How do I activate the IPSEC-License Feature on an ASR1001 with advipservices?

[Stefan Giera]

Hi there, 

I would like to configure some IPSEC-Stuff on my ASR1001 with advipservices-License, which does not work: 

Router(config)#crypto isakmp policy 1

                         ^
% Invalid input detected at '^' marker.

For me it looks like there is a problem with the licenses, and probably I need the "IPSEC"-License. Here are my current licenses: 

Router#sh license

Index 1 Feature: adventerprise
        Period left: 8  weeks 3  days
        License Type: EvalRightToUse
        License State: Active, Not in Use, EULA accepted
        License Count: Non-Counted
        License Priority: Low
Index 2 Feature: advipservices
        Period left: Life time
        License Type: Permanent
        License State: Active, In Use
        License Count: Non-Counted
        License Priority: Medium
Index 3 Feature: ipbase
Index 4 Feature: avc
        Period left: 8  weeks 4  days
        License Type: EvalRightToUse
        License State: Active, Not in Use, EULA not accepted
        License Count: Non-Counted
        License Priority: None
Index 5 Feature: broadband
Index 6 Feature: broadband_4k
Index 7 Feature: cube_250
Index 8 Feature: cube_250_red
Index 9 Feature: cube_ent_100
Index 10 Feature: cube_ent_100_red
Index 11 Feature: cube_lab
Index 12 Feature: cube_video_b2btp
Index 13 Feature: cube_video_b2btp_red
Index 14 Feature: firewall
        Period left: Life time
        License Type: Permanent
        License State: Active, Not in Use
        License Count: Non-Counted
        License Priority: Medium
Index 15 Feature: fpi
Index 16 Feature: fwnat_red
        Period left: 8  weeks 4  days
        License Type: EvalRightToUse
        License State: Active, Not in Use, EULA not accepted
        License Count: Non-Counted
        License Priority: None
Index 17 Feature: gtp_addon_aic
Index 18 Feature: internal_service
Index 19 Feature: ipsec
        Period left: 8  weeks 4  days
        License Type: EvalRightToUse
        License State: Active, Not in Use, EULA not accepted
        License Count: Non-Counted
        License Priority: None

...

Now I would like to activate the IPSEC-License, but I am not able to configure: 

Router(config)#license boot level advipservices ?

  <cr>

Is there any way to activate these specific license feature??

My IOS is Cisco IOS Software, IOS-XE Software (X86_64_LINUX_IOSD-UNIVERSAL-M), Version 15.3(2)S1, RELEASE SOFTWARE (fc1)

bootflash:/asr1001-universal.03.09.01.S.153-2.S1.bin

Thanks for helping! 

[acampbell]

Stefan,

Have you tried accepting the EULA

conf t

!
license accept end user agreement
!
end

You will then have 60 days to evaluate the IPSEC features

Then you need to buy and upgrade you license to a permanent one

Hope this help

Regards

Alex

[Stefan Giera]

Hi Alex, 

thanks for Your answer. I tried this, but it didn't help.

But doing some more research I think I have taken the wrong image: 

bootflash:/asr1001-universal.03.09.01.S.153-2.S1.bin

==> I should have taken the "k9"-version instead....

Meanwhile I rebooted with the "asr1001-universalk9.03.10.01.S.153-3.S1-ext.bin" image, and now it works fine ;-)

Sorry for my blindness...

Kind regards, 

Stefan

[Timohamoto]

Hi, Stefan! Thank you for your post!

I got the same problems while using "k9"-version

How do you think, how could i Enable It IPSEC feature?

[oliver6020]

Hi for anyone stuck in similar issues with crypto functionality not being enabled even after multiple license configurations. 

The reason for the issue here is the image being used for the ASR it contains "npe" in the image name if you closely examine the "sh ver " output. This is the root reason and NPE stands for no payload encryption and has the crypto functions purposefully remove for shipping to countries that have strict laws on ecryption. Simply boot a image without 'npe' in name and activate relevant licensing.