The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
This chapter describes the Service Adapter VPN Acceleration Module 2 (SA-VAM2) and contains the following sections:
•Online Insertion and Removal (OIR)
•Supported Standards, MIBs, and RFCs
•LEDs
•Cables, Connectors, and Pinouts
This section describes data encryption, including the IPSec, IKE, and certification authority (CA) interoperability features.
Note For additional information on these features, refer to the "IP Security and Encryption" chapter in the Security Configuration Guide and Security Command Reference publications.
IPSec is a network level open standards framework, developed by the Internet Engineering Task Force (IETF) that provides secure transmission of sensitive information over unprotected networks such as the Internet. IPSec includes data authentication, antireplay services and data confidentiality services.
Cisco follows these data encryption standards:
•IPSec—IPSec is an IP layer open standards framework that provides data confidentiality, data integrity, and data authentication between participating peers. IKE handles negotiation of protocols and algorithms based on local policy, and generates the encryption and authentication keys to be used by IPSec. IPSec protects one or more data flows between a pair of hosts, between a pair of security routers, or between a security router and a host.
•IKE—Internet Key Exchange (IKE) is a hybrid security protocol that implements Oakley and Skeme key exchanges inside the Internet Security Association and Key Management Protocol (ISAKMP) framework. IKE can be used with IPSec and other protocols. IKE authenticates the IPSec peers, negotiates IPSec security associations, and establishes IPSec keys. IPSec can be configured with or without IKE.
•CA—certification authority (CA) interoperability supports the IPSec standard, using Simple Certificate Enrollment Protocol (SCEP) and Certificate Enrollment Protocol (CEP). CEP permits Cisco IOS devices and CAs to communicate to permit your Cisco IOS device to obtain and use digital certificates from the CA. IPSec can be configured with or without CA. The CA must be properly configured to issue certificates. For more information, see the "Configuring Certification Authority Interoperability" chapter of the Security Configuration Guide at http://www.cisco.com/en/US/products/sw/iosswrel/products_ios_cisco_ios_software_releases.html
The component technologies implemented for IPSec include:
•DES and Triple DES—The Data Encryption Standard (DES) and Triple DES (3DES) encryption packet data. Cisco IOS implements the 3-key Triple DES and DES-CBC with Explicit IV. Cipher Block Chaining (CBC) requires an initialization vector (IV) to start encryption. The IV is explicitly given in the IPSec packet.
•AES—The Advanced Encryption Standard, a next-generation symmetric encryption algorithm, used by the U.S. Government and organizations outside the U.S.
•MD5 (HMAC variant)—MD5 is a hash algorithm. HMAC is a keyed hash variant used to authenticate data.
•SHA (HMAC variant)—SHA is a hash algorithm. HMAC is a keyed hash variant used to authenticate data.
•RSA signatures and RSA encrypted nonces—RSA is the public key cryptographic system developed by Ron Rivest, Adi Shamir, and Leonard Adleman. RSA signatures provides non-repudiation while RSA encrypted nonces provide repudiation.
IPSec with the Cisco IOS software supports the following additional standards:
•AH—Authentication Header is a security protocol that provides data authentication and optional antireplay services.
The AH protocol uses various authentication algorithms; Cisco IOS software has implemented the mandatory MD5 and SHA (HMAC variants) authentication algorithms. The AH protocol provides antireplay services.
•ESP—Encapsulating Security Payload, a security protocol, provides data privacy services, optional data authentication, and antireplay services. ESP encapsulates the data to be protected. The ESP protocol uses various cipher algorithms and (optionally) various authentication algorithms. Cisco IOS software implements the mandatory 56-bit DES-CBC with Explicit IV or Triple DES as the encryption algorithm, and MD5 or SHA (HMAC variants) as the authentication algorithms. The updated ESP protocol provides antireplay services.
•IPPCP—IP Payload Compression Protocol. When using Layer 3 encryption, lower layers (such as PPP at Layer 2) cannot provide compression. When compressing already encrypted packets, expansion usually results. IPPCP provides stateless compression for use with encryption services such as IPSec.
The Service Adapter VPN Acceleration Module 2 (SA-VAM2) is a single-width port adapter (see Figure 1-1) supported on the Cisco 7301 router and the Cisco 7200VXR routers with the network processing engine 225 (NPE-225), 400 (NPE-400), and G1 (NPE-G1).
