 16:31:42 GMT

To all,

I have multiple tunnels on PA 850. It was difficult to see through which tunnel specific traffic was sent. I tried "show vpn ipsec-sa" it gave me only Peer IP addresses but not proxy-IDs ( interesting traffic permitted through tunnel).

is there any CLI command which can tell not only local peer and remote peer but also permitted encryption traffic (added under proxy-ID tab).

Monitor tab also didn't help as it shows which Firewall policy it was permitted by but no tunnel information in the logs too.

Thanks in advance

Re: proxy-id information through CLI -IPSEC Tunnels

SutareMayur — Fri, 17 Apr 2020 05:22:32 GMT

@DNARNI,

You can try cli command ,

show vpn tunnel name <name-of-proxy-id>

You will get information like LOCAL PROXY ID, REMOTE PROXY ID, ports etc in output.

Hope it helps!

Mayur

Re: proxy-id information through CLI -IPSEC Tunnels

DNARNI — Fri, 17 Apr 2020 05:29:49 GMT

Thank you, I didnt notice show vpn tunnel earlier , my bad 🙂

Re: proxy-id information through CLI -IPSEC Tunnels

sachin_chauhan — Wed, 06 Sep 2023 06:35:55 GMT

Hi Mayur,

So if I have many proxy IDs more than 100 for a single tunnel then would it show me all the proxy ID details in one command or I have to put all proxy ID one by one 100 times?

Re: proxy-id information through CLI -IPSEC Tunnels

Jarmo_Hutri — Wed, 21 Feb 2024 13:44:15 GMT

Hi,

Incase you haven't found out yet but you can list the proxy id's and everything else from the running config via CLI by entering config mode e.g.

- set cli config-output-format set

- configure

- show network tunnel ipsec <name>

or if you want to just get for example your enc domains

show network tunnel ipsec <name> | match local

same goes for IKE etc. you just need to be in config mode

Br. Jarmo

Re: proxy-id information through CLI -IPSEC Tunnels

N.Gurjar — Fri, 16 May 2025 10:28:56 GMT

hehe .... wish there was no cmd and you would have to put 100000 times...(jokin)

simply put the below cmd upon initial login (no need of configure mode)

show vpn tunnel

no need of a specific tunnel...just hit enter.

Re: proxy-id information through CLI -IPSEC Tunnels

N.Gurjar — Fri, 16 May 2025 10:34:17 GMT

And you can then save it as txt and export to Excel so you can filter and analyse.

And you may have to put in first the below cmd:

set cli config-output-format set