Cisco 1700 Series Modular Access Routers

Table Of Contents

Configuration of Software-Based Compression on Cisco 1700 Series Routers with Hardware Encryption

Overview

Limitations

Supported Platforms

Software Requirements

Configuring LZS Compression

LZS Compression Configuration Example

Verifying LZS Compression

Related Documents

Obtaining Documentation

World Wide Web

Documentation CD-ROM

Ordering Documentation

Documentation Feedback

Obtaining Technical Assistance

Cisco.com

Technical Assistance Center

Cisco TAC Web Site

Cisco TAC Escalation Center

Configuration of Software-Based Compression on Cisco 1700 Series Routers with Hardware Encryption

---

Overview

Cisco 1700 series routers with hardware encryption through a Virtual Private Network (VPN) module have not previously supported software compression of data. The only way to support compression with encryption on the Cisco 1700 series routers has been to disable the VPN module and to run software encryption with software compression, a configuration that is inherently inefficient. The feature described in this document allows the use of Cisco IOS-provided software compression while maintaining hardware encryption through the use of a VPN module.

The compression algorithm used is Lempel-Ziv-Stac (LZS) compression, the most widely accepted lossless compression algorithm at this time. It is implemented on layer 3, as is the hardware encryption. It can considerably reduce bandwidth requirements to support IP Security (IPSec).

Limitations

The use of LZS compression in Cisco 1700 series routers is subject to the following limitations:

•LZS compression is intended for low-speed WAN links. The intended capability is to compress/decompress two 128-Kbps streams simultaneously.

•Packets that are compressed must be from 128 bytes to 5000 bytes in size. Packets outside this range will not be compressed. Compression will be bypassed for these packets, and they will be forwarded unaltered.

•This implementation operates on data streams only. Voice and video packets are not to be compressed or decompressed by the operations described in this document.

Supported Platforms

Software-based compression with hardware encryption is supported on the following platforms:

•Cisco 1710 router

•Cisco 1720 and 1721 routers

•Cisco 1751 router

•Cisco 1760 router

Software Requirements

Software-based compression with hardware encryption requires Cisco IOS Release 12.2(8)YL or later.

Configuring LZS Compression

LZS compression is configured as part of the configuration for a VPN module. The procedure in this section tells how to configure a VPN module for your router and how to implement LZS compression. LZS compression is specified in Step 6.

Begin in global configuration mode. For detailed information about how to configure a VPN module, refer to the Cisco 1700 Series Router Software Configuration Guide.

	Command	Purpose
Step 1	crypto isakmp policy policy	Defines an Internet Key Exchange (IKE) policy, and assigns the policy a priority. This command places the router in IKE policy configuration mode.
Step 2	hash algorithm	Specifies the hash algorithm for the policy. Typically, this algorithm is md5.
Step 3	encryption encryption	Specifies the encryption for the policy. The VPN module supports des or 3des encryption.
Step 4	authentication pre-share	Specifies pre-share key as the authentication method.
Step 5	crypto isakmp key name address ip-address	Configures a pre-share key and static IP address for each VPN client.
Step 6	crypto ipsec transform-set name ah-hash algorithm-hmac esp-encryption comp-compression	Defines the IPSec transform set, which is a combination of security associations to occur during IPSec negotiations. The transform set is given a name, and the hash algorithm and the encryption method defined in Step 2 and Step 3 are given. The compression algorithm is specified to be lzs.
Step 7	crypto map name seq-num ipsec-isakmp	Creates a crypto map entry in IPSec ISAKMP mode, and enters the crypto map configuration mode.
Step 8	set peer ip-address	Identifies the remote IPSec peer.
Step 9	set transform-set name	Specifies the transform set to be used.
Step 10	match address access-list-id	Specifies an extended access list for the crypto map entry.

LZS Compression Configuration Example

This section shows an example of the configuration of a Cisco 1700 series router to implement LZS compression. The compression algorithm is implemented by the crypto ipsec transform-set command.

version 12.2

no parser cache

service timestamps debug uptime

service timestamps log uptime

no serivce password-encryption

!

hostname 1710

!

memory-size iomem 25

mmi polling-interval 60

no mmi auto-configure

no mmi pvc

mmi snmp-timeout 180

ip subnet-zero

!

ip ssh time-out 120

ip ssh authentication-retries 3

!

crypto isakmp policy 1

encr 3des

hash md5

authentication pre-share

group 2

crypto isakmp key transducer address 4.0.0.2

!

crypto ipsec transform-set set1 ah-md5-hmac esp-3des comp-lzs

!

