A network administrator is setting up a site-to-site VPN from a Cisco FTD to a cloud environment. After the administrator configures the VPN on both sides, they still cannot reach the cloud…

The `show crypto ipsec sa` command displays detailed information about the IPsec Security Associations (SAs), including the number of packets encrypted and decrypted, which directly verifies if traffic is actively flowing through and being processed by the VPN tunnel in both directions.

The `show crypto ipsec stats` command provides overall IPsec statistics and error counts, but it does not show individual SA status or per-SA packet encryption/decryption counts to confirm active traffic flow.

The `show vpn-sessiondb detail l2l` command shows the status of VPN sessions but provides less specific detail about the active IPsec encryption and decryption of traffic compared to `show crypto ipsec sa`.

The `show crypto isakmp sa` command displays the status of the Phase 1 IKE/ISAKMP Security Association, which handles key exchange, but it does not directly show whether actual data traffic is being encrypted and decrypted in Phase 2 via IPsec.