Not able to execute crypto command on voice router

[shihab.kp]

iam configuring Cisco Voice gateway ISR 4321 for Webex calling. but i am not able to enter the following command in sip-ua and it is showing crypto as unrecognized command . Please help me to resolve this issue.

sip-ua
crypto signaling default trustpoint sampleTP cn-san-validate server
transport tcp tls v1.2
tcp-retry 1000
end

[Kasun Bandara]

please share output of #sh ver

[shihab.kp]

sh version
Cisco IOS XE Software, Version 17.03.05
Cisco IOS Software [Amsterdam], ISR Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 17.3.5, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2022 by Cisco Systems, Inc.
Compiled Wed 09-Feb-22 10:37 by mcpre

Cisco IOS-XE software, Copyright (c) 2005-2022 by cisco Systems, Inc.
All rights reserved. Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0. The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0. For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.

ROM: 16.12(2r)

uptime is 1 day, 3 hours, 11 minutes
Uptime for this control processor is 1 day, 3 hours, 12 minutes
System returned to ROM by Reload Command at 08:09:13 UTC Tue Feb 21 2023
System image file is "flash:isr4300-universalk9.17.03.05.SPA.bin"
Last reload reason: Reload Command

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

[Roger Kallberg]

Very likely the router is not licensed for security features.

[shihab.kp]

crypto pki trustpool command is taking, the issue is with Crypto command under sip-ua

[b.winter]

license boot level securityk9

[MHM Cisco World]

Router#copy running-config startup-config

then reboot the router and check command again  

[shihab.kp]

tried it still same behaviour

[Roger Kallberg]

Is your router licensed with security features?

[shihab.kp]

we didn't register to smart account yet

--------------------------------------------------------------------------------
Suite Suite Current Type Suite Next reboot
--------------------------------------------------------------------------------
FoundationSuiteK9 None Smart License None
securityk9
appxk9

AdvUCSuiteK9 None Smart License None
uck9
cme-srst
cube

Technology Package License Information:

-----------------------------------------------------------------
Technology Technology-package Technology-package
Current Type Next reboot
------------------------------------------------------------------
appxk9 appxk9 Smart License appxk9
uck9 uck9 Smart License uck9
securityk9 None Smart License None
ipbase ipbasek9 Smart License ipbasek9

The current throughput level is 100000 kbps

[Roger Kallberg]

I did not ask about Smart Licensing.

[jvcumpa11]

I had the same issue, and this works with me. I have ISR4331 IOS ver 17.9.4

thanks

[Ana C]

Has anyone found the solution to this problem?

[Roger Kallberg]

The solution is to have the router license with security features. Without that you can not enter any commands that is related to security features in the router.

[jvcumpa11]

I had this issue, and adding the following commands work with me

license boot suite AdvUCSuiteK9
license boot level securityk9