Guest

Cisco Security Modules for Routers and Switches

Cisco VPN Services Adapter

  • Viewing Options

  • PDF (91.3 KB)
  • Feedback

Product Overview

The Cisco ® VPN Services Adapter (VSA) for Cisco 7200 Series routers provides high-performance encryption and key-generation services for IP Security (IPsec) VPN applications. With the Cisco VSA, customers can use their existing Cisco 7200 routing infrastructures for cost-effective deployment-and can do so while obtaining the highest IPsec performance available in this class of routers, providing secure VPN connectivity along with multilayer LAN and WAN routing capabilities.
Cisco VSA greatly increases the performance over the existing VPN acceleration modules. Like the VAM2+, the VSA supports Data Encryption Standard (DES), Triple DES (3DES), and Advanced Encryption Standard (AES). It includes hardware acceleration for 128-, 192-, and 256-bit AES keys. The VSA requires the Cisco 7200 Series NPE-G2 Network Processing Engine and fits into the I/O controller slot on the Cisco 7204VXR or 7206VXR chassis, conserving valuable bandwidth points for other port adapters.
This combination of security features and high performance offers a flexible, integrated approach to accommodate the most diverse enterprise or service provider network environments, while providing investment protection for existing Cisco 7200 Series router customers.

Figure 1. Cisco VPN Services Adapter (VSA)

Table 1 describes the Cisco VSA.

Table 1. Hardware Security Features

Feature

Description

Physical

Service adapter; installs in the I/O slot on Cisco 7200 Series routers

Platform Support

Cisco 7200 Series routers with the NPE-G2

Throughput*

960 Mbs

Number of IPsec-Protected Tunnels

Up to 5000 tunnels

Hardware-Based Encryption

Data protection: IPsec DES, 3DES, or AES

Authentication: RSA and Diffie-Hellman

Data integrity: Secure Hash Algorithm (SHA) and Message Digest Algorithm 5 (MD5)

VPN Tunneling

IPsec tunnel mode; generic routing encapsulation (GRE) and Layer 2 Tunneling Protocol (L2TP) protected by IPsec

LAN or WAN Interface Selection

On Cisco 7200 Series, VPN Services Adapter (VSA) works with most Cisco 7200 VXR-compatible port adapters

Minimum Cisco IOS® Software Release Image

Support for Cisco VSA begins in IOS Software release 12.4(11)T.

IPsec VPN Solutions Supported

Group Encrypted Transport (GET) VPN, Dynamic Multipoint VPN (DMVPN), Easy VPN, Site-to-Site IPSec & IPSec/GRE solutions

Standards Supported

IPSec with Internet Key Exchange (IKE): RFCs 2401-2411 and 2451

* 960 Mbps with 1400 Byte Packets

Cisco VSA Features

Engineered to deliver secure IPsec services, the Cisco VSA offers a unique blend of IPsec security features. Table 2 lists the various IPsec features supported by the Cisco VSA on the Cisco 7200 Series routers.

Table 2. Cisco VSA IPsec Features and Benefits

Features

Benefits

GET VPN

Revolutionary technology that provides IPsec encryption over private WAN connections without the use of tunnels.

DMVPN

Provides a scalable and flexible way to establish virtual full-meshed IPSec tunnels from branch to branch. Zero configuration at hub when adding new spokes.

Easy VPN

Eases administration and management of point-to-point VPNs by actively pushing new security policies from a single headend to remote sites.

IPSec/GRE

Provides IPSec/GRE support for customers looking to traverse multicast/routing traffic over their encrypted link. IPsec inherently provides unicast traffic support only.

Multi-VRF and MPLS Secure Contexts

Supports multiple independent contexts (addressing, routing and interfaces) for separation of departments, subsidiaries, or customers. All contexts can share a single uplink connection to the core, (for example, IPSec VPN, or Frame Relay/ATM), while still maintaining secure separation between them.

Secure Provisioning/Digital Certificates

A simple, powerful mechanism for enrolling new remote-site devices in a secure network infrastructure

V3PN

Delivers cost-effective integrated voice, video, and data over VPN to any location

Virtual Tunnel Interface (VTI)

Simplifies VPN configuration and design

Cisco Management Software for IPsec VPNs

Single-Device Management

The Cisco Router and Security Device Manager (SDM) is an intuitive, Web-based device management tool for Cisco IOS Software routers. Cisco SDM simplifies router and security configuration through intelligent wizards, helping customers quickly and easily deploy, configure, and monitor a Cisco Systems ® router without requiring knowledge of the Cisco IOS Software command-line interface (CLI).

Multiple-Device Management

Cisco Security Manager is a powerful but easy-to-use solution to centrally provision all aspects of security policies for Cisco firewalls and VPNs. It can also cross launch to software, which is provided to manage intrusion prevention systems (IPSs). Management of IPSs will be further integrated into Cisco Security Manager in a following release.
Cisco Security Manager is suitable for managing small networks consisting of a handful of devices, but also scales to efficiently manage large-scale networks consisting of thousands of devices. Scalability is achieved through intelligent, policy-based management techniques that can simplify administration.
For more information about Cisco Security Manager, go to http://www.cisco.com/go/csmanager

Ordering Information

Cisco VSA support begins in Cisco IOS Software release12.4(11)T. The recommended Cisco IOS Software for deploying the VSA is 12.4(15)T image. Table 3 provides a summary of part numbers. A Cisco 7200 Series security bundle that includes the VSA is currently available for easy ordering.

Table 3. Part Numbers for Cisco VSA Bundle and Spare

Part Number

Description

7206VXRG2/VSAVPNK9

Cisco 7200 System Bundle for G2 and VSA

C7200-VSA=

VSA for Cisco 7200 Series routers (spare)

For more information about 7200 Security bundles, please visit http://www.cisco.com/en/US/products/hw/routers/ps341/prod_bulletins_list.html.

Export Regulations

The Cisco VSA module itself is not controlled, but 3DESsoftware for the module is controlled by U.S. export regulations on encryption products. U.S. regulations require the recording of names and addresses of recipients of DES and 3DES software. For more details, visit http://www.cisco.com/wwl/export/crypto/.

Certifications

Cisco is committed to maintaining an active product certification and evaluation program for customers worldwide. Recognizing that certifications and evaluations are important to customers, Cisco continues to be a leader in providing certified and evaluated products to the marketplace. The company also will continue to work with international security standards bodies to help shape the future of certified and evaluated products, and will work to accelerate certification and evaluation processes. Certification and evaluation are considered at the earliest part of the company's product development cycle, and Cisco will continue to position its security products to help ensure that customers have certified and evaluated products to meet their needs. For security certification product details, visit http://www.cisco.com/en/US/netsol/ns340/ns394/ns171/networking_solutions_audience_business_benefit0900aecd8009a16f.html.