Note The NPE-300 processor and the Network Services Engine (NSE-1) services accelerator are no longer supported.
An SA-VAM2 provides hardware-assisted tunneling and encryption/compression services for Virtual Private Network (VPN) remote access, site-to-site intranets, and extranet applications, including security, quality of service (QoS), firewall and intrusion detection, and service-level validation and management. The SA-VAM2 offloads IPSec processing from the main processor to permit resources on the processor engines for other tasks.
The SA-VAM2 can be installed directly in the port adapter slots (see Figure 1-5, Figure 1-6, and Figure 1-7) of the Cisco 7000VXR series routers and the Cisco 7301 router (see Figure 1-8). Alternatively, you can install the SA-VAM2 into a Port Adapter Jacket Card (product ID:C7200-JC-PA) that is inserted in the I/O controller slot of a Cisco 7200VXR router with an NPE-G1 processor, for additional bandwidth (see Figure 1-2).
The SA-VAM2 support in the Port Adapter Jacket Card allows you to take advantage of the increase in NPE-G1 performance, while maintaining VPN performance. You allow more bandwidth to the regular port adapter slots when you install the SA-VAM2 in the Port Adapter Jacket Card. See the Port Adapter Jacket Card Installation Guide for more information.
Figure 1-1 SA-VAM2
Figure 1-2 Port Adapter Jacket Card Faceplate for the Cisco 7200VXR with an NPE-G1
|
Captive installation screw |
|
Handle |
|
ENABLE LED |
|
SA-VAM2/port adapter slot |
|
PWR (power) LED |
The SA-VAM2 provides hardware-accelerated support for multiple encryption functions:
•128-bit Advanced Encryption Standard (AES) in hardware and 192/256 bits in HSP software
•56-bit Data Encryption Standard (DES) standard mode: Cipher Block Chaining (CBC)
•Performance to OC3 full duplex with 300 byte packets
•5000 tunnels for DES/3DES/AES
•Provides compression with IPSec at no extra overhead
•3-Key Triple DES (168-bit)
•Secure Hash Algorithm (SHA)-1 and Message Digest 5 (MD5) hash algorithms
•Rivest, Shamir, Adelman (RSA) public-key algorithm
•Diffie-Hellman key exchange RC4-40
•IPSec tunnel mode
•Online Insertion and Removal (OIR)
This section describes the SA-VAM2 features (see Table 1-1), and the SA-VAM2 performance data (see Table 1-2).
|
|
---|---|
Physical |
Service adapter; installs in a single port-adapter slot on any Cisco 7200VXR router1 or Cisco 7301 router |
Platform support |
Cisco 7200VXR Series with NPE G1, NPE-400, or NPE-225 processors and Cisco 7301 Router |
Number of IPSec protected tunnels2 |
Up to 5000 on the Cisco 7200VXR routers |
Hardware-based encryption |
Data protection: IPSec DES, 3DES, and AES3 |
VPN tunneling |
IPsec tunnel mode; Generic Routing Encapsulation (GRE) and Layer 2 Tunneling Protocol (L2TP) protected by IPSec |
Hardware-based compression |
Layer 3 IPPCP LZS |
LAN/WAN interface selection |
Works with most Cisco 7200VXR-compatible port adapters |
Standards supported |
IPSec/IKE: RFCs 2401-2411, 2451 |
(Optional) Port Adapter Jacket Card |
The Port Adapter Jacket Card is available on the Cisco 7200VXR router with the NPE-G1 processor and Cisco IOS Release 12.4(6)T and 12.4(7) or later. |
1 The Cisco 7200VXR supports up to two SA-VAM2. 2 Number of tunnels supported varies based on the total system memory installed and the solution deployed. 3 AES supports 128 bits. |
Table 1-2 lists the performance information for the SA-VAM2.
