Site-to-Site VPN
Here are some site-to-site vpn verification commands for the below topology that was re-created using EVE-NG.
Show crypto isakmp sa
Traffic emanating from 192.168.0.10(VPC2) hitting the Remote (23.0.0.2) router where the ipsec tunnel is established and headed to the Corp-Office(13.0.0.2) with the status ACTIVE. The second verification command:
show crypto ipsec sa
Now this output can really daunting at first just due to the amount of information that is displayed here but there are a few key things to watch out for. Such as the #pkts encaps/encrypt/decap/decrypt, these numbers tell us how many packets have actually traversed the IPSec tunnel and also verifies we are receiving traffic back from the remote end of the VPN tunnel. The interesting traffic was created by pinging from 192.168.0.10 (VPC2) to 172.16.0.10 (VPC1). This will also tell us the local and remote SPI, transform-set, DH group, & the tunnel mode for IPSec SA.
