Cisco AIM-VPN - DES/3DES VPN Data Encryption AIM... Manual de usuario

Corporate Headquarters:

Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA

DES/3DES/AES VPN Encryption Module

(AIM-VPN/EPII, AIM-VPN/HPII, AIM-VPN/BPII

Family)

The DES/3DES/AES VPN Encryption Module (AIM-VPN/EPII, AIM-VPN/HPII, AIM-VPN/BPII

Family) feature describes how to configure virtual private network (VPN) encryption hardware advanced

integration modules (AIM) and network modules (NM) in Cisco IOS Release 12.3(7)T.

Feature Specifications for the VPN Encryption Module

Finding Support Information for Platforms and Cisco IOS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image

support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on

Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at

the login dialog box and follow the instructions that appear.

Feature History

Release Modification

12.2(13)T This feature was introduced on the Cisco 2691, Cisco 3660, Cisco 3725,

and Cisco 3745.

12.2(15)ZJ This feature was introduced on the AIM-VPN/BPII on the following

platforms: Cisco 2610XM, Cisco 2611XM, Cisco 2620XM,

Cisco 2621XM, Cisco 2650XM, and Cisco 2651XM.

12.3(4)T This feature was integrated into Cisco IOS Release 12.3(4)T.

12.3(5) This feature was revised to include support for the AIM-VPN/EPII,

AIM-VPN/HPII family of encryption modules and was integrated into

Cisco IOS Release 12.3(5).

12.3(6) This feature was revised to include support for the AIM-VPN/BPII-Plus on

the 2600XM encryption modules and was integrated into Cisco IOS

Release 12.3(6).

12.3(7)T This feature was revised to include support for the AIM-VPN/BPII-Plus

family of encryption modules and was integrated into Cisco IOS Release

12.3(7)T.

DES/3DES/AES VPN Encryption Module (AIM-VPN/EPII, AIM-VPN/HPII, AIM-VPN/BPII Family)

Contents

Cisco IOS Release 12.3(7)T

Contents

•Prerequisites for DES/3DES/AES VPN Encryption Module, page 2

•How to Configure DES/3DES/AES VPN Encryption Module, page 3

•Additional References, page 3

•Command Reference, page 5

•Glossary, page 23

Prerequisites for DES/3DES/AES VPN Encryption Module

Installation Preconditions

•Cisco IOS Release 12.2(13)T or later.

Note See Table 1 for AIM/VPN Encryption Module support by Cisco IOS Release.

•A working IP network

For more information about configuring IP, refer to the Cisco IOS IP Configuration Guide, Release 12.3.

Choice of Encryption Module

Determine which VPN encryption module to use, as described in Table 1.

Table 1 AIM/VPN Encryption Module Support by Cisco IOS Release

Platform Encryption Module Support by Cisco IOS Release

12.2(13)T 12.3(4)T 12.3(5) 12.3(6) 12.3(7)T

Cisco 831 Software-based AES

Cisco 1710

Cisco 1711

Cisco 1721

Cisco 1751

Cisco 1760

Software-based AES

Cisco 2600 XM — AIM-VPN/BPII-Plus Hardware Encryption

Module

Cisco 2611 XM

Cisco 2621 XM

Cisco 2651 XM

— AIM-VPN/BPII Hardware Encryption Module AIM-VPN/BPII-Plus

Hardware Encryption

Module

Cisco 2691 XM AIM-VPN/EPII Hardware Encryption Module AIM-VPN/EPII-Plus

Hardware Encryption

Module

DES/3DES/AES VPN Encryption Module (AIM-VPN/EPII, AIM-VPN/HPII, AIM-VPN/BPII Family)

Restrictions for DES/3DES/AES VPN Encryption Module

Cisco IOS Release 12.3(7)T

Restrictions for DES/3DES/AES VPN Encryption Module

•Rivest-Shamir-Adelman (RSA) manual keying is not supported.

•To achieve maximum benefit from hardware-assisted IP Payload Compression Protocol (IPPCP), it

is suggested that prefragmentation be disabled if IP compression with the Limpel Zif Stac (LZS)

algorithm is enabled on IP Security (IPSec) sessions.

How to Configure DES/3DES/AES VPN Encryption Module

There are no configuration tasks specific to the encryption hardware. Both software-based and

hardware-based encryption are configured in the same way. The system automatically detects the

presence of an encryption module at bootup and uses it to encrypt data. If no encryption hardware is

detected, software is used to encrypt data.

