Datasheet

ManualsBrandsCisco ManualsNetworkingAIM-VPN/SSL-2=

Corporate Headquarters:

Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134-1706 USA

DES/3DES/AES VPN Encryption Module

(AIM-VPN/SSL-1, AIM-VPN/SSL-2, and

AIM-VPN/SSL-3)

First Published: June 19, 2006

Last Updated: May 30, 2006

The DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and

AIM-VPN/SSL-3) feature describes how to configure virtual private network (VPN) encryption

hardware advanced integration modules (AIM) in Cisco IOS Release 12.4(9)T.

Finding Feature Information in This Module

Your Cisco IOS software release may not support all of the features documented in this module. To reach

links to specific feature documentation in this module and to see a list of the releases in which each feature is

supported, use the “Feature Information for DES/3DES/AES VPN Encrytion Module (AIM-VPN/SSL-1,

AIM-VPN/SSL-2, and AIM-VPN/SSL-3)” section on page 22.

Finding Support Information for Platforms and Cisco IOS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image

support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on

Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at

the login dialog box and follow the instructions that appear.

Contents

• Prerequisites for the DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1,

AIM-VPN/SSL-2, and AIM-VPN/SSL-3), page 2

• Restrictions for the DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1,

AIM-VPN/SSL-2, and AIM-VPN/SSL-3), page 2

• Information About the DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1,

AIM-VPN/SSL-2, and AIM-VPN/SSL-3), page 2

• How to Configure the DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1,

AIM-VPN/SSL-2, and AIM-VPN/SSL-3), page 3

Summary of content (22 pages)

