| 14.6 |  | Task 4 - Test and Verify VPN Configuration |
| 14.6.5 |  | Show and clear the IPSec and IKE SAs |

| When changing the list of transform sets or when specifying a new list of transform sets to replace the old list, the change will not be applied to existing security associations. Instead, the set will be used in subsequent negotiations to establish new security associations. In order to expedite this process, it is possible to clear all or part of the security association database. This is done by using the clear crypto ipsec sa command. The clear crypto ipsec sa command only clears IPSec security associations. To clear IKE security associations, use the clear crypto isakmp sa command.

The show crypto ipsec sa command allows administrators to view the security associations. The SAs will first be sorted by interface, and then by traffic flow. For example, the proper order for sorting could be by source/destination address, then mask, then protocol, and then port. Within a flow, the security associations are listed by the ESP or AH protocol and the inbound or outbound direction.

IKE negotiations may be suspended when a PIX Security Appliance has numerous tunnels that originate from the PIX and terminate on a single remote peer. This problem occurs when the local peer makes many simultaneous rekey requests. If this problem occurs, the IKE security association will not recover until it has timed out or until it is manually cleared with the clear crypto isakmp sa command. PIX Security Appliances configured with many tunnels to many peers or many clients sharing the same tunnel are not affected by this problem.