Installing VPN Encryption Modules in Cisco2600 Series, Cisco 3600 Series, and Cisco3700 Series Routers

Transcription

1 Installing VPN Encryption Modules in Cisco2600 Series, Cisco 3600 Series, and Cisco3700 Series Routers Product Numbers: AIM-VPN/BP, AIM-VPN/EP, AIM-VPN/HP, NM-VPN/MP This document describes how to install and configure the following virtual private network (VPN) encryption hardware (advanced integration modules [AIMs] and network modules [NMs]): AIM-VPN/BP: Basic performance VPN encryption AIM AIM-VPN/EP: Enhanced performance VPN encryption AIM AIM-VPN/HP: High performance VPN encryption AIM NM-VPN/MP: Encryption NM Use this document in conjunction with the hardware installation guide, the software configuration guide, and the Regulatory Compliance and Safety Information document for your router, and with the applicable Cisco IOS configuration guides and command references. If you have questions or need help, refer to the Obtaining Documentation section on page 46 and the Obtaining Technical Assistance section on page 47 for further information. Note If you have an older VPN AIM, the installation instructions will be different from those outlined in this document. Early MP, HP, and BP AIMs have 800 part numbers with a -02 version number and look like the AIM in Figure 1. Installation instructions for early modules can be found on the Web at: Cisco Product Documentation > Access Servers & Routers > Modular Access Routers > Cisco 3600 Series Routers > Hardware installation documents for Cisco 3600 series > Advanced interface module (AIM) installation > Installing the Data Encryption AIM in Cisco 2600 Series and Cisco 3600 Series Routers Corporate Headquarters: Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA USA Copyright Cisco Systems, Inc. All rights reserved.

2 Overview February 2002 Figure 1 Early Production VPN AIMs This document contains the following sections: Overview, page 2 Software Requirements, page 3 Safety Recommendations, page 3 Required Tools and Equipment, page 6 Installing a VPN AIM in Cisco Routers with 1-RU Chassis, page 7 Installing a VPN AIM in Cisco Routers with 2-RU Chassis, page 13 Installing an Encryption Network Module in a Cisco 3620 or Cisco 3640 Chassis Slot, page 20 Installing a VPN AIM in a Cisco 3660 Router, page 22 Installing a VPN AIM in a Cisco 3745 Chassis, page 29 Verifying VPN AIM installation, page 38 Configuring Internet Encryption, page 38 Obtaining Documentation, page 46 Obtaining Technical Assistance, page 47 Note Before performing procedures described in this document, review the Safety Recommendations section on page 3. Overview The VPN encryption Advanced Integration Modules (AIM) and Network Modules (NM) provide hardware-based encryption for the Cisco 2600 series, Cisco 3600 series, and Cisco 3700 series routers. These VPN encryption modules can be installed in the Cisco router platforms listed in Table 1. They require a Cisco IOS software release as listed in Table 1, and they require one of the Cisco IOS feature sets that includes IPSec. 2 Overview

3 February 2002 Software Requirements Table 1 Platform and Cisco IOS Software Compatibility for Encryption Modules Encryption Module Cisco Router Platform Cisco IOS Release AIM-VPN/BP Cisco 2600 series 12.1(3)XI or 12.1(5)T or later AIM-VPN/EP Cisco 2600 series 12.2(2)T or later Cisco (8)T or later AIM-VPN/HP Cisco (3)XI or 12.1(5)T or later Cisco (8)T or later NM-VPN/MP Cisco 3620 Cisco (3)XI or 12.1(5)T or later Software Requirements A Cisco IOS release as listed in Table 1 is required to use an encryption module. To determine the version of Cisco IOS software running on your router, log in to the router and enter the show version EXEC command: Router> show version Cisco Internetwork Operating System Software IOS (tm) 12.1 Software (c3600-i-mz), Version 12.1(3)XI, RELEASE SOFTWARE Safety Recommendations Follow these guidelines to ensure general safety: Keep the area clear and dust-free during and after installation. Keep tools away from walk areas where you or others could fall over them. Do not wear loose clothing that could get caught in the chassis. Fasten your tie or scarf and roll up your sleeves. Wear safety glasses when working under any conditions that might be hazardous to your eyes. Do not perform any action that creates a potential hazard to people or makes equipment unsafe. Safety Warnings Safety warnings appear throughout this publication in procedures that, if performed incorrectly, may harm you. A warning symbol precedes each warning statement. Software Requirements 3

