Which of the following commands can display the IPSec SA negotiation results and IPSec policy configuration information?

Question

Options

• Adisplay ike sa
• Bdisplay ipsec statistics
• Cdisplay ipsec sa
• Ddisplay ike peer

• A
  8% (2)
• B
  15% (4)
• C
  73% (19)
• D
  4% (1)

Explanation

display ipsec sa (option C) shows both IPSec Security Association negotiation results AND the IPSec policy configuration information bound to those SAs, making it the single command that satisfies both requirements in the question.

• A (display ike sa) - Shows IKE (Phase 1) SAs only; IKE is the key-exchange protocol that sets up IPSec, but this command doesn't display the resulting IPSec (Phase 2) SA details or policy config.
• B (display ipsec statistics) - Shows traffic counters and packet/byte statistics for IPSec tunnels, not SA negotiation state or policy configuration.
• D (display ike peer) - Shows IKE peer configuration (remote IP, authentication mode, etc.), which is pre-negotiation config, not negotiation results.

Memory tip: Think of the phases - IKE commands (ike sa, ike peer) relate to Phase 1 key exchange setup, while ipsec sa shows Phase 2 results. When the question asks for both negotiation results and policy info, you need the command that lives at the IPSec level, not the IKE level.

No community discussion yet for this question.