Manuals / Cisco Systems / Computer Equipment / Network Cables

Cisco Systems C7200 Cisco 7206VXR Router, 1-10, 5 Cisco 7206VXR - Front View, OL-9129-02, 153566

Models: C7200

1 62

Download 62 pages 7.3 Kb

Page 24

Image 24

Chapter 1 Overview

Slot Locations

Cisco 7206VXR Router

The VSA is supported in the I/O controller port on the Cisco 7206VXR router (see 4 in Figure 1-5).

Figure 1-5 Cisco 7206VXR - Front View

TOKEN RING

ETHERNET 10BT

FAST ETHERNET

B L

E D

N A

M II

L IN

R J

FAST SERIAL

ETHERNET-10BFL

Cisco 7200	C7200-VSA

Series VXR	0

1 Blank port adapter

3 VSA in the I/O controller slot

2Port adapter

153566

C7200 VSA (VPN Services Adapter) Installation and Configuration Guide

1-10	OL-9129-02

Page 24

Image 24

Cisco Systems C7200 Cisco 7206VXR Router, 1-10, 5 Cisco 7206VXR - Front View, Overview Slot Locations, OL-9129-02, 153566

Contents

C7200 VSA VPN Services Adapter Installation and Configuration Guide Corporate HeadquartersCisco Systems, Inc 170 West Tasman Drive San Jose, CA 800 553-NETS Fax 408Turn the television or radio antenna until the interference stops Features Definitions of Service Request SeverityC O N T E N T S PrefaceThe Crypto Transform Configuration Mode 4 Configuration Tasks 4Safety Warnings Removing and Installing the VSAVerifying the Configuration 4 Router A ConfigurationRouter B Configuration Troubleshooting TipsContents C7200 VSA VPN Services Adapter Installation and Configuration GuideOL-9129-02 Preface AudienceWarnings Audience, page Warnings, page Objectives, page Organization, pagePreparing for Installation Removing and Installing the VSAConfiguring the VSA ObjectivesRelated Documentation Obtaining DocumentationCisco.com Documentation Feedback Cisco Product Security OverviewProduct Documentation DVD Ordering DocumentationReporting Security Problems in Cisco Products Product Alerts and Field NoticesFor emergencies only - security-alert@cisco.com Obtaining Technical Assistance Cisco Technical Support & Documentation Websitehttp//tools.cisco.com/RPF/register/register.do Submitting a Service Request Definitions of Service Request SeverityObtaining Additional Publications and Information xiiiThe Cisco Product Quick Reference Guide is a handy, compact reference tool that includes brief product overviews, key features, sample part numbers, and abbreviated technical specifications for many Cisco products that are sold through channel partners. It is updated twice a year and includes the latest Cisco channel product offerings. To order and find out more about the Cisco Product Quick Reference Guide, go to this URL Hardware Required, page Features, page Enabling/Disabling the VSA, page LEDs, page Connectors, pageOverview Data Encryption OverviewVSA Overview Screws Features Hardware RequiredFeature Description/BenefitSupported Standards, MIBs, and RFCs PerformanceStandards MIBsDisables the C7200 VSA Enables the C7200 VSA after it has beendisabled Enabling/Disabling the VSALEDs Hw-module slot 0 shutdown -Not supportedno crypto engine slot accelerator 0 -See Table Connectors Slot LocationsCisco 7204VXR Router Cisco 7204VXR Router, page Cisco 7206VXR Router, pageC7200 VSA VPN Services Adapter Installation and Configuration Guide ENABLEDFigure 1-4 Cisco 7204VXR Router - Front View Chapter 1 Overview Slot LocationsCisco 7206VXR Router 1-10C7200 VSA VPN Services Adapter Installation and Configuration Guide Figure 1-5 Cisco 7206VXR - Front ViewPreparing for Installation Online Insertion and Removal OIR, page Safety Guidelines, pageRequired Tools and Equipment Hardware and Software RequirementsSoftware Requirements Hardware RequirementsRestrictions PlatformSafety Guidelines Safety WarningsSafety Warnings, page Electrical Equipment Guidelines, page Online Insertion and Removal OIRElectrical Equipment Guidelines Preventing Electrostatic Discharge DamageCompliance with U.S. Export