| 6.6 |  | Configure Site-to-Site IPSec VPN using Digital Certificates |
| 6.6.6 |  | Task 5 - test and verify IPSec |

| Cisco IOS software contains a number of show, clear, and debug commands useful for testing and verifying IPSec and ISAKMP. Administrators can perform the following actions to test and verify that they have correctly configured VPN using Cisco IOS:

- Display the configured IKE policies using the show crypto isakmp policy command.
- Display the configured transform sets using the show crypto IPSec transform set command.
- Display the current state of the IPSec SAs with the show crypto IPSec sa command.
- View the configured crypto maps with the show crypto map command.
- Debug IKE and IPSec traffic through the Cisco IOS with the debug crypto IPSec and debug crypto isakmp commands.
- Debug CA events through the Cisco IOS using the debug crypto key-exchange and debug crypto pki commands.

Use debug commands with caution. Enabling debugging can disrupt operation of the router because of the large amount of output. Before starting a debug command, always consider the output that this command will generate and the amount of time this may take. Also, look at the CPU load using the show processes cpu command. Verify that there is ample CPU time available before beginning the debugs.

| Lab Activity Lab Exercise: Configure IPSec using Digital Certificates In this lab, the student will learn the following objectives:

- Prepare for IKE and IPSec
- Configure CA support
- Configure IPSec
- Configure IKE
- Test and Verify IPSec
- Fine tune the ACL

| Lab Activity e-Lab Activity: Testing & Verifying IPSec In this activity, students will learn how to use show, clear, and debug commands for testing, troubleshooting and verifying IPSec and ISAKMP.

| Lab Activity e-Lab Activity: Configure Cisco IOS CA Support (RSA Signatures) In this lab activity, the student will configure a secure VPN gateway using IPSec between two Cisco routers using a certificate authority (CA) server.