| 14.6 |  | Task 4 - Test and Verify VPN Configuration |
| 14.6.1 |  | Verify ACLs and interesting traffic |

| After preparing for VPN and configuring IKE Phase 1 and IPSec, the firewall administrator must verify the proper configuration. The verification process can save a significant amount of time when trying to troubleshoot a faulty IPSec connection. This section presents the methods and commands used to test and verify a VPN configuration.

As illustrated in Figures and , the following actions can be performed to test and verify correct configuration of an IPSec VPN on the PIX Security Appliance:

- Verify ACLs and select interesting traffic with the show access-list command.
- Verify correct IKE phase one configuration with the show isakmp and show isakmp policy commands.
- Verify correct IPSec algorithm configuration with the show crypto IPSec transform-set command.
- Verify the correct crypto map configuration with the show crypto map command.
- Clear IPSec and IKE SAs for testing of SA establishment with the clear crypto IPSec sa and the clear crypto isakmp sa commands.
- Debug IKE and IPSec traffic through the PIX Security Appliance with the debug crypto IPSec and debug crypto isakmp commands.