ASR Security Bundle

[ksherwood]

Hi,

      is there anything special you need to do with the ASR after you purchase it as a security bundle ?

Kevin.

[Richard Burts]

Kevin

I probably am missing something in your question. It seems to me that if you have purchased an ASR with the security bundle that it should come with the license activated for the security features. You probably want to boot the ASR and then to check to verify that the security license is activated.If it is not activated for some reason then you have a problem to solve. If it is activated then all you need to do is to start configuring the security features.

If this is not what you are really asking then please provide clarification of the question.

HTH

Rick

[ksherwood]

Rick,

          that is what I am not sure about, how do you know ?

The reason I am really curious is that when configuring IKEv2 and in particular a strong transform set, a message appears that a performance hit would occur.

So I just want to be sure I have everything activated or enabled that we have paid for.

Kevin.

[Richard Burts]

Kevin

If the ASR is allowing you to configure IKEv2 then that is proof that the licenses are installed and activated.

HTH

Rick

Sent from Cisco Technical Support iPad App

[ksherwood]

Ok, I agree, so why doesn't my transform set work as soon as I set it with SHA-2 strength

ie   crypto ipsec transform-set cisco-ts esp-aes 256 esp-sha-hmac           works,

       crypto ipsec transform-set cisco-ts esp-aes 256 esp-sha512-hmac    does not

and also, this worries me !

Router#sho license

License Store: Primary License Storage

StoreIndex:  1  Feature: ipsec                             Version: 1.0

        License Type: Permanent

        License State: Active, Not in Use

        License Count: Non-Counted

        License Priority: Medium

[Richard Burts]

Kevin

This is certainly not what I would have expected to see. I wonder what else is in the output of show license?

You say that crypto ipsec transform-set cisco-ts esp-aes 256 esp-sha512-hmac does not work. In what way is it not working? Does it generate an error message? Do tunnels not come up?

Is this router covered under maintenance/new equipment warranty? I would think that a question to Cisco TAC might be the appropriate next step?

HTH

Rick

[Richard Burts]

Kevin

What model of ASR is this and what version of code is it running?

HTH

Rick

[ksherwood]

The answer is:

ASR1002-X or any ASR with an ESP100 should have the support for data plane next-gen encryption from IOS version 3.8 onwards.

ASR routers with the standard processor can not handle the stronger encryption processing.