proxy-id information through CLI -IPSEC Tunnels

[DNARNI]

To all,

I have multiple tunnels on PA 850. It was difficult to see through which tunnel specific traffic was sent. I tried "show vpn ipsec-sa" it gave me only Peer IP addresses but not proxy-IDs ( interesting traffic permitted through tunnel).

is there any CLI command which can tell not only local peer and remote peer but also permitted encryption traffic (added under proxy-ID tab). 

Monitor tab also didn't help as it shows which Firewall policy it was permitted by but no tunnel information in the logs too.

Thanks in advance

[SutareMayur · Accepted solution]

@DNARNI,

You can try cli command ,

show vpn tunnel name <name-of-proxy-id>

You will get information like LOCAL PROXY ID, REMOTE PROXY ID, ports etc in output.

Hope it helps!

Mayur

[DNARNI]

Thank you, I didnt notice show vpn tunnel earlier , my bad 🙂

[sachin_chauhan]

Hi Mayur,

So if I have many proxy IDs more than 100 for a single tunnel then would it show me all the proxy ID details in one command or I have to put all proxy ID one by one 100 times? 

[Jarmo_Hutri]

Hi,

Incase you haven't found out yet but you can list the proxy id's and everything else from the running config via CLI by entering config mode e.g.

- set cli config-output-format set

- configure 

- show network tunnel ipsec <name> 

or if you want to just get for example your enc domains

show network tunnel ipsec <name> | match local

same goes for IKE etc. you just need to be in config mode

Br. Jarmo