Downloads |
 Feedback
|
Table Of Contents
Prerequisites for the IPsec Diagnostics Enhancement
Restrictions for the IPsec Diagnostics Enhancement
Information About the IPsec Diagnostics Enhancement
Tracking Packet Processing Within a Switch or Router
How to Use the IPsec Diagnostics Enhancement
Clearing the Counters or Error History
Feature Information for the IPsec Diagnostics Enhancement
IPsec Diagnostics Enhancement
First Published: June 19, 2006Last Updated: June 19, 2006The Cisco IPsec Diagnostics Enhancement feature adds four sets of event statistics and an error history buffer to the Cisco IOS software for use in troubleshooting a virtual private network (VPN) that encrypts the data path.
Finding Feature Information in This Module
Your Cisco IOS software release may not support all of the features documented in this module. To reach links to specific feature documentation in this module and to see a list of the releases in which each feature is supported, use the "Feature Information for the IPsec Diagnostics Enhancement" section.
Finding Support Information for Platforms and Cisco IOS and Catalyst OS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•
Prerequisites for the IPsec Diagnostics Enhancement
•
•
•
•
Prerequisites for the IPsec Diagnostics Enhancement
•
Note
Restrictions for the IPsec Diagnostics Enhancement
•
Memory and Performance Impact
•
Information About the IPsec Diagnostics Enhancement
To use the enhanced diagnostic tools for troubleshooting an encryption data path, you should understand the following concept:
•
Tracking Packet Processing Within a Switch or Router
Standard packet analyzers used for troubleshooting network issues capture packets between devices in the network but they cannot capture packet processing events inside a device, such as a router. Beginning with Cisco IOS Release 12.4(9)T, Cisco IOS software includes four sets of event statistics to track packet processing within a switch or router. These statistics help Cisco TAC engineers diagnose and resolve issues in encrypted networks. Each set of statistics tracks a different aspect of packet processing within a switch or router:
•
•
•
•
You can view any one set of statistics, or all of them, or only those that have recorded errors. You must choose the display timeframe for the statistics, either realtime, which captures traffic statistics in real time, or snapshot, which captures statistics as of a single point in time.
How to Use the IPsec Diagnostics Enhancement
Note
This section contains the following tasks:
•
•
•
Displaying the Statistics
You can use the show crypto datapath command to display statistics that help troubleshoot an encrypted network. Use the keywords to specify the IP version used in the network (IPv4 or IPv6) and to specify whether to capture statistics in real time (realtime) or as of a single point in time (snapshot). You can also choose which statistics to display. The all keyword displays the output of all the counters, whether they have recorded events or not. The non-zero keyword displays only the output of counters that have recorded at least one event. Each of the other keywords displays one specific set of statistics, as described in the "Information About the IPsec Diagnostics Enhancement" section.
SUMMARY STEPS
1.
2.
DETAILED STEPS
Displaying the Error History
You can display the contents of the buffer that stores information from error events to diagnose the cause of errors. The show monitor event-trace command is updated with the cfd (crypto fault detection) keyword as a possible entry for the component argument to help with troubleshooting an encryption data path. Additional keywords allow you to specify the time span for which you want to display events. For example, you can display all events for the last 30 minutes.
For detailed information about the show monitor event-trace command, seethe Cisco IOS Configuration Fundamentals Command Reference.
SUMMARY STEPS
1.
2.
DETAILED STEPS
Clearing the Counters or Error History
You can use the clear crypto datapath command to clear the counters or error history buffer in an encrypted network. Use the appropriate keywords to clear all counters or one specific counter.
SUMMARY STEPS
1.
2.
DETAILED STEPS
Additional References
The following sections provide references related to the IPsec Diagnostics Enhancement.
Related Documents
Standards
No new or modified standards are supported by this feature, and support for existing standards has not been modified.
—
MIBs
RFCs
No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified.
—
Technical Assistance
Command Reference
This section documents new and modified commands only.
clear crypto datapath
To clear the counters or error history buffers in an encrypted network, use the clear crypto datapath command in privileged EXEC mode.
clear crypto datapath {ipv4 | ipv6} [error | internal | punt | success]
Syntax Description
Command Default
All counters are cleared, unless a keyword is entered to specify one counter.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use the clear crypto datapath command to clear the history buffers or counters associated with an encrypted data path. You must specify the IP version for the network. If you only use the IP version keyword, all counters will be cleared. To clear only a specific counter, enter the keyword for that counter.
