IPsec on 2951

[SSG.Mueller]

Hello Everyone.

     I'm looking for a little help with setting up IPsec for a DMVPN between a 2811 and 2951s in a test lab.  I have enabled IPsec on the hub (2811) but I am unable to do so on either of the 2951s.  After researching, it seems that I may have the incorrect IOS for this, but I am at a loss which IOS I should be using. Currently the 2951s are on "c2951-universalk9-mz.SPA.151-2.T2.bin" and the only crypto options are

(config)#crypto ?

  ca   Certification authority

  key  Long term key operations

  pki  Public Key components

while on the 2811 I get:

WIN-T(config)#crypto ?

  ca            Certification authority

  call          Configure Crypto Call Admission Control

  ctcp          Configure cTCP encapsulation

  dynamic-map   Specify a dynamic crypto map template

  engine        Enter a crypto engine configurable menu

  gdoi          Configure GDOI policy

  identity      Enter a crypto identity list

  ipsec         Configure IPSEC policy

  isakmp        Configure ISAKMP policy

  key           Long term key operations

  keyring       Key ring commands

  logging       logging messages

  map           Enter a crypto map

  mib           Configure Crypto-related MIB Parameters

  pki           Public Key components

  provisioning  Secure Device Provisioning

  wui           Crypto HTTP configuration interfaces

  xauth         X-Auth parameters

These are all hand me downs, so I'm not sure what features the all have.  Any info would be greatly appreciated.

Regards

SSG M

[Dan Frey · Accepted solution]

Welcome to Cisco Licensing.   The ISRG2 have a universal IOS image and features are unlocked via a licensing model.   There are no more pre-compiled images for the ISRG2s (Advipservices, ipbase,ect...).

There is an evaluation license that can be turned on and is good for 60 days to get services up and running.

execute:

C1921(config)#license boot module c1900 technology-package securityk9

The syntax for a 2951 will be slightly different.   After executing this command reboot the router and you will have access to all the security features.   During the 60 day evaluation license you should purchase a permanent security license and install it on the router.

- Dan

[SSG.Mueller]

Sorry it took me so long to get back to you, this project was put on hold for quite some time.  I'm very grateful for the info about licensing.  Looks like I have to get some more money for this.  Again, thanks!

Regards
SSG M