Hi Reza,
Thanks very much indeed. It would be great if you can try the following: This is the enabling commands for the ISR G2 routers 29xx, 39xx for One PK. and the requirement is to run cxxxx-universalk9-mz.SPA.153-2.T.bin on the ISR G2 platforms for OnePK support.
Here are the steps:
Enable onePK on your router. The onePK infrastructure is disabled by default on your router. To enable it, you must choose a communication method and then connect to the router console and issue a set of commands through the IOS CLI.
Choose one of the following options:
Option 1 – Unencrypted communication between the router and onePK applications Using the onep transport socket communication option means that all communication between the onePK application and the router, including router userids and passwords used to authenticate the onePK application to the router will be sent unencrypted or “in the clear.” Note: onep socket communication is very similar to using telnet to administer a router. Therefore, great care must be taken to ensure the communication path between the onePK application and the router cannot be intercepted and the socket communication traffic to the router is allowed only from the specific hosts running the onePK applications. See the Cisco Guide to Harden Cisco IOS Devices for more information on restricting traffic to/from your router.
If you accept the security risks of unencrypted communication, enable onep transport socket as follows:
router> enable router# configure terminal
router(config)# onep router
(config-onep)# transport socket
router(config-onep)# start
router(config-onep)# exit
Option 2 – Encrypted communication between the router and onePK applications The onep transport TLS communication option enables the onePK application to communicate with the router over an encrypted link. TLS communication is similar to using SSH for router administration and therefore should be used for production deployments of onePK or in any development or test environment where traffic between the onePK application and the router may be intercepted. Note: TLS communication should be used with onePK applications whenever possible. In addition to enabling encrypted communications, TLS supports an additional layer of security by providing the option for the onePK application to use certificates to authenticate to the router (i.e., client authentication). See the Configuring onePK Application Authentication using Transport Layer Security (TLS) section below for more information.
NOTE: Before entering the following commands, make sure the clock on your router is set to the correct time. If the clock is not set, issue the command clock set e.g., clock set <21:10:00> <1 apr 2013> or configure NTP on the router – see http://www.cisco.com/en/US/docs/ios/12_2/configfun/configuration/guide/fcf012.html#wp1001170 for more information.
router> enable router# configure terminal
router(config)# ip http server router(config)# onep
router(config-onep)# transport tls disable-remotecert-validation
router(config-onep)# start router(config-onep)# exit
router(config)# crypto pki server onepkCA
router(cs-server)# database level minimum
router(cs-server)# grant auto
router(cs-server)# no shut
%Some server settings cannot be changed after CA certificate generation % Please enter a passphrase to protect the private key % or type return to exit