4 Safety Recommendations February 2002 Warning Waarschuwing Varoitus Attention Warnung Avvertenza This warning symbol means danger. You are in a situation that could cause bodily injury. Before you work on any equipment, be aware of the hazards involved with electrical circuitry and be familiar with standard practices for preventing accidents. To see translations of the warnings that appear in this publication, refer to the Regulatory Compliance and Safety Information document that accompanied this device. Dit waarschuwingssymbool betekent gevaar. U verkeert in een situatie die lichamelijk letsel kan veroorzaken. Voordat u aan enige apparatuur gaat werken, dient u zich bewust te zijn van de bij elektrische schakelingen betrokken risico's en dient u op de hoogte te zijn van standaard maatregelen om ongelukken te voorkomen. Voor vertalingen van de waarschuwingen die in deze publicatie verschijnen, kunt u het document Regulatory Compliance and Safety Information (Informatie over naleving van veiligheids- en andere voorschriften) raadplegen dat bij dit toestel is ingesloten. Tämä varoitusmerkki merkitsee vaaraa. Olet tilanteessa, joka voi johtaa ruumiinvammaan. Ennen kuin työskentelet minkään laitteiston parissa, ota selvää sähkökytkentöihin liittyvistä vaaroista ja tavanomaisista onnettomuuksien ehkäisykeinoista. Tässä julkaisussa esiintyvien varoitusten käännökset löydät laitteen mukana olevasta Regulatory Compliance and Safety Information -kirjasesta (määräysten noudattaminen ja tietoa turvallisuudesta). Ce symbole d'avertissement indique un danger. Vous vous trouvez dans une situation pouvant causer des blessures ou des dommages corporels. Avant de travailler sur un équipement, soyez conscient des dangers posés par les circuits électriques et familiarisez-vous avec les procédures couramment utilisées pour éviter les accidents. Pour prendre connaissance des traductions d avertissements figurant dans cette publication, consultez le document Regulatory Compliance and Safety Information (Conformité aux règlements et consignes de sécurité) qui accompagne cet appareil. Dieses Warnsymbol bedeutet Gefahr. Sie befinden sich in einer Situation, die zu einer Körperverletzung führen könnte. Bevor Sie mit der Arbeit an irgendeinem Gerät beginnen, seien Sie sich der mit elektrischen Stromkreisen verbundenen Gefahren und der Standardpraktiken zur Vermeidung von Unfällen bewußt. Übersetzungen der in dieser Veröffentlichung enthaltenen Warnhinweise finden Sie im Dokument Regulatory Compliance and Safety Information (Informationen zu behördlichen Vorschriften und Sicherheit), das zusammen mit diesem Gerät geliefert wurde. Questo simbolo di avvertenza indica un pericolo. La situazione potrebbe causare infortuni alle persone. Prima di lavorare su qualsiasi apparecchiatura, occorre conoscere i pericoli relativi ai circuiti elettrici ed essere al corrente delle pratiche standard per la prevenzione di incidenti. La traduzione delle avvertenze riportate in questa pubblicazione si trova nel documento Regulatory Compliance and Safety Information (Conformità alle norme e informazioni sulla sicurezza) che accompagna questo dispositivo. 4 Safety Warnings

