How to tell if IPSec Tunnel is really encrypting 2

[retiredman2006]

I have 2 7206VXR routers with VAM cards and are serially connected via 2 T-1's running IOS 12.2(15T1)and would like to know if any one has any ideas how to verify that the data between these 2 routers is really being encrypted.

I'm using GRE encapsulation with the tunnel.

Cisco has signed off on saying I have everything configured correctly. I don't have a WAN Sniffer to check so any other ideas would be appreciated.

Thanks

 

[fmonteiro]

You may use the "show crypto engine connection active" commands that shows packet encryption/decryption counter per IPSec security association.

Other helpful crypto commands are:

debug crypto isakmp - Shows detailed information on Internet Key Exchange (IKE) phase I (Main Mode) negotiation.

debug crypto ipsec - Shows detailed information on IKE phase II (Quick Mode) negotiation.

debug crypto engine - Debugs packet encryption/decryption and Diffie-Hellman (DH) process.

debug ip ospf adj - Debugs OSPF neighbor adjacency establishment process.

show crypto isakmp sa - Shows all current Internet Security Association and Key Management Protocol (ISAKMP) security associations.

show crypto ipsec sa - Shows all current IPSec security associations.

 

[amirchd]

Hi,
the best way to verify the encryption is
sh access-lists

it will shows u all the access lists and number of hits, that way u can see how many how many hists on a specific access list. if acl shows no hits then data is not encrypted.

 

[tschouten]

____________________________________________________________
>>amirchd (IS/IT--Manageme) Jul 31, 2003
>>Hi,
>>the best way to verify the encryption is
>>sh access-lists

>>it will shows u all the access lists and number of hits, >>that way u can see how many how many hists on a specific >>access list. if acl shows no hits then data is not >>encrypted.
____________________________________________________________

HUH?!?!?!?!?!?!
Not sure what you are talking about up there.

Fmonteiros right, marking his post as helpful.