Preparing for Installation | Cisco Systems C7200 guide

Chapter 2 Preparing for Installation

Compliance with U.S. Export Laws and Regulations Regarding Encryption

Compliance with U.S. Export Laws and Regulations Regarding Encryption

This product performs encryption and is regulated for export by the U.S. government. Persons exporting any item out of the United States by either physical or electronic means must comply with the Export Administration Regulations as administered by the U.S. Department of Commerce, Bureau of Export Administration. See http://www.bxa.doc.gov/ for more information.

Certain “strong” encryption items can be exported outside the United States depending upon the destination, end user, and end use. See http://www.cisco.com/wwl/export/encrypt.html for more information about Cisco-eligible products, destinations, end users, and end uses.

Check local country laws prior to export to determine import and usage requirements as necessary. See http://cwis.kub.nl/~frw/people/koops/lawsurvy.htm as one possible, unofficial source of international encryption laws.

C7200 VSA (VPN Services Adapter) Installation and Configuration Guide

	OL-9129-02	2-5

Image 29

Cisco Systems C7200 manual Preparing for Installation

Contents

Text Part Number OL-9129-02 Corporate HeadquartersPage N T E N T S Preventing Electrostatic Discharge Damage 2 Creating Dynamic Crypto Maps 4 OL-9129-02 Audience Preface Chapter Title Description ObjectivesOrganization Cisco.com Related DocumentationObtaining Documentation Product Documentation DVD Ordering Documentation Documentation FeedbackCisco Product Security Overview Product Alerts and Field Notices Reporting Security Problems in Cisco Products Cisco Technical Support & Documentation Website Obtaining Technical Assistance Obtaining Additional Publications and Information Submitting a Service RequestDefinitions of Service Request Severity Xiv Data Encryption Overview Overview VSA Overview VSA Module Front View Screws Handle Status LED light This section describes the VSA features, as listed in Table FeaturesFeature Description/Benefit Hardware Required Performance Supported Standards, MIBs, and RFCsStandards MIBs Enabling/Disabling the VSA Command PurposeDisabling the VSA during Operation Enabling/Disabling Scheme LEDs Condition System is ConfiguredCommand Description of VSA Behavior See -2for the VSA connectors ConnectorsSlot Locations Cisco 7204VXR Router Cisco 7204VXR Router Front View Port adapter VSA in I/O controller slot Port adapter lever Cisco 7206VXR Front View Cisco 7206VXR Router Hardware and Software Requirements Required Tools and Equipment Hardware Requirements Software RequirementsRestrictions Platform Online Insertion and Removal OIR Safety GuidelinesSafety Warnings Preventing Electrostatic Discharge Damage Electrical Equipment Guidelines Preparing for Installation OL-9129-02 VSA circuit board is sensitive to ESD damage Handling the VSA This section describes how to remove and install the VSA VSA Removal and Installation Removing and Installing the VSA VSA Removal and Installation OL-9129-02 Overview Configuration Tasks Configuring an IKE Policy Using the Exec Command Interpreter Config-isakmp mode Key Management Protocol Isakmp policy configurationOptional Specifies the authentication method within an IKE Signatures as the authentication method Disabling VSA Optional Configuring a Transform Set Defining a Transform Set Transform type Description Selecting Appropriate Transforms Crypto Transform Configuration ModeIPSec Protocols AH and ESP Ensuring That Access Lists Are Compatible with IPSec Configuring IPSecSetting Global Lifetimes for IPSec Security Associations Changing Existing Transforms Step Command Purpose Creating Crypto Map Entries Creating Crypto Access Lists Authenticator keys if the transform set includes an Only one transform set can be specified when IKE isESP authenticator algorithm Exits crypto-map configuration mode and return to Creating Dynamic Crypto Maps Extended access list. This access list determines Optional Accesses list number or name of anIf this is configured, the data flow identity proposed For this crypto access list Applying Crypto Map Sets to Interfaces Monitoring and Maintaining IPSec Router# show crypto isakmp policy Verifying IKE and IPSec Configurations Verifying the Configuration Currentpeer 172.21.114.67 PERMIT, flags=originisacl Configuring IKE Policies Example Configuration ExamplesConfiguring IPSec Configuration Example This section provides the following configuration examples Crypto map is applied to an interface Basic IPSec Configuration IllustrationRouter a Configuration Specify the parameters to be used during an IKE negotiation Router B ConfigurationTransform set defines how the traffic will be protected Router# show diag Troubleshooting Tips Tunnel I/F Monitoring and Maintaining the VSA Using Deny Policies in Access Lists Configuration Guidelines and Restrictions Monitor and Maintenance Commands D E Set session-key command Set transform-set command Sa command, clear crypto Entries, creatingSet pfs command Handling VPN Acceleration Module see VAM 1 Features Handling Monitoring and maintaining 4 Overview IN-4