5 February 2002 Safety Recommendations Advarsel Aviso Advertencia Varning Dette varselsymbolet betyr fare. Du befinner deg i en situasjon som kan føre til personskade. Før du utfører arbeid på utstyr, må du vare oppmerksom på de faremomentene som elektriske kretser innebærer, samt gjøre deg kjent med vanlig praksis når det gjelder å unngå ulykker. Hvis du vil se oversettelser av de advarslene som finnes i denne publikasjonen, kan du se i dokumentet Regulatory Compliance and Safety Information (Overholdelse av forskrifter og sikkerhetsinformasjon) som ble levert med denne enheten. Este símbolo de aviso indica perigo. Encontra-se numa situação que lhe poderá causar danos físicos. Antes de começar a trabalhar com qualquer equipamento, familiarize-se com os perigos relacionados com circuitos eléctricos, e com quaisquer práticas comuns que possam prevenir possíveis acidentes. Para ver as traduções dos avisos que constam desta publicação, consulte o documento Regulatory Compliance and Safety Information (Informação de Segurança e Disposições Reguladoras) que acompanha este dispositivo. Este símbolo de aviso significa peligro. Existe riesgo para su integridad física. Antes de manipular cualquier equipo, considerar los riesgos que entraña la corriente eléctrica y familiarizarse con los procedimientos estándar de prevención de accidentes. Para ver una traducción de las advertencias que aparecen en esta publicación, consultar el documento titulado Regulatory Compliance and Safety Information (Información sobre seguridad y conformidad con las disposiciones reglamentarias) que se acompaña con este dispositivo. Denna varningssymbol signalerar fara. Du befinner dig i en situation som kan leda till personskada. Innan du utför arbete på någon utrustning måste du vara medveten om farorna med elkretsar och känna till vanligt förfarande för att förebygga skador. Se förklaringar av de varningar som förkommer i denna publikation i dokumentet Regulatory Compliance and Safety Information (Efterrättelse av föreskrifter och säkerhetsinformation), vilket medföljer denna anordning. Safety with Electricity Follow these guidelines when working on equipment powered by electricity: Locate the emergency power-off switch in the room in which you are working. Then, if an electrical accident occurs, you can quickly shut the power OFF. Before working on the router, turn OFF the power and unplug the power cord. Disconnect all power before doing the following: Installing or removing a router chassis Working near power supplies Do not work alone if potentially hazardous conditions exist. Never assume that power is disconnected from a circuit. Always check. Look carefully for possible hazards in your work area, such as moist floors, ungrounded power extension cables, and missing safety grounds. Safety with Electricity 5

6 Required Tools and Equipment February 2002 If an electrical accident occurs, proceed as follows: Use caution; do not become a victim yourself. Turn OFF power to the router. If possible, send another person to get medical aid. Otherwise, determine the condition of the victim and then call for help. Determine if the victim needs rescue breathing or external cardiac compressions; then take appropriate action. Preventing Electrostatic Discharge Damage Electrostatic discharge (ESD) can damage equipment and impair electrical circuitry. ESD can occur when printed circuit cards are improperly handled and can result in complete or intermittent failures. Always follow ESD prevention procedures when removing and replacing cards. Ensure that the router chassis is electrically connected to earth ground. Wear an ESD-preventive wrist strap, ensuring that it makes good skin contact. Connect the clip to an unpainted surface of the chassis frame to safely channel unwanted ESD voltages to ground. To guard against ESD damage and shocks, the wrist strap and cord must be used properly. If no wrist strap is available, ground yourself by touching the metal part of the chassis. Caution For safety, periodically check the resistance value of the ESD-preventive wrist strap, which should be between 1 and 10 megohms (Mohm). Required Tools and Equipment You need the following tools and equipment to install an encryption AIM or NM in a chassis: For encryption network module installation VPN encryption network module Blank network module panel for any unoccupied chassis slot Number 2 Phillips screwdriver or flat-blade screwdriver ESD-preventive wrist strap For encryption AIM installation VPN encryption AIM, supplied with standoffs and two screws Number 2 Phillips screwdriver or flat-blade screwdriver 1/4 inch nut driver Torx-15 screwdriver (for installation in Cisco 3660 only) 3/16-inch open end wrench (optional) ESD-preventive wrist strap 6 Preventing Electrostatic Discharge Damage

7 February 2002 Installing a VPN AIM in Cisco Routers with 1-RU Chassis Installing a VPN AIM in Cisco Routers with 1-RU Chassis The following sections describe VPN AIM installation in a Cisco router chassis of 1 RU (rack unit) height. VPN AIMs plug into internal AIM connectors located on the system board. (See Figure 2.) Figure 2 AIM connector System Board Layout in a 1-RU Chassis Bezel To install a VPN AIM, complete these procedures: 1. Removing the Cover from 1-RU Chassis, page 7 2. Installing the VPN AIM in a 1-RU Chassis, page 9 3. Reinstalling the Chassis Cover on a 1-RU Chassis, page Verifying VPN AIM installation, page Configuring Internet Encryption, page 38 Removing the Cover from 1-RU Chassis This section describes how to open the chassis to access internal components. Warning Do not touch the power supply when the power cord is connected. For systems with a power switch, line voltages are present within the power supply even when the power switch is OFF and the power cord is connected. For systems without a power switch, line Installing a VPN AIM in Cisco Routers with 1-RU Chassis 7

