Details the implementation of Layer 1 encryption using OTNSec and IKEv2 on Cisco NCS 1004 platforms. This chapter guides users through configuring authentication methods, managing security associations, ensuring FIPS compliance, and troubleshooting common session issues to secure client traffic across fiber-optic networks.
In this chapter, "layer 1 encryption" is referred to as "OTNSec".
| Feature Name |
Release Information |
Feature Description |
|---|---|---|
| Encryption Support on 1.2TL Card |
Cisco IOS XR Release 7.3.1 |
AES 256 GCM authenticated OTNSec encryption on 1.2TL line cards is supported. It uses only pre-shared keys for authentication. Optical encryption secures the communications link in and out of a facility, rendering all data undecipherable to hackers who tap into networks. |
| Encryption Support on OTN-XP Card |
Cisco IOS XR Release 7.8.1 |
AES 256-GCM authenticated OTNSec encryption is supported on the OTN-XP card. The encryption is enabled on the ODUC4 controller. This encryption secures the data across different datapaths of the OTN-XP card. |
| Encryption for 10G clients and 100GE clients on OTN-XP Card |
Cisco IOS XR Release 7.9.1 |
OTN-XP card now supports AES 256-GCM authenticated OTNSec encryption for 10G and 100GE clients in the 40x10G-4x100G-MXP mode. As this authentication method uses a key size of 256 bits, it provides considerably strong cryptography acceptable by enterprise, and public sector organizations. |
OTNSec encryption mechanisms in Cisco NCS 1004
Explains how Cisco NCS 1004 uses AES256-based OTNSec encryption to protect 100GE client traffic, and covers prerequisites, IKEv2 protocol, certificate-based authentication, FIPS compliance, configuration tasks, verification, and troubleshooting.
IKEv2 certificate-based authentication methods
Explains how IKEv2 uses RSA digital signatures and PKI to authenticate peer devices during the establishment of security associations.
Configuring OTNSec workflows on NCS1004
Describes the workflow, key components, and process stages for configuring IKEv2 and OTNSec encryption on NCS1004 using CA-based and PSK-based authentication.
FIPS compliance for IKEv2 sessions
Describes FIPS compliance for IKEv2 sessions, a security standard that requires all IKEv2 sessions to use only FIPS-approved cryptographic algorithms and key parameters.
Troubleshooting IKE session issues
Provides troubleshooting steps and command references to resolve common IKE session issues on the device.