Crypto support on ASR1001?

[nick]

Hello,

I'm trying to set up a VPN configuration for a colocation setup. So far, I've get a working IKEv2 server (StrongSwan on Ubuntu 16.04) running at our office. However, while trying to follow this tutorial (1) to set up the client on an older Cisco ASR1001, the "crypto ikev2" commands all fail with  "invalid input detected" at the "ikev2" part. I tried a few other crypto commands, and all so far have failed the same way (e.g. "crypto isakmp", "crypto ipsec", "crypto map"). I double-checked the system image ("asr1001-universalk9.03.16.01a.S.155-3.S1a-ext.bin") using the Cisco Feature Navigator, and while I couldn't find an exact match, I did find the release here (2), and am reasonably sure this version should support the "IKE security protocol".

Is there some sort of activation required for the crypto features, or something else I'm missing?

Thanks!

1) http://www.cisco.com/c/en/us/support/docs/ip/internet-key-exchange-ike/117258-config-l2l.html

2) https://software.cisco.com/download/release.html?mdfid=282993672&release=3.16.1aS&softwareid=282046477

[Rahul Govindan]

I believe you need one of the following licenses packages to activate crypto functionality:

◦     Cisco ASR 1000 Advanced IP Services license

◦     Cisco ASR 1000 Advanced Services license

If you have purchases one of these packages, you can activate the PAK on and install the license on the router. 

There should also be a license that can enable only the ipsec feature set on the ASR if you do not want all the Security features.

The information of the licenses is present in the ASR ordering guide:

http://www.cisco.com/c/en/us/products/collateral/routers/asr-1000-series-aggregation-services-routers/guide-c07-731639.html#_Toc462044517

The guide is super confusing for someone reading it for the first time :)

This datasheet may be more useful:

http://www.cisco.com/c/dam/en/us/products/collateral/routers/asr-1000-series-aggregation-services-routers/q-and-a-c67-452124.pdf