8 Installing a VPN AIM in Cisco Routers with 1-RU Chassis February 2002 voltages are present within the power supply when the power cord is connected. To see translations of the warnings that appear in this publication, refer to the Regulatory Compliance and Safety Information document that accompanied this device. Warning Before opening the chassis, disconnect the telephone-network cables to avoid contact with telephone-network voltages. To see translations of the warnings that appear in this publication, refer to the Regulatory Compliance and Safety Information document that accompanied this device. To remove the cover from a Cisco router with a 1-RU chassis, do the following: Step 1 Step 2 Step 3 Power OFF the router and disconnect the power cord. Disconnect all cables from the rear panel of the router. Remove the screws located on the top of the chassis with the Phillips screwdriver. Note that the chassis has two sections: top and bottom. Step 4 Holding the chassis with both hands, position it as shown in Figure 3. Step 5 Slide the top section away from the bottom section as shown in Figure 4. Figure 3 Holding the 1-RU Chassis for Cover Removal Cisco 2600 SERIES POWER RPS ACTIVITY H11658 Figure 4 Removing the 1-RU Chassis Cover Cisco 2600 SERIES POWER RPS ACTIVITY H Removing the Cover from 1-RU Chassis

9 February 2002 Installing a VPN AIM in Cisco Routers with 1-RU Chassis Installing the VPN AIM in a 1-RU Chassis Perform the following procedure to install a VPN AIM. You need a number 2 Phillips screwdriver or flat-blade screwdriver to complete this procedure. Note Cisco routers with 1-RU chassis have one AIM connector. Step 1 Remove two screws from the system board near the AIM connector as shown in Figure 5. Figure 5 Removing Screws from System Board in 1-RU Chassis System board AIM connector Step 2 Install the two metal standoffs (included with the AIM) in the system board in place of the screws removed in Step 1. (See Figure 6.) Step 3 Insert the plastic standoff (provided with the AIM) into the hole in the system board. (See Figure 6). Note For 1-RU chassis, the plastic standoff snaps into the system board. Be sure to insert the locking end of the standoff into the system board. The locking end is the shortest end of the standoff. Press the standoff firmly into the system board to be sure it is locked to the board. Step 4 Insert the connector on the AIM into the AIM connector on the system board. (See Figure 6.) Note Be sure to press firmly on the AIM until the board seats onto the connector. The plastic standoff must snap into the hole in the AIM board. (See Figure 6.) Installing the VPN AIM in a 1-RU Chassis 9

10 Installing a VPN AIM in Cisco Routers with 1-RU Chassis February 2002 Step 5 Insert the screws (provided with the AIM) through the AIM into the metal standoffs. (See Figure 6.) Figure 6 Connecting the VPN AIM to the System Board in 1-RU Chassis AIM Snap-in plastic standoff Metal standoffs Installing the VPN AIM in a 1-RU Chassis

11 February 2002 Installing a VPN AIM in Cisco Routers with 1-RU Chassis Step 6 Check that the AIM is installed correctly on the system board. (See Figure 7.) Figure 7 Installed VPN AIM in a 1-RU Chassis Reinstalling the Chassis Cover on a 1-RU Chassis Perform the following procedure to reinstall a 1-RU chassis cover. You need a number 2 Phillips screwdriver or flat-blade screwdriver to complete this procedure. Step 1 Position the two chassis sections, as shown previously in Figure 4. Step 2 Referring to Figure 4, press the two chassis sections together and ensure the following: The top section fits into the rear of the bottom section. The bottom section fits on the inside of the front of the top section. Each side of the top and bottom sections fits together. Caution Step 3 Step 4 Step 5 Step 6 Step 7 To fit the two sections together, it might be necessary to work them together at one end and then the other, working back and forth; however, use care to prevent bending the chassis edges. When the two sections fit together snugly, slide the chassis top until it fits into the front bezel. Replace the cover screws. Tighten the screws to no more than 8 or 9 inch/pounds of torque. Apply the label (AIM-VPN/BP, for example) that comes with the AIM onto the rear of the chassis. (See Figure 8.) Reinstall the chassis on a rack or desktop. Reconnect the power and network interface cables. Reinstalling the Chassis Cover on a 1-RU Chassis 11

12 Installing a VPN AIM in Cisco Routers with 1-RU Chassis February 2002 Figure 8 VPN AIM Label Location on 1-RU Chassis AIM-VPN/BP Rear of chassis AIM label Step 8 Power ON the router. Observe the following warning if your Cisco router uses DC power: Warning After wiring the DC power supply, remove the tape from the circuit breaker switch handle and reinstate power by moving the handle of the circuit breaker to the ON position. To see translations of the various warnings that appear in this publication, refer to the Regulatory Compliance and Safety Information document that accompanied this device. 12 Reinstalling the Chassis Cover on a 1-RU Chassis