Examples
The following example shows how to clear all the counters in a network using IP version 4:
Router# clear crypto datapath ipv4This example shows how to clear the success counter only:
Router# clear crypto datapath ipv4 successRelated Commands
show crypto datapath
Displays the counters associated with an encrypted data path.
show crypto datapath
To display the counters that help troubleshoot an encrypted data path, use the show crypto datapath command in privileged EXEC mode.
show crypto datapath {ipv4 | ipv6} {realtime | snapshot} {all | non-zero} [error | internal | punt | success]
Syntax Description
Command Default
The command defaults are:
•
•
•
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use the show crypto datapath counters command to troubleshoot an encrypted data path.
Note
You must specify the IP version used in the network. You can display all counters, only the counters that have recorded events, or one of these specific counters:
•
•
•
•
You must also choose the display timeframe for the counters:
•
•
Examples
The following example shows output from the show crypto datapath command. In this example, the snapshot option is specified for the timeframe, and only counters that have recorded events are displayed. The output of this command is intended for use by Cisco TAC engineers.
Router# show crypto datapath ipv4 snapshot non-zeroSuccess Statistics: Snapshot at 21:34:30 PST Mar 4 2006crypto check input core2nd round ok: 245 1st round ok: 118post crypto ip encryptpost encrypt ipflowok: 230crypto ceal post encrypt switchpost encrypt ipflowok-2: 230Error Statistics: Snapshot at 21:34:30 PST Mar 4 2006Punt Statistics: Snapshot at 21:34:30 PST Mar 4 2006crypto ceal post decrypt switchfs to ps: 245Internal Statistics: Snapshot at 21:34:30 PST Mar 4 2006crypto check inputcheck input core not con 378 check input core consume 623crypto check input corecame back from ce: 245 deny pak: 15crypto ipsec les fsnot esp or ah: 1113post crypto ip decryptdecrypt switch: 245crypto decrypt ipsec sa checkcheck ident success: 245crypto ceal post decrypt switchfs: 245crypto ceal post decrypt fsles ip turbo fs: 245 tunnel ip les fs: 245crypto ceal post decrypt psproc inline: 245crypto ceal punt to process inlinecoalesce: 245 simple enq: 245crypto ceal post encrypt switchps: 230crypto ceal post encrypt psps coalesce: 230 simple enq: 230crypto engine ps vecip encrypt: 230crypto send epa packetsucast next hop: 230 ip ps send: 230Related Commands
show monitor event-trace
To display event trace messages for Cisco IOS software subsystem components, use the show monitor event-trace command in privileged EXEC configuration mode.
show monitor event-trace [all-traces] [component {all | back time | clock time | from-boot seconds | latest | parameters}]
Syntax Description
Command Modes
Privileged EXEC
Command History
Usage Guidelines
Use the show monitor event-trace command to display trace message information.
The trace function is not locked while information is being displayed to the console, which means that new trace messages can accumulate in memory. If entries accumulate faster than they can be displayed, some messages can be lost. If this happens, the show monitor event-trace command will generate a message indicating that some messages might be lost; however, messages will continue to display on the console. If the number of lost messages is excessive, the show monitor event-trace command will stop displaying messages.
Use the bfd keyword for the component argument to display trace messages relating to the Bidirectional Forwarding Detection (BFD) feature.
Use the cfd keyword for the component argument to display trace messages relating to the crypto fault detection feature. This keyword will display the contents of the error trace buffers in an encryption data path.
Examples
Cisco IOS Releases 12.2(18)SXE, 12.0(31)S, and 12.4(4)T
Use the show monitor event-trace bfd all command to display logged messages for important BFD events in the recent past. The following trace messages show BFD session state changes:
Router# show monitor event-trace bfd all
3d03h: EVENT: Session [172.16.10.2,172.16.10.1,Fa6/0,1], event Sessioncreate, state Unknown -> Fail3d03h: EVENT: Session [172.16.10.2,172.16.10.1,Fa6/0,1], state Fail -> Down(from LC)3d03h: EVENT: Session [172.16.10.2,172.16.10.1,Fa6/0,1], state Down -> Init(from LC)3d03h: EVENT: Session [172.16.10.2,172.16.10.1,Fa6/0,1], state Init -> Up(from LC)3d07h: EVENT: Session [172.16.10.2,172.16.10.1,Fa6/0,2], event Sessioncreate, state Unknown -> Fail3d07h: EVENT: Session [172.16.10.2,172.16.10.1,Fa6/0,2], state Fail -> Down(from LC)3d07h: EVENT: Session [172.16.10.2,172.16.10.1,Fa6/0,2], state Down -> Up(from LC)To view trace information for all components configured for event tracing on the networking device, enter the show monitor event-trace all-traces command. In this example, separate output is provided for each event and message numbers are interleaved between the events.