crypto map test2 10 ipsec-isakmp

set peer 4.0.0.2

set transform-set set1

match address 101

!

interface Ethernet0

ip address 4.0.0.1 255.255.255.0

half-duplex

crypto map test2

!

interface FastEthernet0

ipaddress 1.9.85.31 255.255.255.0

speed auto

!

ip classless

ip route 5.0.0.0 255.255.255.0 Ethernet0

no ip http server

ip pim bidir-enable

!

access-list 101 permit ip 1.9.0.0 0.0.255.255 5.0.0.0 0.0.0.255

!

line con 0

line aux 0

line vty 0 4

 login

!

no schedular allocate

end

Verifying LZS Compression

LZS compression may be verified with the following command:

show crypto engine accelerator statistic

This command has had counters added to its output in order to display compression and decompression statistics for packets and bytes in the data stream, and to indicate the compression ratios achieved.

router#show crypto engine accelerator statistic  
C1700_EM:

  ds: 0x81784BA4 idb:0x81780560

  Statistics for Virtual Private Network (VPN) Module: 

     10 packets in                  10 packets out

     0 paks/sec in                  0 paks/sec out

     0 Kbits/sec in                 0 Kbits/sec out

     5 packets decompressed         5 packets compressed

     235 compressed bytes in        640 uncompressed bytes in

     235 compressed bytes out       640 decompressed bytes out

     0 packets bypass compression   0 packets abort compression

     2.7:1 compression ratio        2.7:1 overall compression ratio

  rx_no_endp: 0 rx_hi_discards: 0 fw_failure: 0 

  invalid_sa: 0 invalid_flow: 0 cgx_errors 0 

  fw_qs_filled: 0 fw_resource_lock:0 lotx_full_err: 0 

  null_ip_error: 0 pad_size_error: 0 out_bound_dh_acc: 0 

  esp_auth_fail: 0 ah_auth_failure: 0 crypto_pad_error: 0 

  ah_prot_absent: 0 ah_seq_failure: 0 ah_spi_failure: 0 

  esp_prot_absent:0 esp_seq_fail: 0 esp_spi_failure: 0 

  obound_sa_acc: 0 invalid_sa: 0 out_bound_sa_flow: 0 

  invalid_dh: 0 bad_keygroup: 0 out_of_memory: 0 

  no_sh_secret: 0 no_skeys: 0 invalid_cmd: 0 

  dsp_coproc_err: 0 comp_unsupported:0 pak_too_big: 0 

  pak_mp_length_spec_fault: 0 

  tx_lo_queue_size_max 0 cmd_unimplemented: 0 

  48 seconds since last clear of counters

  Interrupts: Notify = 20, Reflected = 10, Spurious = 0

  cgx_cmd_pending:0 packet_loop_max:2 packet_loop_limit: 512

The following table defines the compression statistics counters. These counters may be cleared by using the top-level clear counter command.

Counter	Meaning
packets decompressed	The number of packets that were decompressed by the compression engine.
packets compressed	The number of packets that were compressed by the compression engine.
compressed bytes in	The number of compressed bytes that were presented to the compression engine after the data was decrypted.
uncompressed bytes in	The number of uncompressed bytes that were presented to the compression engine before encryption.
compressed bytes out	The number of compressed bytes output after compression and encryption.
decompressed bytes out	The number of decompressed bytes output after decryption and decompression.
packets bypass compression	The number of packets that were not compressed because they •Were too small (less than 128 bytes). •Were too large (greater than 5000 bytes). •Resulted in degenerative compression.
packets abort compression	The number of packets that were not compressed due to problems in the compression engine.
compression ratio	A measure of the efficiency of the compression engine. The compression ratio is the ratio of compression and decompression of all those packets successfully compressed or decompressed.
overall compression ratio	The ratio of compression and decompression of all packets presented to the compression engine, including packets that were not compressed because the compression was bypassed or aborted. This ratio indicates whether the data traffic is suitable for compression. A ratio of 1:1 implies that no successful compression is being performed on the data traffic.

Related Documents

This document provides information on the use of LZS compression in Cisco 1700 series routers.

For further information on the crypto ipsec transform-set command used to control LZS compression, refer to the following documents:

•Cisco IOS Security Configuration Guide, Release 12.2

•Cisco IOS Security Command Reference, Release 12.2

Obtaining Documentation

These sections explain how to obtain documentation from Cisco Systems.

World Wide Web

You can access the most current Cisco documentation on the World Wide Web at this URL:

http://www.cisco.com

Translated documentation is available at this URL:

http://www.cisco.com/public/countries_languages.shtml

Documentation CD-ROM

Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which is shipped with your product. The Documentation CD-ROM is updated monthly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual subscription.