13 February 2002 Installing a VPN AIM in Cisco Routers with 2-RU Chassis Installing a VPN AIM in Cisco Routers with 2-RU Chassis The following sections describe VPN AIM installation in a Cisco router chassis of 2 RU (rack unit) height. VPN AIMs plug into internal AIM connectors located on the system board. (See Figure 9.) You can install VPN AIMs in either AIM connector or in both AIM connectors. Figure 9 System Board Layout, 2-RU Chassis (Cisco 3725) Bezel AIM slot 1 connector AIM slot 0 connector To install a VPN AIM, complete these procedures: 1. Removing Cover from 2-RU Chassis, page Installing the VPN AIM in a 2-RU Chassis, page Installing the VPN AIM in a 2-RU Chassis, page Verifying VPN AIM installation, page Configuring Internet Encryption, page 38 Installing a VPN AIM in Cisco Routers with 2-RU Chassis 13

14 Installing a VPN AIM in Cisco Routers with 2-RU Chassis February 2002 Removing Cover from 2-RU Chassis Perform the following procedure to remove the cover from a Cisco router with a 2-RU chassis. You need a number 2 Phillips screwdriver or flat-blade screwdriver to complete this procedure. Observe the following precaution if your router uses AC or DC power: Warning Do not touch the power supply when the power cord is connected. For systems with a power switch, line voltages are present within the power supply even when the power switch is OFF and the power cord is connected. For systems without a power switch, line voltages are present within the power supply when the power cord is connected. To see translations of the various warnings that appear in this publication, refer to the Regulatory Compliance and Safety Information document that accompanied this device. Observe the following warning if your router uses DC power: Warning Before performing any of the following procedures, ensure that power is removed from the DC circuit. To ensure that all power is OFF, locate the circuit breaker on the panel board that services the DC circuit, switch the circuit breaker to the OFF position, and tape the switch handle of the circuit breaker in the OFF position. To see translations of the various warnings that appear in this publication, refer to the Regulatory Compliance and Safety Information document that accompanied this device. Step 1 Power OFF the router and disconnect the power cord. Warning Before opening the chassis, disconnect the telephone-network cables to avoid contact with telephone-network voltages. To see translations of the various warnings that appear in this publication, refer to the Regulatory Compliance and Safety Information document that accompanied this device. Step 2 Step 3 Step 4 Disconnect all network interface cables from the rear panel of the router. Place the router on a flat surface. Remove the screws from the top of the cover (typically five or six screws, depending on the router model). Set the screws aside in a safe place. If your router is a Cisco 3725 and has a blank cover plate in the upper right network-module slot, loosen the captive screw at the left edge of the blank cover. This screw is identified by the following stamped lettering: LOOSEN SCREW TO REMOVE COVER. Step 5 Lift the cover up to a 45-degree angle. (See Figure 10.) Step 6 Slide the cover to the side (away from the side with the fans) until the tabs are free from the slots. (See Figure 10.) 14 Removing Cover from 2-RU Chassis

15 February 2002 Installing a VPN AIM in Cisco Routers with 2-RU Chassis Figure 10 Removing the Cover from a Cisco Router with a 2-RU Chassis Lift cover 2 Slide cover Installing the VPN AIM in a 2-RU Chassis Perform the following procedure to install a VPN AIM. You need a number 2 Phillips screwdriver or flat-blade screwdriver and a 1/4-inch nut driver to complete this procedure. Note Cisco routers with 2-RU chassis have two AIM connectors AIM slot 0 and AIM slot 1. You can install a VPN encryption AIM in either slot, but not in both slots. Step 1 Remove the three screws from the system board near the AIM connector you are going to use. (See Figure 11 for the locations of the screws.) Installing the VPN AIM in a 2-RU Chassis 15