Laws and Regulations Regarding Encryption Compliance with U.S. Export Laws and Regulations Regarding EncryptionChapter 2 Preparing for Installation C7200 VSA VPN Services Adapter Installation and Configuration GuideCompliance with U.S. Export Laws and Regulations Regarding Encryption OL-9129-02Removing and Installing the VSA Warnings and Cautions, page VSA Removal and Installation, pageHandling the VSA Handling the VSA, page Online Insertion and Removal OIR, pageVSA Removal and Installation Warnings and CautionsThe safety cover is an integral part of the product. Do not operate the unit without the safety cover installed. Operating the unit without the cover in place will invalidate the safety approvals and pose a risk of fire and electrical hazards Online Insertion and Removal OIRStep 3 Unscrew the screws holding the VSA in the slot Chapter 3 Removing and Installing the VSA VSA Removal and InstallationC7200 VSA VPN Services Adapter Installation and Configuration Guide OL-9129-02Configuring the VSA Configuration TasksOverview, page Configuration Tasks, page Configuration Examples, page Basic IPSec Configuration Illustration, pageUsing the EXEC Command Interpreter Configuring an IKE PolicyVerifying IKE and IPSec Configurations, page 4-15 optional Configuring IPSec Configuration Example, page 4-18 optionalDefines an IKE policy and enters Internet Security Association Configuring a Transform Set Disables VSAVSA will be enabled after the next system rebootThe Crypto Transform Configuration Mode Changing Existing Transforms Defining a Transform SetSelecting Appropriate Transforms Transform ExampleAuthentication Transform is used, you must ESP Authentication Transform Pick up toah-md5-hmac ah-sha-hmacThe Crypto Transform Configuration Mode IPSec Protocols AH and ESPSelecting Appropriate Transforms esp-aes and esp-sha-hmac ah-sha-hmac and esp-aes and esp-sha-hmacConfiguring IPSec Ensuring That Access Lists Are Compatible with IPSecSetting Global Lifetimes for IPSec Security Associations Ensuring That Access Lists Are Compatible with IPSec requiredCommand StepPurpose Router# clear crypto sa spi destination-addressCreating Crypto Access Lists Creating Crypto Map Entries4-10 Routerconfig# ip access-list extended name4-11 spi cipher hex-key-string authenticatoresp spi cipher hex-key-string authenticator Routerconfig-crypto-m# set session-key inbound ahThis is the only configuration statement required in Creating Dynamic Crypto MapsCreates a dynamic crypto map entry Specifies which transform sets are allowed for the4-13 CommandPurpose Monitoring and Maintaining IPSec Applying Crypto Map Sets to Interfaces4-14 Verifying IKE and IPSec Configurations Displays your transform set configurationDisplays your crypto map configuration Displays information about IPSec security associationsVerifying the Configuration 4-164-17 Chapter 4 Configuring the VSA Configuration TasksC7200 VSA VPN Services Adapter Installation and Configuration Guide OL-9129-02Configuration Examples Configuring IKE Policies ExampleConfiguring IPSec Configuration Example Configuring IKE Policies Example, pageBasic IPSec Configuration Illustration Router A Configuration4-19 Router B Configuration 4-20Troubleshooting Tips 4-21Router# show diag Router# show crypto engine accelerator statistic4-22 Chapter 4 Configuring the VSA Troubleshooting TipsC7200 VSA VPN Services Adapter Installation and Configuration Guide Using Deny Policies in Access Lists Using Deny Policies in Access Lists, pageMonitor and Maintenance Commands, page Monitoring and Maintaining the VSAMonitor and Maintenance Commands Configuration Guidelines and RestrictionsDisplays integrated service adapter as part of the interfaces Verifies the VSA is currently processing crypto packetsI N D E IN-1IN-2 creating 4definition IN-3 IN-4 C7200 VSA VPN Services Adapter Installation and Configuration GuideIndex OL-9129-02