Due to fragile SA spec regex the command fails with an exception if there are tunnels without PFS, because it expects the DH group field to be there.
vyos@vyos:~$ show vpn ipsec sa Traceback (most recent call last): File "/usr/libexec/vyos/op_mode/show_ipsec_sa.py", line 51, in <module> raise e File "/usr/libexec/vyos/op_mode/show_ipsec_sa.py", line 45, in <module> bytes_in = hurry.filesize.size(int(bytes_in)) TypeError: int() argument must be a string or a number, not 'NoneType'