16 Installing a VPN AIM in Cisco Routers with 2-RU Chassis February 2002 Figure 11 Removing Screws from System Board in 2-RU Chassis (Slot 1 Shown) A A B A B A AIM slot 1 connector System board AIM slot 0 connector Step 2 Install the two metal standoffs (included with the VPN AIM) in the system board in place of two of the screws removed in Step 1. Use a 1/4-inch nut driver to tighten the standoffs. (See Figure 12.) Caution Step 3 Make sure that the standoffs are installed straight. Tighten them gently but firmly. Install the plastic standoff (provided with the VPN AIM) in place of the third screw that you removed. Tighten it firmly with fingers, or very carefully using a 3/16-inch open end wrench. (See Figure 12.) Note Step 4 Step 5 For 2-RU chassis, the plastic standoff has a threaded end for insertion into the system board. Plug the VPN AIM into the AIM connector on the system board. (See Figure 12.) Make sure that the plastic standoff fits into the hole in the AIM board, and the connector is fully seated. Insert the screws (provided with the VPN AIM) through the AIM into the metal standoffs. (See Figure 12.) 16 Installing the VPN AIM in a 2-RU Chassis

17 February 2002 Installing a VPN AIM in Cisco Routers with 2-RU Chassis Figure 12 Connecting a VPN AIM in AIM Slot 1 in a 2-RU Chassis AIM Threaded plastic standoff Metal standoffs AIM slot 1 connector AIM slot 0 connector Installing the VPN AIM in a 2-RU Chassis 17

18 Installing a VPN AIM in Cisco Routers with 2-RU Chassis February 2002 Step 6 Check that the VPN AIM is installed correctly on the system board. (See Figure 13.) Figure 13 Installed VPN AIM in a 2-RU Chassis (Aim Slot 1 Shown) Reinstalling the Chassis Cover on a 2-RU Chassis Caution Before reinstalling the cover on the router, make sure that all cables are secured, and are not in danger of being pinched or cut. Perform the following procedure to reinstall the router cover. You need a number 2 Phillips screwdriver or flat-blade screwdriver to complete this procedure. Step 1 Step 2 Step 3 Place the chassis on a flat surface. Hold the cover at a 45-degree angle, and insert the tabs into the slots along the front (bezel) edge of the chassis. (See Figure 14.) Center the cover over the chassis and lower it onto the chassis. 18 Reinstalling the Chassis Cover on a 2-RU Chassis

19 February 2002 Installing a VPN AIM in Cisco Routers with 2-RU Chassis Figure 14 Replacing the Cover on a 2-RU Chassis Insert tabs and slide cover 2 Close cover Step 4 Step 5 Step 6 Reinstall the cover screws (typically five or six, depending on the router model). If your router is a Cisco 3725 and has a blank cover plate in the upper right network-module slot, reinstall the captive screw at the left edge of the blank cover. This screw is identified by the following stamped lettering: LOOSEN SCREW TO REMOVE COVER. Apply the label (AIM-VPN/EP, for example) that comes with the VPN AIM onto any suitable area on the rear of the chassis, or on the top cover near the front edge if no suitable area is available on the rear. Do not apply the label over any holes, screws, or existing labels. Note Step 7 Step 8 Do not apply the AIM-VPN label to a blank cover plate or to any removable network module or interface card. Reinstall the chassis on a rack or desktop. Reconnect the power and network interface cables. Reinstalling the Chassis Cover on a 2-RU Chassis 19

20 Installing an Encryption Network Module in a Cisco 3620 or Cisco 3640 Chassis Slot February 2002 Step 9 Power ON the router. Observe the following warning if your Cisco router uses DC power: Warning After wiring the DC power supply, remove the tape from the circuit breaker switch handle and reinstate power by moving the handle of the circuit breaker to the ON position. To see translations of the various warnings that appear in this publication, refer to the Regulatory Compliance and Safety Information document that accompanied this device. Installing an Encryption Network Module in a Cisco 3620 or Cisco 3640 Chassis Slot Follow this procedure to install an encryption network module: Step 1 Turn OFF electrical power to the router and unplug the power cable. Remove all network interface cables, including telephone cables, from the rear panel. Caution Cisco 3620 and Cisco 3640 routers do not support online insertion and removal of network modules or other system components. To avoid damaging the module, before you insert a network module into a chassis slot, you must turn OFF electrical power and disconnect network cables. Before installing an encryption network module in routers that use a DC power supply, be aware of the following: Warning Step 2 Before performing any of the following procedures, ensure that power is removed from the DC circuit. To ensure that all power is OFF, locate the circuit breaker on the panel board that services the DC circuit, switch the circuit breaker to the OFF position, and tape the switch handle of the circuit breaker in the OFF position. To see translations of the warnings that appear in this publication, refer to the Regulatory Compliance and Safety Information document that accompanied this device. Using either a number 2 Phillips screwdriver or a flat-blade screwdriver, remove the blank filler panel from the chassis slot where you plan to install the module. Save the blank panel for future use. Note The encryption network module can be installed in any available slot in the router chassis. However, the router supports only one installed encryption network module. 20 Installing an Encryption Network Module in a Cisco 3620 or Cisco 3640 Chassis Slot