Additional References

The following sections provide additional references pertaining to VPN Encryption Modules.

Related Topic Document Title

Installation of VPN encryption modules Installing Advanced Integration Modules in Cisco 2600 Series,

Cisco 3600 Series, and Cisco 3700 Series Routers

ISDN configuration Cisco IOS ISDN Voice Configuration Guide, Release 12.3

Cisco 2600 series Cisco 2600 series routers documentation index on Cisco.com

Cisco IOS References Cisco IOS Security Configuration Guide, Release 12.3

Cisco IOS Security Command Reference, Release 12.3

DES/3DES/AES VPN Encryption Module (AIM-VPN/EPII, AIM-VPN/HPII, AIM-VPN/BPII Family)

Additional References

Cisco IOS Release 12.3(7)T

Standards

MIBs

RFCs

Technical Assistance

Standards Title

No new or modified standards are supported by this

feature, and support for existing standards has not been

modified by this feature.

—

MIBs MIBs Link

No new or modified MIBs are supported by this

feature, and support for existing MIBs has not been

modified by this feature.

To locate and download MIBs for selected platforms, Cisco IOS

releases, and feature sets, use Cisco MIB Locator found at the

following URL:

http://www.cisco.com/go/mibs

RFCs Title

2401–2410 IPSec AH, ESP

2401–2411 IPsec/IKE

2401–2451 IPsec/IKE

AES (NIST) Advanced Encryption Standard and The National Institute of

Standards and Technology

Description Link

Technical Assistance Center (TAC) home page,

containing 30,000 pages of searchable technical

content, including links to products, technologies,

solutions, technical tips, and tools. Registered

Cisco.com users can log in from this page to access

even more content.

http://www.cisco.com/public/support/tac/home.shtml

DES/3DES/AES VPN Encryption Module (AIM-VPN/EPII, AIM-VPN/HPII, AIM-VPN/BPII Family)

Command Reference

Cisco IOS Release 12.3(7)T

Command Reference

This section documents modified commands. All other commands used with this feature are documented

in the Cisco IOS Release 12.3 command reference publications.

•clear crypto engine accelerator counter

•crypto engine accelerator

•show crypto engine

•show crypto engine accelerator statistic

•show crypto engine accelerator ring

•show diag

DES/3DES/AES VPN Encryption Module (AIM-VPN/EPII, AIM-VPN/HPII, AIM-VPN/BPII Family)

clear crypto engine accelerator counter

Cisco IOS Release 12.3(7)T

clear crypto engine accelerator counter

To reset the statistical and error counters for a router’s hardware accelerator to zero, use the clear crypto

engine accelerator counter command in privileged EXEC mode.

clear crypto engine accelerator counter

Syntax Description This command has no arguments or keywords.

Defaults No default behavior or values

Command Modes Privileged EXEC

Command History

Examples The following example shows the router’s statistical and error counters being cleared to zero:

Router# clear crypto engine accelerator counter

Related Commands

Release Modification

12.1(3)XL This command was introduced for the Cisco uBR905 cable access router.

12.2(2)XA Support was added for the Cisco uBR925 cable access router.

12.2(13)T This command was integrated into Cisco IOS Release 12.2(13)T and

implemented for the AIM-VPN/EPII & AIM-VPN/HPII on the following

platforms: Cisco 2691, Cisco 3660, Cisco 3725, and Cisco 3745.

12.2(15)ZJ This command was implemented for the AIM-VPN/BPII on the following

platforms: Cisco 2610XM, Cisco 2611XM, Cisco 2620XM,

Cisco 2621XM, Cisco 2650XM, and Cisco 2651XM.

12.3(4)T This command was integrated into Cisco IOS Release 12.3(4)T.

Command Description

crypto ca Defines the parameters for the certification authority used for a

session.

crypto cisco Defines the encryption algorithms and other parameters for a

session.

crypto dynamic-map Creates a dynamic map crypto configuration for a session.

crypto engine accelerator Enables the use of the onboard hardware accelerator for IPSec

encryption.

crypto ipsec Defines the IPSec security associations and transformation sets.

crypto isakmp Enables and defines the IKE protocol and its parameters.

crypto key Generates and exchanges keys for a cryptographic session.

crypto map Creates and modifies a crypto map for a session.

