show cmp

This chapter includes the show cmp command output tables. CMP refers to IPSec Certificate Management Protocol v2.


Important

The commands described in this chapter appear in the CLI for this release. However, they have not been qualified for use with any current Cisco StarOS gateway products.

show cmp history

Table 1. show cmp history Command Output Descriptions
Field Description

Trans id

Internal ID assigned to this Certificate Management Protocol v2 (CMPv2) transaction

Cert Name

CMPv2 certificate name

Src State

Possible source states:

  • INIT – the initial state generates the public and private keys for the Initialize Response/Enrollment Response message, builds these messages and sends them to the CA.

  • RESP WAIT – waiting for a response for any of Initialize Response, Enrollment Response, Update Response or Polling Response messages. The response messages are handled in this state and appropriate actions taken based on the PKIStatus of the response.

  • POLL WAIT – there is no outstanding request for the certificate but the CA has not yet signed the certificate and has returned a PKIStatus of "waiting".

  • READY – the certificate is signed by CA and is ready for use.

  • CLEANUP – This is an error handling state that handles all error transitions and results in cleanup activities for the certificate.

Trigger
Transaction trigger:

  • cp (Enrollment Response)

  • cr (Enrollment Request)

  • ip (Initialize Response)

  • ir (Initialize Request)

  • kup (Update Response)

  • kur (Update Request)

Dst State

Possible destination states:

  • INIT – the initial state generates the public and private keys for the Initialize Response/Enrollment Response message, builds these messages and sends them to the CA.

  • RESP WAIT – waiting for a response for any of Initialize Response, Enrollment Response, Update Response or Polling Response messages. The response messages are handled in this state and appropriate actions taken based on the PKIStatus of the response.

  • POLL WAIT – there is no outstanding request for the certificate but the CA has not yet signed the certificate and has returned a PKIStatus of "waiting".

  • READY – the certificate is signed by CA and is ready for use.

  • CLEANUP – This is an error handling state that handles all error transitions and results in cleanup activities for the certificate.

Status

Transaction status: OK or KEY_GEN_FAIL

show cmp outstanding-reg

Table 2. show cmp outstanding-req Command Output Descriptions
Field Description

Cert name

Name of the CMPv2 certificate

Current State

Possible states:

  • INIT – the initial state generates the public and private keys for the Initialize Response/Enrollment Response message, builds these messages and sends them to the Certificate Authority (CA).

  • RESP WAIT – waiting for a response for any of Initialize Response, Enrollment Response, Update Response or Polling Response messages. The response messages are handled in this state and appropriate actions taken based on the PKIStatus of the response.

  • POLL WAIT – there is no outstanding request for the certificate but the CA has not yet signed the certificate and has returned a PKIStatus of "waiting".

  • READY – the certificate is signed by CA and is ready for use.

  • CLEANUP – This is an error handling state that handles all error transitions and results in cleanup activities for the certificate.

Outstanding Message

Possible messages: None and those states listed above

show cmp statistics

Table 3. show cmp statistics Command Output Descriptions
Field Description

Protocol Statistics

Initialize Request (ir)

Number of Initialize Request messages

Initialize Response (ip)

Number of Initialize Response messages

Enrollment Request (cr)

Number of Enrollment Request messages

Enrollment Response (cp)

Number of Enrollment Response messages

Manual Update Request (kur)

Number of manual Update Request messages

Manual Update Response (kup)

Number of manual Update Response messages

Polling Request

Number of Polling Request messages

Polling Response

Number of Polling Response messages

Certconf Message

Number of Certificate Configuration messages

Error Message

Number of error messages

Accepted Initial Request

Number of accepted Initial Request messages

Accepted Enrollment Request

Number of accepted Enrollment Request messages

Accepted Update Request

Number of accepted Update Request messages

Accepted Polling Request

Number of accepted Polling Request messages

Auto Update (kur) Triggered

Number of times an automatic certificate update was triggered

Parse Response - CA Reject

Number of times messages have received Reject response from the Certificate Authority (CA)

Pkiconf Message

Number of Public Key Infrastructure (PKI) Configuration messages received

Response Timeout

Initialize Request (ir)

Number of Initialize Request timeouts

Enrollment Request (cr)

Number of Enrollment Request timeouts

Update Request (kur)

Number of Update Request timeouts

Certconf

Number of Certificate Configuration timeouts

PollReq

Number of Polling Request timeouts

Parse Failure

Initialize Response (ip)

Number of Initialize Response parsing error messages

Enrollment Response (cp)

Number of Enrollment Response parsing error messages

Update Response (kup)

Number of Update Response parsing error messages

Pkiconf Message

Number of PKI Configuration parsing error messages

Polling Response

Number of Polling Response parsing error messages

Unexpected Response Msg

Number of Unexpected Response messages

Message Build Failure

Initialize Request (ir)

Number of Initialize Request message build failures

Enrollment Request (cr)

Number of Enrollment Request message build failures

Update Request (kur)

Number of Update Request message build failures

Certconf Message

Number of Certificate Configuration build failures

Polling Request

Number of Polling Request message build failures

Internal Statistics

TCP Socket Connection Failure

Number of TCP socket connection failures

Failed Key Pair Generation

Number of times a key pair failed to be generated

Certificate Validation Failure

Number of times a certificate validation failed

Certificate Storage Failure

Number of times a certificate failed to be stored

Certificate Configuration Failure

Number of times a certificate failed to be configured

DNS Host Failures

Number of DNS host failures

Other Internal Error

Number of other internal errors

Manual CMP Certificate Cleared

Number of times a CMP certificate was manually cleared

Redundancy Statistics

Certificate Recovery Succeeded

Number of times a certificate was successfully recovered

Certificate Recovery Failed

Number of times a certificate failed to be recovered