|
|
|
---|---|---|
Cisco 7301 |
Up to 386 Mbps |
Cisco IOS: c7301-jk9o3s-mz.123-1.92 |
Cisco 7200VXR with NPE-G1 or NPE-400 |
Cisco IOS: c7200-jk9o3s-mz.123-1M2 |
|
Same as above, but with dual SA-VAM2s |
||
Cisco 7200VXR with NPE-225 |
Up to 218 Mbps |
Cisco IOS: c7200-jk9o3s-mz.123-1M2 |
Cisco 7200VXR with NSE-1 |
Up to 250 Mbps |
Cisco IOS: c7200-jk9o3s-mz.123-1M2 |
1 As measured with IPSec 3DES Hashed Message Authentication Code (HMAC)-SHA-1 on 1400-byte packets. Performance varies depending on the number of modules, bandwidth, traffic volume, Cisco IOS release, etc. 2 We recommend using the Cisco 12.3-1M image. Performance varies by Cisco IOS release. It is recommended that you download the most recent image for your Cisco 7200VXR or Cisco 7301 router. 3 When using two onboard Fast Ethernet I/O boards in UUT, the 1400 B performance is approximately 26-40% higher than using one onboard Fast Ethernet I/O board with Fast Ethernet port adapters |
The Online Insertion and Removal (OIR) feature is described in this section.
Online insertion and removal (OIR) is supported on the SA-VAM2. Before removing the SA-VAM2, we recommend that you shut down the interface so that there is no traffic running through the SA-VAM2 when it is removed. Removing a SA-VAM2 while traffic is flowing through the ports can cause system disruption.
OIR on the Port Adapter Jacket Card is not supported; however, the SA-VAM2 within the Port Adapter Jacket Card does support OIR. You must have the chassis powered off to install or remove the Port Adapter Jacket Card. See the Port Adapter Jacket Card Installation Guide for more information about the Port Adapter Jacket Card.
This section describes the standards, Management Information Bases (MIBs), and Request for Comments (RFCs) supported on the SA-VAM2. Requests for Comments (RFCs) contain information about the supported Internet suite of protocols.
•IPPCP: RFC 2393, 2395
•IPSec/IKE: RFCs 2401-2411, 2451
•CISCO-IPSEC-FLOW-MONITOR-MIB
•CISCO-IPSEC-MIB
•CISCO-IPSEC-POLICY-MAP-MIB
To obtain lists of supported MIBs by platform and Cisco IOS release, and to download MIB modules, go to the Cisco MIB website on Cisco.com at the following URL:
http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml
•IPPCP: RFC 2393, 2395
•IPSec/IKE: RFCs 2401-2411, 2451
This section includes information about the LEDs for the SA-VAM2 and the Port Adapter Jacket Card. See the Port Adapter Jacket Card Installation Guide for more information about the Port Adapter Jacket Card.
The SA-VAM2 has three LEDs, as shown in Figure 1-3. Table 1-3 lists the colors and functions of the LEDs.
Figure 1-3 SA-VAM2 LEDs
The following conditions must be met before the enabled LED goes on:
•The SA-VAM2 is correctly connected to the backplane and receiving power.
•The system bus recognizes the SA-VAM2.
If either of these conditions is not met, or if the router initialization fails for other reasons, the enabled LED does not go on.
The Port Adapter Jacket Card has two LEDs, as shown in Figure 1-4. Table 1-3 lists the colors and functions of the LEDs.
Note The Port Adapter Jacket Card is available on the Cisco 7200VXR router with the NPE-G1 processor only.
Figure 1-4 Port Adapter Jacket Card Faceplate
|
Captive installation screw |
|
Handle |
|
ENABLE LED |
|
Port adapter (SA-VAM2) slot |
|
PWR (power) LED |
There are no interfaces on the SA-VAM2, so there are no cables, connectors, or pinouts.
The topics in this section include:
The SA-VAM2 is supported in the port adapter slots on the Cisco 7301 router and the Cisco 7200VXR routers.
Note If a port adapter slot is not populated, insert a blank SM-PA filler in the slot (part number 800-00455-01).
See Figure 1-5, Figure 1-6, and Figure 1-7 for the slot numbering for the Cisco 7200VXR routers.
Figure 1-5 Cisco 7206 Slot Numbering
Figure 1-6 Cisco 7204 Slot Numbering
|
Port adapter slot 3 |
|
Port adapter slot 2 |
|
Port adapter slot 4 |
|
Port adapter slot 1 |
Figure 1-7 Cisco 7202 Slot Numbering
|
Port adapter slot 1 |
|
Port adapter slot 2 |
See Figure 1-8 for the slot numbering for the Cisco 7301 router.
Note The Cisco 7301 router supports a single SA-VAM2, or port adapter.
Figure 1-8 Cisco 7301 Slot Numbering
|
Latch |
|
Slot guides |
|
SA-VAM2 partially removed |
|
Ground for ESD wrist strap banana jack |