DES/3DES/AES VPN Encryption Module (AIM-VPN/EPII, AIM-VPN/HPII, AIM-VPN/BPII Family)

clear crypto engine accelerator counter

Cisco IOS Release 12.3(7)T

debug crypto engine accelerator

control

Displays each control command as it is given to the crypto

engine.

debug crypto engine accelerator

packet

Displays information about each packet sent for encryption and

decryption.

show crypto engine accelerator

ring

Displays the contents of command and transmits rings for the

crypto engine.

show crypto engine accelerator

sa-database

Displays the active entries in the crypto engine SA database.

show crypto engine accelerator

statistic

Displays the current run-time statistics and error counters for

the crypto engine.

show crypto engine brief Displays a summary of the configuration information for the

crypto engine.

show crypto engine configuration Displays the version and configuration information for the

crypto engine.

show crypto engine connections Displays a list of the current connections maintained by the

crypto engine.

Command Description

DES/3DES/AES VPN Encryption Module (AIM-VPN/EPII, AIM-VPN/HPII, AIM-VPN/BPII Family)

crypto engine accelerator

Cisco IOS Release 12.3(7)T

crypto engine accelerator

To enable a router’s onboard hardware accelerator for IPSec encryption, use the crypto engine

accelerator command in global configuration mode. To disable the use of the onboard hardware IPSec

accelerator, and thereby perform IPSec encryption/decryption in software, use the no form of this

command.

crypto engine accelerator

no crypto engine accelerator

Syntax Description This command has no arguments or keywords.

Defaults The hardware accelerator for IPSec encryption is enabled.

Command Modes Global configuration mode

Command History

Usage Guidelines This command is not normally needed for typical operations because the router’s onboard hardware

accelerator for IPSec encryption is enabled by default. The hardware accelerator should not be disabled

except on instruction from Cisco TAC personnel.

Examples The following example shows how to enable the router’s onboard hardware accelerator for IPSec

encryption. This operation is normally needed only after the accelerator has been disabled for testing or

debugging purposes.

Router(config)# no crypto engine accel

Warning! all current connections will be torn down.

Do you want to continue? [yes/no]:

Release Modification

12.1(3)T This command was introduced for the Cisco 1700 series router and other

Cisco routers that support hardware accelerators for IPSec encryption.

12.1(3)XL Support was added for the Cisco uBR905 cable access router.

12.2(2)XA Support was added for the Cisco uBR925 cable access router.

12.2(13)T This command was integrated into Cisco IOS Release 12.2(13)T and

implemented for the AIM-VPN/EPII & AIM-VPN/HPII on the following

platforms: Cisco 2691, Cisco 3660, Cisco 3725, and Cisco 3745.

12.2(15)ZJ This command was implemented for the AIM-VPN/BPII on the following

platforms: Cisco 2610XM, Cisco 2611XM, Cisco 2620XM,

Cisco 2621XM, Cisco 2650XM, and Cisco 2651XM.

12.3(4)T This command was integrated into Cisco IOS Release 12.3(4)T.

DES/3DES/AES VPN Encryption Module (AIM-VPN/EPII, AIM-VPN/HPII, AIM-VPN/BPII Family)

crypto engine accelerator

Cisco IOS Release 12.3(7)T

Related Commands Command Description

clear crypto engine accelerator

counter

Resets the statistical and error counters for the hardware

accelerator to zero.

crypto ca Defines the parameters for the certification authority used for a

session.

crypto cisco Defines the encryption algorithms and other parameters for a

session.

crypto dynamic-map Creates a dynamic map crypto configuration for a session.

crypto ipsec Defines the IPSec security associations and transformation sets.

crypto isakmp Enables and defines the IKE protocol and its parameters.

crypto key Generates and exchanges keys for a cryptographic session.

crypto map Creates and modifies a crypto map for a session.

debug crypto engine accelerator

control

Displays each control command as it is given to the crypto

engine.

debug crypto engine accelerator

packet

Displays information about each packet sent for encryption and

decryption.

show crypto engine accelerator

ring

Displays the contents of command and transmits rings for the

crypto engine.

show crypto engine accelerator

sa-database

Displays the active entries in the crypto engine SA database.

show crypto engine accelerator

statistic

Displays the current run-time statistics and error counters for the

crypto engine.

show crypto engine brief Displays a summary of the configuration information for the

crypto engine.

show crypto engine configuration Displays the version and configuration information for the

crypto engine.

show crypto engine connections Displays a list of the current connections maintained by the

crypto engine.

