® VPN Services Adapter (VSA) for Cisco 7200 Series routers provides high-performance encryption and key-generation services for IP Security (IPsec) VPN applications. With the Cisco VSA, customers can use their existing Cisco 7200 routing infrastructures for cost-effective deployment-and can do so while obtaining the highest IPsec performance available in this class of routers, providing secure VPN connectivity along with multilayer LAN and WAN routing capabilities.
Cisco VSA greatly increases the performance over the existing VPN acceleration modules. Like the VAM2+, the VSA supports Data Encryption Standard (DES), Triple DES (3DES), and Advanced Encryption Standard (AES). It includes hardware acceleration for 128-, 192-, and 256-bit AES keys. The VSA requires the Cisco 7200 Series NPE-G2 Network Processing Engine and fits into the I/O controller slot on the Cisco 7204VXR or 7206VXR chassis, conserving valuable bandwidth points for other port adapters.
This combination of security features and high performance offers a flexible, integrated approach to accommodate the most diverse enterprise or service provider network environments, while providing investment protection for existing Cisco 7200 Series router customers.
Figure 1. Cisco VPN Services Adapter (VSA)
Table 1 describes the Cisco VSA.
Table 1. Hardware Security Features
Service adapter; installs in the I/O slot on Cisco 7200 Series routers
Cisco 7200 Series routers with the NPE-G2
Number of IPsec-Protected Tunnels
Up to 5000 tunnels
Data protection: IPsec DES, 3DES, or AES
Authentication: RSA and Diffie-Hellman
Data integrity: Secure Hash Algorithm (SHA) and Message Digest Algorithm 5 (MD5)
IPsec tunnel mode; generic routing encapsulation (GRE) and Layer 2 Tunneling Protocol (L2TP) protected by IPsec
LAN or WAN Interface Selection
On Cisco 7200 Series, VPN Services Adapter (VSA) works with most Cisco 7200 VXR-compatible port adapters
Minimum Cisco IOS® Software Release Image
Support for Cisco VSA begins in IOS Software release 12.4(11)T.
IPsec VPN Solutions Supported
Group Encrypted Transport (GET) VPN, Dynamic Multipoint VPN (DMVPN), Easy VPN, Site-to-Site IPSec & IPSec/GRE solutions
IPSec with Internet Key Exchange (IKE): RFCs 2401-2411 and 2451
* 960 Mbps with 1400 Byte Packets
Cisco VSA Features
Engineered to deliver secure IPsec services, the Cisco VSA offers a unique blend of IPsec security features. Table 2 lists the various IPsec features supported by the Cisco VSA on the Cisco 7200 Series routers.
Table 2. Cisco VSA IPsec Features and Benefits
Revolutionary technology that provides IPsec encryption over private WAN connections without the use of tunnels.
Eases administration and management of point-to-point VPNs by actively pushing new security policies from a single headend to remote sites.
Provides IPSec/GRE support for customers looking to traverse multicast/routing traffic over their encrypted link. IPsec inherently provides unicast traffic support only.
Multi-VRF and MPLS Secure Contexts
Supports multiple independent contexts (addressing, routing and interfaces) for separation of departments, subsidiaries, or customers. All contexts can share a single uplink connection to the core, (for example, IPSec VPN, or Frame Relay/ATM), while still maintaining secure separation between them.
Secure Provisioning/Digital Certificates
A simple, powerful mechanism for enrolling new remote-site devices in a secure network infrastructure
Delivers cost-effective integrated voice, video, and data over VPN to any location
Virtual Tunnel Interface (VTI)
Simplifies VPN configuration and design
Cisco Management Software for IPsec VPNs
The Cisco Router and Security Device Manager (SDM) is an intuitive, Web-based device management tool for Cisco IOS Software routers. Cisco SDM simplifies router and security configuration through intelligent wizards, helping customers quickly and easily deploy, configure, and monitor a Cisco Systems
® router without requiring knowledge of the Cisco IOS Software command-line interface (CLI).
Cisco Security Manager is a powerful but easy-to-use solution to centrally provision all aspects of security policies for Cisco firewalls and VPNs. It can also cross launch to software, which is provided to manage intrusion prevention systems (IPSs). Management of IPSs will be further integrated into Cisco Security Manager in a following release.
Cisco Security Manager is suitable for managing small networks consisting of a handful of devices, but also scales to efficiently manage large-scale networks consisting of thousands of devices. Scalability is achieved through intelligent, policy-based management techniques that can simplify administration.
Cisco VSA support begins in Cisco IOS Software release12.4(11)T. The recommended Cisco IOS Software for deploying the VSA is 12.4(15)T image. Table 3 provides a summary of part numbers. A Cisco 7200 Series security bundle that includes the VSA is currently available for easy ordering.
Table 3. Part Numbers for Cisco VSA Bundle and Spare
The Cisco VSA module itself is not controlled, but 3DESsoftware for the module is controlled by U.S. export regulations on encryption products. U.S. regulations require the recording of names and addresses of recipients of DES and 3DES software. For more details, visit
Cisco is committed to maintaining an active product certification and evaluation program for customers worldwide. Recognizing that certifications and evaluations are important to customers, Cisco continues to be a leader in providing certified and evaluated products to the marketplace. The company also will continue to work with international security standards bodies to help shape the future of certified and evaluated products, and will work to accelerate certification and evaluation processes. Certification and evaluation are considered at the earliest part of the company's product development cycle, and Cisco will continue to position its security products to help ensure that customers have certified and evaluated products to meet their needs. For security certification product details, visit