Ordering Documentation

You can order Cisco documentation in these ways:

•Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Networking Products MarketPlace:

http://www.cisco.com/cgi-bin/order/order_root.pl

•Registered Cisco.com users can order the Documentation CD-ROM through the online Subscription Store:

http://www.cisco.com/go/subscription

•Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, U.S.A.) at 408 526-7208 or, elsewhere in North America, by calling 800 553-NETS (6387).

Documentation Feedback

You can submit comments electronically on Cisco.com. In the Cisco Documentation home page, click the Fax or Email option in the "Leave Feedback" section at the bottom of the page.

You can e-mail your comments to bug-doc@cisco.com.

You can submit your comments by mail by using the response card behind the front cover of your document or by writing to the following address:

Cisco Systems
Attn: Document Resource Connection
170 West Tasman Drive
San Jose, CA 95134-9883

We appreciate your comments.

Obtaining Technical Assistance

Cisco provides Cisco.com as a starting point for all technical assistance. Customers and partners can obtain online documentation, troubleshooting tips, and sample configurations from online tools by using the Cisco Technical Assistance Center (TAC) Web Site. Cisco.com registered users have complete access to the technical support resources on the Cisco TAC Web Site.

Cisco.com

Cisco.com is the foundation of a suite of interactive, networked services that provides immediate, open access to Cisco information, networking solutions, services, programs, and resources at any time, from anywhere in the world.

Cisco.com is a highly integrated Internet application and a powerful, easy-to-use tool that provides a broad range of features and services to help you with these tasks:

•Streamline business processes and improve productivity

•Resolve technical issues with online support

•Download and test software packages

•Order Cisco learning materials and merchandise

•Register for online skill assessment, training, and certification programs

If you want to obtain customized information and service, you can self-register on Cisco.com. To access Cisco.com, go to this URL:

http://www.cisco.com

Technical Assistance Center

The Cisco Techncial Assistance Center (TAC) is available to all customers who need technical assistance with a Cisco product, technology, or solution. Two levels of support are available: the Cisco TAC Web Site and the Cisco TAC Escalation Center.

Cisco TAC inquiries are categorized according to the urgency of the issue:

•Priority level 4 (P4)—You need information or assistance concerning Cisco product capabilities, product installation, or basic product configuration.

•Priority level 3 (P3)—Your network performance is degraded. Network functionality is noticeably impaired, but most business operations continue.

•Priority level 2 (P2)—Your production network is severely degraded, affecting significant aspects of business operations. No workaround is available.

•Priority level 1 (P1)—Your production network is down, and a critical impact to business operations will occur if service is not restored quickly. No workaround is available.

The Cisco TAC resource that you choose is based on the priority of the problem and the conditions of service contracts, when applicable.

Cisco TAC Web Site

You can use the Cisco TAC Web Site to resolve P3 and P4 issues yourself, saving both cost and time. The site provides around-the-clock access to online tools, knowledge bases, and software. To access the Cisco TAC Web Site, go to this URL:

http://www.cisco.com/tac

All customers, partners, and resellers who have a valid Cisco service contract have complete access to the technical support resources on the Cisco TAC Web Site. The Cisco TAC Web Site requires a Cisco.com login ID and password. If you have a valid service contract but do not have a login ID or password, go to this URL to register:

http://www.cisco.com/register/

If you are a Cisco.com registered user, and you cannot resolve your technical issues by using the Cisco TAC Web Site, you can open a case online by using the TAC Case Open tool at this URL:

http://www.cisco.com/tac/caseopen

If you have Internet access, we recommend that you open P3 and P4 cases through the Cisco TAC Web Site.

Cisco TAC Escalation Center

The Cisco TAC Escalation Center addresses priority level 1 or priority level 2 issues. These classifications are assigned when severe network degradation significantly impacts business operations. When you contact the TAC Escalation Center with a P1 or P2 problem, a Cisco TAC engineer automatically opens a case.

To obtain a directory of toll-free Cisco TAC telephone numbers for your country, go to this URL:

http://www.cisco.com/warp/public/687/Directory/DirTAC.shtml

Before calling, please check with your network operations center to determine the level of Cisco support services to which your company is entitled: for example, SMARTnet, SMARTnet Onsite, or Network Supported Accounts (NSA). When you call the center, please have available your service agreement number and your product serial number.

This document is to be used in conjunction with the documents listed in the "Related Documents" section.

Copyright © 2002, Cisco Systems, Inc.
All rights reserved.