Security (IPSec) Encryption-CHS版12

If you do a ping test across the encrypted link when you finish your configuration, the negotiation process can take some time (about six seconds on a Cisco 4500, and about 20 seconds on a Cisco 2500) because SAs have not yet been negotiated. Even though everything is configured correctly, your ping can initially fail. The debug crypto ipsec and debug crypto isakmp commands show you what goes on. Once your encrypted datastreams have finished their set up, the ping works fine.

If you run into trouble with your negotiation(s) and make configuration changes, use the clear crypto is and clear crypto sa commands in order to

页码：[1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] 第12页、共13页