Connecting External Encryption Equipment (KG-194, KIV-19) to NM-4T, PA-4T+, PA-8T, and FSIP Cisco Serial Interfaces

Introduction

This document contains configuration and resolution information about connecting external encryption equipment (crypto) to Cisco 36xx/NM-4T, Cisco 72xx/PA-4T+, and Cisco 75xx/PA-4T+/PA-8T serial interfaces. When you use Cisco IOS® Software Release 11.2(x) and later with the Fast Serial Interface Processor (FSIP) on the 75xx router platform, as well as the NM-4T, PA-4T+, and PA-8T on any hardware platform, the crypto equipment, while connected to any of the stated Cisco hardware combinations, could fail to successfully establish synchronization after a circuit interruption or an equipment reset. The only option is to remove the pulse-time x command. This command controls how data terminal ready (DTR) functions on the serial interface. Also, in some instances, on the Cisco 75xx platform, the router has to be reloaded. Since hardware configurations vary according to customer-specific security requirements, different EIA-530 cabling pinouts are used. These different wiring combinations have caused different variations of the problem, which results in several Cisco bugs being opened.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

This document is not restricted to specific software and hardware versions.

Conventions

For more information on document conventions, refer to the Cisco Technical Tips Conventions.

Cables

Customers who typically experience this problem use EIA-530 cables to interconnect their crypto equipment to the Cisco NM-4T, PA-4T+, and PA-8T serial interfaces. This section describes the cables necessary to connect the KG-194 and KIV-19, using the Pulse Engineering Cryptographic Equipment Enclosure, to the Cisco serial interfaces previously mentioned in this document. Due to customer specific hardware applications, different EIA-530 cable pin outs are used on the "red," or unencrypted side of the cryptographic unit. The "red" side of the cryptographic unit connects to the Cisco serial interface on the router.

Red Cable - Cable Pinout Option 1

Red Cable - Cable Pinout Option 2

Red Cable - Cable Pinout Option 3

Black Cable - Cable Pinout

Testing Results

Testing of the resync problem consists of using different lab setups with the Cisco 7507/FSIP, 7507/PA-8T, 7507/VIP2-50/PA-4T+, 7206/PA-4T+, and 3640/NM-4T equipment. Platforms using the PA-4T, WIC-1T, and WIC-2T did not appear to be affected during testing. The lab connectivity consisted of:

The DTR control signal is used to resync, or "prep" a crypto unit after synchronization is lost. The pulse-time x command must be entered in the serial interface configuration, or the crypto unit has no way to know the data that is received by the router is corrupt.

The problem encountered on the Cisco 75xx platform is when a circuit disruption or crypto resync takes place. The configured pulse-time x command caused DTR to transition only once, therefore the resynchronization of the external encryption gear could not take place.

The problem encountered on the Cisco 72xx/36xx platforms is when a circuit disruption or crypto resync takes place. The configured pulse-time x command caused RTS to glitch every 1.5 ms, as seen with a digital oscilloscope. This occurred until the pulse-time x command was taken out of the serial interface configuration. This glitch is detrimental because the cabling scheme calls for the control signals to be tied together. This results in continuous interface resets.

Related Information

• Technical Support - Cisco Systems