DES/3DES/AES VPN Encryption Module (AIM-VPN/EPII, AIM-VPN/HPII, AIM-VPN/BPII Family)

show crypto engine

Cisco IOS Release 12.3(7)T

show crypto engine

To displays a summary of the configuration information for the crypto engines, use the

show crypto engine command in privileged EXEC mode.

show crypto engine [brief | configuration]

Syntax Description

Command Modes Privileged EXEC

Command History

Usage Guidelines This command displays all crypto engines and displays the AIM-VPN product name.

Examples The following example of show crypto engine brief shows typical crypto engine information:

Router# show crypto engine brief

crypto engine name: Virtual Private Network (VPN) Module

crypto engine type: hardware

VPN Module in slot: 1

Product Name: AIM-VPN/EPII

Software Serial #: 55AA

Device ID: 0014

Vendor ID: 13A3

VSK revision: 0

Boot version: 255

DPU version: 0

HSP version: 2.0(0x0) (PRODUCTION)

Time running: 0 Seconds

Compression: Yes

DES: Yes

3 DES: Yes

AES CBC: Yes (128,192,256)

AES CNTR: No

Maximum buffer length: 4096

brief Displays a summary of the configuration information for the crypto engine.

configuration Displays the version and configuration information for the crypto engine.

Release Modification

11.2 This command was introduced on the Cisco 7200, RSP7000, and 7500

series routers.

12.2(15)ZJ This command was implemented for the AIM-VPN/BPII on the following

platforms: Cisco 2610XM, Cisco 2611XM, Cisco 2620XM,

Cisco 2621XM, Cisco 2650XM, and Cisco 2651XM.

12.3(4)T This command was integrated into Cisco IOS Release 12.3(4)T.

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Hardware de red de Cisco

Cisco

Cisco Gigabit Switch Router Cisco 12012 Manual de usuario

Cisco

Cisco NM-1A-T3 - 1port Ds3 Atm Network Module Manual de usuario

Cisco

Cisco 2650XM Manual de usuario

Cisco

Cisco ONS 15216-MD-40-ODD Manual de usuario

Cisco

Cisco CiscoWorks Wireless LAN Solution Engine Manual del operador

Cisco

Cisco FPR1150-ASA-K9 Manual

Cisco

Cisco CGR 1000 Series Manual de usuario

Cisco

Cisco ASR 901S Series Instrucciones de funcionamiento

Cisco

Cisco ONS 15454 SDH E1-75 Manual de usuario

Cisco

Cisco 40-Gigabit and 100-Gigabit CFP Transceiver... Guía de inicio rápido

Cisco

Cisco ASR 5000 Manual de instrucciones

Cisco

Cisco Edge 300 Series Guía de inicio rápido

Cisco

Cisco IAD2430 Series Manual

Cisco

Cisco Aironet 340 Series Manual de usuario

Cisco

Cisco IPS-4260-K9 - IPS Sensor 4260 Manual de usuario

Cisco

Cisco WAE-674-K9 - Wide Area Application Engine... Manual

Cisco

Cisco GS7000 Guía

Cisco

Cisco 5500 Series Manual de usuario

Cisco

Cisco Aironet 340 Series Cómo utilizar

Cisco

Cisco ONS 15310-MA SDH Manual

Cisco

Cisco AIR-BR350-A-K9 - Aironet 350 Wireless Bridge Manual

Cisco

Cisco SA520-K9 - SA 500 Series Security Appliances Manual de usuario

Cisco

Cisco Catalyst 2960-XR Manual de usuario

Cisco

Cisco ATA 191 Manual de usuario

Manuales populares de Hardware de red de otras marcas

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manual de usuario

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manual de usuario

Yudor

Yudor YDS-16 Manual de usuario

D-Link

D-Link ShareCenter DNS-320L Manual de usuario

Samsung

Samsung ES1642dc Instrucciones de uso

Honeywell Home

Honeywell Home LTEM-PV Instrucciones de montaje

evertz

evertz 7700 Series Manual de usuario

D-Link

D-Link ShareCenter DNS-343 Manual de usuario

Asante

Asante AsanteBridge 1012 Manual de usuario

FireBrick

FireBrick FB2700 Manual de usuario

Audiovox Electronics

Audiovox Electronics ARWH2T Manual de usuario

ADC

ADC DSX-1 Manual

NetComm

NetComm NF2 Manual de usuario

Alcatel-Lucent

Alcatel-Lucent 5620 Manual de usuario

Dell EMC

Dell EMC XC6420 Series Manual de usuario

Lanner

Lanner NCA-1020A Manual de usuario

Allied Telesis

Allied Telesis AT-TN121-A Manual de usuario

Arista

Arista CCA-ETM-Q12 Manual de usuario