Hmmm, looks like AES with 256 bit keys is supported depending on the mode of operation - But still I don't know if this is in hardware or in software (have you seen the datasheet and the comment about AES-192 and AES-256?)
show crypto ipsec sa detail
interface: Tunnel1
Crypto map tag: Tunnel1-head-0, local addr 10.2.32.15
protected vrf: besiscr
local ident (addr/mask/prot/port): (10.2.32.15/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (10.2.32.128/255.255.255.255/47/0)
current_peer 10.2.32.128 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 114, #pkts encrypt: 114, #pkts digest: 114
#pkts decaps: 142, #pkts decrypt: 142, #pkts verify: 142
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#pkts no sa (send) 0, #pkts invalid sa (rcv) 0
#pkts encaps failed (send) 0, #pkts decaps failed (rcv) 0
#pkts invalid prot (recv) 0, #pkts verify failed: 0
#pkts invalid identity (recv) 0, #pkts invalid len (rcv) 0
#pkts replay rollover (send): 0, #pkts replay rollover (rcv) 0
##pkts replay failed (rcv): 0
#pkts internal err (send): 0, #pkts internal err (recv) 0
local crypto endpt.: 10.2.32.15, remote crypto endpt.: 10.2.32.128
path mtu 1514, ip mtu 1514, ip mtu idb Loopback1
current outbound spi: 0xCD695E1A(3446234650)
inbound esp sas:
spi: 0xAD976BD4(2912381908)
transform: esp-256-aes esp-sha-hmac ,
in use settings ={Transport, }
conn id: 5633, flow_id: VAM2:3633, crypto map: Tunnel1-head-0
sa timing: remaining key lifetime (k/sec): (4545193/2351)
IV size: 16 bytes
replay detection support: N
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xCD695E1A(3446234650)
transform: esp-256-aes esp-sha-hmac ,
in use settings ={Transport, }
conn id: 5634, flow_id: VAM2:3634, crypto map: Tunnel1-head-0
sa timing: remaining key lifetime (k/sec): (4545191/2351)
IV size: 16 bytes
replay detection support: N
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
protected vrf: besiscr
local ident (addr/mask/prot/port): (10.2.32.15/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (10.2.32.1/255.255.255.255/47/0)
current_peer 10.2.32.1 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 371160003, #pkts encrypt: 371160003, #pkts digest: 371160003
#pkts decaps: 667833920, #pkts decrypt: 667833920, #pkts verify: 667833920
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#pkts no sa (send) 2, #pkts invalid sa (rcv) 0
#pkts encaps failed (send) 0, #pkts decaps failed (rcv) 0
#pkts invalid prot (recv) 0, #pkts verify failed: 0
#pkts invalid identity (recv) 0, #pkts invalid len (rcv) 0
#pkts replay rollover (send): 0, #pkts replay rollover (rcv) 0
##pkts replay failed (rcv): 0
#pkts internal err (send): 0, #pkts internal err (recv) 0
local crypto endpt.: 10.2.32.15, remote crypto endpt.: 10.2.32.1
path mtu 1514, ip mtu 1514, ip mtu idb Loopback1
current outbound spi: 0x774A849C(2001372316)
inbound esp sas:
spi: 0xFB2E22F1(4214104817)
transform: esp-256-aes esp-sha-hmac ,
in use settings ={Transport, }
conn id: 5599, flow_id: VAM2:3599, crypto map: Tunnel1-head-0
sa timing: remaining key lifetime (k/sec): (3920695/368)
IV size: 16 bytes
replay detection support: N
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0x774A849C(2001372316)
etc
