Supported Standards, MIBs, and RFCs | Cisco Systems C7200 guide

Chapter 1 Overview

Supported Standards, MIBs, and RFCs

2.Number of tunnels supported varies based on the total system memory installed.

3.On the NPE-G2, the minimum memory requirement is 1 GB of memory.

Performance

Table 1-2lists the performance information for the VSA.

Table 1-2 Performance for VSA

	Cisco Router	Throughput1 2	Description
	Cisco 7200VXR	Performance to	Cisco IOS release: 12.4(4)XD3 fc2
	series routers	900 Mbps	7200VXR/NPE-G2/VSA, 1GB system memory
	with the	encrypted	7200VXR/NPE-G2/VSA, 1GB system memory
	with the	encrypted	3DES/HMAC-SHA or AES/HMAC-SHA, preshared with no
	NPE-G2	throughput	3DES/HMAC-SHA or AES/HMAC-SHA, preshared with no
	processor		IKE-keepalive configured

1.As measured with IPSec 3DES or AES Hashed Message Authentication Code (HMAC)-SHA-1 on 1400-byte packets. Performance varies depending on the number of modules, bandwidth, traffic volume, Cisco IOS software release, and so forth.

2.Using Cisco 12.4(4)XD3 fc2 image. Performance varies by Cisco IOS software release.

Supported Standards, MIBs, and RFCs

This section describes the standards, Management Information Bases (MIBs), and Request for Comments (RFCs) supported on the VSA. Requests for Comments (RFCs) contain information about the supported Internet suite of protocols.

Standards

•IPSec/IKE: RFCs 2401-2411, 2451

MIBs

•CISCO-IPSEC-FLOW-MONITOR-MIB

•CISCO-IPSEC-MIB

•CISCO-IPSEC-POLICY-MAP-MIB

To obtain lists of supported MIBs by platform and Cisco IOS release, and to download MIB modules, go to the Cisco MIB website on Cisco.com at the following URL:

http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml

RFCs

•IPSec/IKE: RFCs 2401-2411, 2451

C7200 VSA (VPN Services Adapter) Installation and Configuration Guide

	OL-9129-02	1-5

Image 19

Cisco Systems C7200 manual Supported Standards, MIBs, and RFCs, Performance

Contents

Text Part Number OL-9129-02 Corporate HeadquartersPage N T E N T S Preventing Electrostatic Discharge Damage 2 Creating Dynamic Crypto Maps 4 OL-9129-02 Audience Preface Organization ObjectivesChapter Title Description Obtaining Documentation Related DocumentationCisco.com Cisco Product Security Overview Documentation FeedbackProduct Documentation DVD Ordering Documentation Product Alerts and Field Notices Reporting Security Problems in Cisco Products Cisco Technical Support & Documentation Website Obtaining Technical Assistance Definitions of Service Request Severity Submitting a Service RequestObtaining Additional Publications and Information Xiv Data Encryption Overview Overview VSA Overview VSA Module Front View Screws Handle Status LED light Hardware Required FeaturesThis section describes the VSA features, as listed in Table Feature Description/Benefit MIBs Supported Standards, MIBs, and RFCsPerformance Standards Enabling/Disabling Scheme Command PurposeEnabling/Disabling the VSA Disabling the VSA during Operation Command Description of VSA Behavior Condition System is ConfiguredLEDs Cisco 7204VXR Router ConnectorsSee -2for the VSA connectors Slot Locations Cisco 7204VXR Router Front View Port adapter VSA in I/O controller slot Port adapter lever Cisco 7206VXR Front View Cisco 7206VXR Router Hardware and Software Requirements Required Tools and Equipment Platform Software RequirementsHardware Requirements Restrictions Safety Warnings Safety GuidelinesOnline Insertion and Removal OIR Preventing Electrostatic Discharge Damage Electrical Equipment Guidelines Preparing for Installation OL-9129-02 VSA circuit board is sensitive to ESD damage Handling the VSA This section describes how to remove and install the VSA VSA Removal and Installation Removing and Installing the VSA VSA Removal and Installation OL-9129-02 Overview Configuration Tasks Configuring an IKE Policy Using the Exec Command Interpreter Signatures as the authentication method Key Management Protocol Isakmp policy configurationConfig-isakmp mode Optional Specifies the authentication method within an IKE Disabling VSA Optional Configuring a Transform Set Defining a Transform Set Transform type Description IPSec Protocols AH and ESP Crypto Transform Configuration ModeSelecting Appropriate Transforms Changing Existing Transforms Configuring IPSecEnsuring That Access Lists Are Compatible with IPSec Setting Global Lifetimes for IPSec Security Associations Step Command Purpose Creating Crypto Map Entries Creating Crypto Access Lists Exits crypto-map configuration mode and return to Only one transform set can be specified when IKE isAuthenticator keys if the transform set includes an ESP authenticator algorithm Creating Dynamic Crypto Maps For this crypto access list Optional Accesses list number or name of anExtended access list. This access list determines If this is configured, the data flow identity proposed Applying Crypto Map Sets to Interfaces Monitoring and Maintaining IPSec Router# show crypto isakmp policy Verifying IKE and IPSec Configurations Verifying the Configuration Currentpeer 172.21.114.67 PERMIT, flags=originisacl This section provides the following configuration examples Configuration ExamplesConfiguring IKE Policies Example Configuring IPSec Configuration Example Router a Configuration Basic IPSec Configuration IllustrationCrypto map is applied to an interface Transform set defines how the traffic will be protected Router B ConfigurationSpecify the parameters to be used during an IKE negotiation Router# show diag Troubleshooting Tips Tunnel I/F Monitoring and Maintaining the VSA Using Deny Policies in Access Lists Configuration Guidelines and Restrictions Monitor and Maintenance Commands D E Set pfs command Sa command, clear crypto Entries, creatingSet session-key command Set transform-set command Handling VPN Acceleration Module see VAM 1 Features Handling Monitoring and maintaining 4 Overview IN-4