Router# show monitor event-trace all-tracesTest1 event trace:3667: 6840.016:Message type:3 Data=01234567893669: 6841.016:Message type:4 Data=01234567893671: 6842.016:Message type:5 Data=01234567893673: 6843.016:Message type:6 Data=0123456789Test2 event trace:3668: 6840.016:Message type:3 Data=01234567893670: 6841.016:Message type:4 Data=01234567893672: 6842.016:Message type:5 Data=01234567893674: 6843.016:Message type:6 Data=0123456789CFD Component for Cisco IOS Release 12.4(9)T
To troubleshoot errors in an encryption datapath, enter the show monitor event-trace cfd all command. In this example, events are shown separately, each beginning with a timestamp, followed by data from the error trace buffer. Cisco TAC engineers can use this information to diagnose the cause of the errors.
Note
Router# show monitor event-trace cfd all00:00:42.452: 450000B4 00060000 FF33B306 02020203 02020204 32040000 F672999C 00000001 7A7690C2 A0A4F8BC E732985C D6FFDCC8 00000001 C0902BD0 A99127AE 8EAA22D4 00:00:44.452: 450000B4 00070000 FF33B305 02020203 02020204 32040000 F672999C 00000002 93C01218 2325B697 3C384CF1 D6FFDCC8 00000002 BFA13E8A D21053ED 0F62AB0E 00:00:46.452: 450000B4 00080000 FF33B304 02020203 02020204 32040000 F672999C 00000003 7D2E11B7 A0BA4110 CC62F91E D6FFDCC8 00000003 7236B930 3240CA8C 9EBB44FF 00:00:48.452: 450000B4 00090000 FF33B303 02020203 02020204 32040000 F672999C 00000004 FB6C80D9 1AADF938 CDE57ABA D6FFDCC8 00000004 E10D8028 6BBD748F 87F5E253 00:00:50.452: 450000B4 000A0000 FF33B302 02020203 02020204 32040000 F672999C 00000005 697C8D9D 35A8799A 2A67E97B D6FFDCC8 00000005 BC21669D 98B29FFF F32670F6 00:00:52.452: 450000B4 000B0000 FF33B301 02020203 02020204 32040000 F672999C 00000006 CA18CBC4 0F387FE0 9095C27C D6FFDCC8 00000006 87A54811 AE3A0517 F8AC4E64SPA Component Example
The following sample output illustrates the show monitor event-trace component latest command output for the spa component. The fields are self-explanatory.
Router# show monitor event-trace spa latest00:01:15.364: subslot 2/3: 4xOC3 POS SPA, TSM Event:inserted New state:wait_psm_readyspa type 0x44000:02:02.308: subslot 2/0: not present, TSM Event:empty New state:removespa type 0x0, fail code 0x0(none)00:02:02.308: subslot 2/0: not present, TSM Event:remove_complete New state:idle00:02:02.308: subslot 2/1: not present, TSM Event:empty New state:removespa type 0x0, fail code 0x0(none)00:02:02.308: subslot 2/1: not present, TSM Event:remove_complete New state:idle00:02:02.308: subslot 2/2: not present, TSM Event:empty New state:removespa type 0x0, fail code 0x0(none)00:02:02.308: subslot 2/2: not present, TSM Event:remove_complete New state:idle00:02:02.312: subslot 2/3: not present(plugin 4xOC3 POS SPA), TSM Event:empty New state:removespa type 0x0, fail code 0x0(none)00:02:02.312: subslot 2/3: not present, TSM Event:remove_complete New state:idleRelated Commands
Feature Information for the IPsec Diagnostics Enhancement
Table 1 lists the release history for this feature.
Not all commands may be available in your Cisco IOS software release. For release information about a specific command, see the command reference documentation.
Cisco IOS software images are specific to a Cisco IOS software release, a feature set, and a platform. Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which Cisco IOS and Catalyst OS software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2006 Cisco Systems, Inc. All rights reserved.