PAGE 1
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) First Published: June 19, 2006 Last Updated: May 30, 2006 The DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) feature describes how to configure virtual private network (VPN) encryption hardware advanced integration modules (AIM) in Cisco IOS Release 12.4(9)T.
PAGE 2
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) Prerequisites for the DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) • Additional References, page 6 • Command Reference, page 7 • Feature Information for DES/3DES/AES VPN Encrytion Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3), page 22 Prerequisites for the DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) Installation Preconditions
PAGE 3
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) How to Configure the DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and Determining Which Encryption Module to Use Determine which VPN encryption module to use as described in Table 1. Table 1 AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3 Encryption Module Support by Cisco IOS Release Platform Cisco IOS Release 12.
PAGE 4
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) How to Configure the DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) DETAILED STEPS Step 1 Command Purpose enable Enables privileged EXEC mode. • Enter your password if prompted. Example: Router> enable Step 2 configure terminal Enters global configuration mode.
PAGE 5
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) How to Configure the DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and Clearing the Statistical and Error Counters To clear the statistical and error counters of the hardware accelerator of a router, perform the following steps. SUMMARY STEPS 1. enable 2. clear crypto engine accelerator counter DETAILED STEPS Step 1 Command Purpose enable Enables privileged EXEC mode.
PAGE 6
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) Additional References Step 3 Command Purpose show crypto engine accelerator statistic Displays the statistics and error counters for the onboard hardware accelerator of the router for IPsec encryption. Example: Router# show crypto engine accelerator statistic Additional References The following sections provide references related to DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3).
PAGE 7
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) Command Reference MIBs MIB MIBs Link No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature. To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: http://www.cisco.
PAGE 8
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) crypto engine aim crypto engine aim To reenable an advanced integration module (AIM) encryption module, use the crypto engine aim command in global configuration mode. To disable an AIM encryption module, use the no form of this command. crypto engine aim aim-slot-number no crypto engine aim aim-slot-number Syntax Description aim-slot-number Defaults An AIM module is not reenabled or disabled.
PAGE 9
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) show crypto engine show crypto engine To display a summary of the configuration information for the crypto engines, use the show crypto engine command in privileged EXEC mode. show crypto engine [accelerator | brief | configuration | connections | qos] Syntax Description accelerator (Optional) Displays crypto accelerator information.
PAGE 10
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) show crypto engine VPN Module in slot: 0 Product Name: AIM-VPN/SSL-3 Software Serial #: 55AA Device ID: 001F - revision 0000 Vendor ID: 0000 Revision No: 0x001F0000 VSK revision: 0 Boot version: 255 DPU version: 0 HSP version: 3.
PAGE 11
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) show crypto engine Table 2 show crypto engine brief Field Descriptions (Continued) Field Description crypto engine state The state “installed” indicates that a crypto engine is located in the given slot, but it is not configured for encryption. The state “dss key generated” indicates the crypto engine found in that slot has DSS keys already generated.
PAGE 12
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) show crypto engine accelerator statistic show crypto engine accelerator statistic To display IP Security (IPsec) encryption statistics and error counters for the onboard hardware accelerator of the router or the IPsec Virtual Private Network (VPN) Shared Port Adapter (SPA), use the show crypto engine accelerator statistic command in privileged EXEC mode.
PAGE 13
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) show crypto engine accelerator statistic Usage Guidelines Release Modification 12.2(33)SRA This command was integrated into Cisco IOS Release 12.2(33)SRA to support the IPsec VPN SPA on Cisco 7600 series routers and Catalyst 6500 series switches. 12.4(9)T Output was added for the AIM-VPN Secure Sockets Layer (SSL) encryption module. No specific usage guidelines apply to the hardware accelerators.
PAGE 14
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) show crypto engine accelerator statistic ppq down errors : no buffer : dest overflow : Other error : IPSEC Unsupported Option: ESP Pad Length : AH ESP seq mismatch : AH ICV Incorrect : IPSEC ESP Modulo : Unexpected Protocol : IPSEC Pkt is fragment : Invalid IP Version : SSL Output overrun : SSL BAD Decomp History : SSL Input overrun : SSL Input Underrun : SSL Unrecognised content: PPTP Duplicate packet : RNG self test fail
PAGE 15
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) show crypto engine accelerator statistic Table 3 show crypto engine accelerator statistic Compression Statistics Descriptions Counter Description packets bypass compres Number of packets that were not compressed because they were too small (<128 bytes). packets not compressed Number of packets that were not compressed because the packets are expanded rather than compressed.
PAGE 16
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) show crypto engine accelerator statistic Reassembly Frag RX.......: IPSec Fragments..........: IPSec Reasm Done.........: Clear Fragments..........: Clear Reasm Done.........: Datagrams Drop...........: Fragments Drop...........: 0 0 0 0 0 0 0 Decryption Side Controller Statistics ===================================== Frames RX................: 756088 Bytes RX.................: 63535848 Mcast/Bcast Frames RX....
PAGE 17
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) show crypto engine accelerator statistic Mcast/Bcast Frames RX....: RX Less 128Bytes.........: RX Less 512Bytes.........: RX Less 1KBytes..........: RX Less 9KBytes..........: RX Frames Drop...........: 1586 1562 452503 0 0 0 Frames TX................: Bytes TX.................: Mcast/Bcast Frames TX....: TX Less 128Bytes.........: TX Less 512Bytes.........: TX Less 1KBytes..........: TX Less 9KBytes..........
PAGE 18
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) show crypto engine accelerator statistic Table 4 show crypto engine accelerator statistic IPsec VPN SPA Statistics Descriptions (Continued) Field Description SPD Errors Number of Security Policy Database (SPD) errors. HA Standby Drop Number of packet drops on a High Availability (HA) standby IPSec VPN SPA. Note The standby IPSec VPN SPA is not supposed to receive packets.
PAGE 19
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) show crypto engine accelerator statistic Table 4 show crypto engine accelerator statistic IPsec VPN SPA Statistics Descriptions (Continued) Field Description TX Less 512Bytes Number of frames with size greater than or equal to 128 bytes and less than 512 bytes. TX Less 1KBytes Number of frames with size greater than or equal to 512 bytes and less than 1 KB.
PAGE 20
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) show crypto engine accelerator statistic Table 4 show crypto engine accelerator statistic IPsec VPN SPA Statistics Descriptions (Continued) Field Description Encryption Side Controller Statistics Related Commands Frames RX Number of frames received. Bytes RX Number of bytes received. Mcast/Bcast Frames RX Number of multicast/broadcast frames received. RX Less 128Bytes Number of frames less than 128 bytes.
PAGE 21
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) show crypto engine accelerator statistic Command Description debug crypto engine accelerator control Displays each control command as it is given to the crypto engine. debug crypto engine accelerator packet Displays information about each packet sent for encryption and decryption. show crypto engine accelerator ring Displays the contents of command and transmit rings for the crypto engine.
PAGE 22
DES/3DES/AES VPN Encryption Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) Feature Information for DES/3DES/AES VPN Encrytion Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) Feature Information for DES/3DES/AES VPN Encrytion Module (AIM-VPN/SSL-1, AIM-VPN/SSL-2, and AIM-VPN/SSL-3) Table 5 lists the release history for this feature. Not all commands may be available in your Cisco IOS software release.