Explanation #show crypto ipsec sa - This command shows IPsec SAs built between peers In the output you see #pkts encaps: 345, #pkts encrypt: 345, #pkts digest 0 #pkts decaps: 366, #pkts decrypt: 366, #pkts verify 0 which means packets are encrypted and decrypted by the IPsec peer. Source: http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/5409-ipsec- debug-00.html#ipsec_sa