I use the image "asr920-universalk9_npe.16.09.03.SPA.bin". In fact the ASR920 has only NPE images available, not standard k9 ones. Still, the ASR920 has IPSEC encryption guides available on Cisco's website and I tested it today, I was able to configure site-to-site VPNs with GRE on top and it works quite well.
Is the "NPE" thing just a mistake?
