可以查看 IKE 服务的属性、IKE 状态和 IKE 守护进程对象的各方面情况以及证书验证策略。如果运行两个 IKE 服务，可以显示每个服务或两个服务的信息。这些命令在测试、故障排除和监视过程中很有帮助。
查看 IKE 服务实例的属性－此输出可以显示 IKEv2 服务的可配置属性，包括配置文件的名称。
% svccfg -s ipsec/ike:ikev2 listprop config config application config/allow_keydump boolean false config/config_file astring /etc/inet/ike/ikev2.config config/ignore_errors boolean false config/kmf_policy astring /etc/inet/ike/kmf-policy.xml config/max_child_sas integer 0 config/max_threads integer 0 config/min_threads integer 0 config/preshared_file astring /etc/inet/ike/ikev2.preshared config/response_wait_time integer 30 config/value_authorization astring solaris.smf.value.ipsec config/debug_logfile astring config/debug_level astring op
以下示例中的输出显示了 IKEv1 服务的可配置属性。请勿指定 :default 服务实例。
% svccfg -s ipsec/ike listprop config config application config/admin_privilege astring base config/config_file astring /etc/inet/ike/config config/debug_level astring op config/debug_logfile astring /var/log/in.iked.log config/ignore_errors boolean false config/value_authorization astring solaris.smf.value.ipsec
查看 IKE 守护进程的当前状态－以下示例中的输出显示了 ikeadm 命令的参数。这些参数可以显示守护进程的当前状态。
% ikeadm help
...
get debug|priv|stats|p1|ikesa|rule|preshared|defaults [identifier]
dump p1|ikesa|rule|preshared|certcache|groups|encralgs|authalgs
read rule|preshared [filename]
help [get|set|add|del|dump|flush|read|write|token|help]
显示 ikeadm 命令的特定参数的语法－使用 help 子命令显示命令参数语法。例如：
% ikeadm help read
This command reads a new configuration file into
in.iked, discarding the old configuration info.
Sets of data that may be read include:
rule all phase 1/ikesa rules
preshared all preshared keys
A filename may be provided to specify a source file
other than the default.
查看预先共享的密钥－可以查看 IKEv1 和 IKEv2 的预先共享的密钥。
对于 IKEv2：
# ikeadm -v2 dump preshared
对于 IKEv1：
# ikeadm set priv keymat # ikeadm -v1 dump preshared PSKEY: Rule label: "Test PSK 197 to 56" PSKEY: Local pre-shared key (80 bytes): 74206272696c6c696720...3/584 PSKEY: Remote pre-shared key (80 bytes): 74206272696c6c696720...3/584 Completed dump of preshared keys
查看 IKE SA－此输出包括有关 SA、转换、本地和远程系统以及其他细节的信息。如果未请求通信，则 SA 不存在，也就不存在可显示的信息。
# ikeadm -v2 dump ikesa IKESA: SPIs: Local 0xd3db95689459cca4 Remote 0xb5878717f5cfa877 ... XFORM: Encryption alg: aes-cbc(256..256); Authentication alg: hmac-sha512 ... LOCIP: AF_INET: port 500, 10.1.2.3 (example-3). ... REMIP: AF_INET: port 500, 10.1.4.5 (ex-2). ... LIFTM: SA expires in 11459 seconds (3.18 hours) ... STATS: 0 IKE SA rekeys since initial AUTH. LOCID: Initiator identity, type FQDN ... CHILD: ESP Inbound SPI: 0x94841ca3, Outbound SPI 0x074ae1e5 ... Completed dump of IKE SA info
查看活动的 IKE 规则－已列出的 IKE 规则可能未被使用，但它可以使用。
# ikeadm -v2 dump rule GLOBL: Label 'Test Rule1 for PSK', key manager cookie 1 GLOBL: Local auth method=pre-shared key GLOBL: Remote auth method=pre-shared key GLOBL: childsa_pfs=false GLOBL: authentication_lifetime=86400 seconds (1.00 day) GLOBL: childsa_lifetime=120 seconds (2.00 minutes) GLOBL: childsa_softlife=108 seconds (1.80 minute) GLOBL: childsa_idletime=60 seconds GLOBL: childsa_lifetime_kb=122880 kilobytes (120.00 MB) GLOBL: childsa_softlife_kb=110592 kilobytes (108.00 MB) LOCIP: IP address range(s): LOCIP: 10.142.245.197 REMIP: IP address range(s): REMIP: 10.134.64.56 LOCID: Identity descriptors: LOCID: Includes: LOCID: fqdn="gloria@ms.mag" REMID: Identity descriptors: REMID: Includes: REMID: fqdn="gloria@ms.mag" XFRMS: Available Transforms: XF 0: Encryption alg: aes-cbc(128..256); Authentication alg: hmac-sha512 XF 0: PRF: hmac-sha512 ; Diffie-Hellman Group: 2048-bit MODP (group 14) XF 0: IKE SA lifetime before rekey: 14400 seconds (4.00 hours) Completed dump of policy rules
查看 IKEv2 中的证书验证策略－必须指定 dbfile 值和 policy 值。
动态下载的 CRL 可能要求管理员干预，对响应者超时进行调整。
在以下示例的输出中，先从证书中嵌入的 URI 下载 CRL，然后缓存列表。当高速缓存包含过期的 CRL 时，将下载新的 CRL 替换旧的 CRL。
# kmfcfg list dbfile=/etc/inet/ike/kmf-policy.xml policy=default
…
Validation Policy Information:
Maximum Certificate Revocation Responder Timeout: 10
Ignore Certificate Revocation Responder Timeout: true
…
CRL:
Base filename: [not set]
Directory: /var/user/ikeuser/crls
Download and cache CRL: true
CRL specific proxy override: www-proxy.cagate.example.com:80
Ignore CRL signature: false
Ignore CRL validity date: false
IPsec policy bypass on outgoing connections: true
…
当管理员将 CRL 项设定为以下值时，管理员负责手动下载 CRL、填充目录以及维护当前的 CRL：
…
Directory: /var/user/ikeuser/crls
Download and cache CRL: false
Proxy: [not set]
…