ISM-VPN-29 on a CISCO2901

[Matt Maxa]

I'm trying to run the ISM-VPN-29  in a 2901 router. Cisco says that the SECK9 and HSECK9 licenses are  needed to operate this ISM. However, they also say that the HSECK9  license is not available on the 2901. I'm running the SECK9 license but  it's still not working. Has anybody run into this?

This link, table 5 states that the HSECK9 feature license is for 2921 and 2951 only:

http://www.cisco.com/en/US/docs/routers/access/sw_activation/SA_on_ISR.html#wp1168046

This link states that it is a requirement to run the card, and also that the card works on the 2901:

http://www.cisco.com/en/US/prod/collateral/modules/ps2706/ps12202/data_sheet_c78-682436.html

I am running 15.3(1)T IOS.

[hsticher]

I’ve the same question and found that Cisco offers a ISM-VPN-29 for 2901, but my reseller told me it would be cheaper to buy the bundle (CISCO2901-HSEC+/K9) than only the module and the HSEC license.

http://www.cisco.com/en/US/prod/collateral/modules/ps2706/ps12202/data_sheet_c78-682436.html

. The Cisco 2900 Series Module (ISM-VPN-29) can provide hardware-based IPSec encryption services of 145 and 550 Mbps in the Cisco 2901, 150 and 600 Mbps in the Cisco 2911, 220 and 700 Mbps in the Cisco 2921, and 385 and 900 Mbps in the Cisco 2951 (IPSec IMIX and 1400-byte packets).

Can Cisco please tell us:

. for whom they offer that ISM module and why it is cheaper to buy the bundle?

. is it also cheaper to buy the 3925-HSEC bundle than the ISM-VPN-39 module?

[paolo bevilacqua]

Wrong forum, post in "Wan and routing". You can move your posting with the Actions panel on the right.

[aigars]

According to "Cisco’s Integrated Services Routers Generation Two Licensing and Packaging"

>> 

http://www.cisco.com/c/en/us/products/collateral/cloud-systems-management/software-activation-on-integrated-services-routers-isr/white_paper_c11_556985.html

see item '

Feature License Details,

Software Activation Feature Licenses

>>

1. The HSEC-K9 license removes the curtailment enforced by the U.S. government export restrictions on the encrypted tunnel count and encrypted throughput.

2. With the HSEC-K9 license, the ISR G2 router can go over the curtailment limit of:

- 225 tunnels maximum for IP Security (IPsec), and

- encrypted throughput of 85-Mbps unidirectional traffic in or out of the ISR G2 router, with a bidirectional total of 170 Mbps

3. HSEC-K9 is available only on the Cisco 2921, Cisco 2951, Cisco 3925, Cisco 3945, Cisco 3925E, and Cisco 3945E, and please note that

FL-29-HSEC-K9 stands for "U.S. Export Restriction Compliance license for 2921/2951, and applies for ISR 2921 and ISR 2951

4. The Cisco 1941, 2901, and 2911 already have maximum encryption capacities within export limits, so there are no restrictions to remove as hardware limitations come first.

The document

>>

"Cisco VPN Internal Service Module for Cisco ISR G2 Data Sheet"

http://www.cisco.com/c/en/us/products/collateral/interfaces-modules/vpn-internal-service-module-isr-g2/data_sheet_c78-682436.html

>>

states:

The Cisco 2900 Series Module (ISM-VPN-29) can provide hardware-based IPSec encryption services of:

- 145 and 550 Mbps in the Cisco 2901,

- 150 and 600 Mbps in the Cisco 2911,

- 220 and 700 Mbps in the Cisco 2921,

- 385 and 900 Mbps in the Cisco 2951

(IPSec IMIX and 1400-byte packets).

So, IMHO you don't need HSEC license, as router's performance does not exceed U.S. government export restrictions.

Is not your ISM-VPN operating correctly?