VPN encrptions domains

VPN
1

Hi,

I have a basic question regarding VPN encryption domains. I’m curious if there are any CLI command for that, which I can’t find.

​

Thanks in advance

​

2
3

Checkmates has some great one liners that you can run via cli on the gateway, or from smartconsole

4

Once the tunnel is up, you can view the local vpn domain for each tunnel with the command `vpn tu tlist`. This would basically be the equivalent of `show crypto ipsec sa` on a Cisco router.

Viewing the full configuration is more difficult. The one-liner from CheckMates worked in R80.30 but I can’t get it working in R81.10.

5

Ok but which one of those? I cant see any specific one.

6

I run this one on my gateways - it will return the encryption domain for every peer in the community.

​

if [[ `$CPDIR/bin/cpprod_util FwIsFirewallModule 2>/dev/null` != *‘1’* ]]; then echo; tput bold; tput setab 1; echo ’ Not a firewall gateway! '; tput sgr0; echo; else if [[ `grep R80.40 /etc/cp-release | wc -l` != 0 ]]; then echo; tput bold; tput setab 1; echo -n ’ Info: VPN Domain for Gateway Communities are currently not displayed correctly by this tool! '; tput sgr0; echo; fi; fw tab -t vpn_routing -u | awk ‘NR>3 {$0=substr($0,2,28); gsub(“, “, “”); gsub(”; “, “”); gsub(”..”, "0x& "); print}’ | xargs printf “%d.%d.%d.%d %d.%d.%d.%d %d.%d.%d.%d\n” | awk ‘{print $3".“$1” - "$2}’ | sort -t . -k 1,1n -k 2,2n -k 3,3n -k 4,4n -k 5,5n -k 6,6n -k 7,7n -k 8,8n | sed ‘s/^/x/’ | sed ‘s/\./\n\t/4’ | awk ‘!x[$0]++’ | sed ‘/x/s/$/\n\tEncryption domain/’ | sed ‘s/x/\nVPN Gateway > /’ | if [[ $(cat /etc/cp-release) != *“Embedded”* ]]; then egrep -C 9999 --color=auto $‘VPN Gateway|Encryption domain’; else cat $1 | sed ‘s/^\t//’; fi; echo; fi; if [[ `grep R80.40 /etc/cp-release | wc -l` != 0 ]]; then tput bold; tput setab 1; echo -n ’ Info: VPN Domain for Gateway Communities are currently not displayed correctly by this tool! '; tput sgr0; echo; echo; fi

​

In case there’s issue with the copy/paste above - you can find the original here:

7

Hehe what a line.
Is there no more simple way?
Why does’nt it exists a inbuilt command for this, quite stranger?