21 February 2002 Installing an Encryption Network Module in a Cisco 3620 or Cisco 3640 Chassis Slot Step 3 Holding the network module by the handle, align it with the guides in the chassis and slide it gently into the slot. (see Figure 15). Figure 15 Installing an Encryption Network Module in a Router Step 4 Step 5 Step 6 Push the module into place until you feel its edge connector mate securely with the connector on the backplane. Fasten the module s captive mounting screws into the holes in the chassis, using the Phillips or flat-blade screwdriver. These screws prevent accidental removal, provide proper grounding for the system, and ensure that the network module connectors are securely seated in the backplane. Connect the power and network interface cables and turn ON power to the router. The following warning applies to routers that use a DC power supply: Warning Step 7 After wiring the DC power supply, remove the tape from the circuit breaker switch handle and reinstate power by moving the handle of the circuit breaker to the ON position. To see translations of the warnings that appear in this publication, refer to the Regulatory Compliance and Safety Information document that accompanied this device. If the router is not fully configured with network modules, make sure that blank panels fill the unoccupied chassis slots to provide proper airflow. (See Figure 16.) Figure 16 Blank Network Module Panel When you have finished installing the network module, complete the procedure described in the Configuring Internet Encryption section on page 38. Installing an Encryption Network Module in a Cisco 3620 or Cisco 3640 Chassis Slot 21

22 Installing a VPN AIM in a Cisco 3660 Router February 2002 Encryption Network Module Enable LED All network modules have an enable LED. This LED indicates that the module has passed its self-tests and is available to the router. (See Figure 17.) Figure 17 Encryption Network Module LED Installing a VPN AIM in a Cisco 3660 Router The VPN AIM does not require an external network connection; it attaches directly to an internal AIM connector on the Cisco 3660 system board. (See Figure 18.) Figure 18 Cisco 3660 System Board Layout AIM slot Front of system board tray AIM slot 1 22 Encryption Network Module Enable LED

23 February 2002 Installing a VPN AIM in a Cisco 3660 Router To install a VPN AIM in a Cisco 3660 router, complete the following procedures: 1. Removing the System Board Tray, page Installing the VPN AIM in a Cisco 3660, page Replacing the System Board Tray, page Verifying VPN AIM installation, page Configuring Internet Encryption, page 38 The sections that follow describe these procedures. Removing the System Board Tray This section describes the procedure for removing the Cisco 3660 system board tray. You must remove the system board tray to access the internal components. Warning Before removing the system board tray, disconnect the telephone-network cables to avoid contact with telephone-network voltages. To see translations of the warnings that appear in this publication, refer to the Regulatory Compliance and Safety Information document that accompanied this device. Warning Do not touch the power supply when the power cord is connected. For systems with a power switch, line voltages are present within the power supply even when the power switch is OFF and the power cord is connected. For systems without a power switch, line voltages are present within the power supply when the power cord is connected. To see translations of the warnings that appear in this publication, refer to the Regulatory Compliance and Safety Information document that accompanied this device. To remove the system board tray, do the following: Step 1 Step 2 Step 3 Power OFF the router and disconnect the power cable. Disconnect all cables from the system board panel. Loosen the two captive mounting screws on the front of the system board tray. (See part 1 of Figure 19.) Step 4 Rotate the tray levers to their open position. (See part 2 of Figure 19.) Step 5 Pull the tray levers to slide the system board tray out of the chassis. (See part 3 of Figure 19). Removing the System Board Tray 23

24 VCC OK SYSTEM VOICE 2V SERIAL 4T V1 CN/LP RXC FDX LINK 100Mbps FDX LINK 100Mbps SERIAL 3 SERIAL 2 SERIAL 1 SERIAL 0 RXD TXC TXD CN/LP RXC RXD TXC TXD CN/LP RXC RXD TXC TXD CN/LP RXC RXD TXC TXD VIC FXS 1 0 V0 EN ETHERNET 1 0 LINK ACT HS Installing a VPN AIM in a Cisco 3660 Router February 2002 Figure 19 Removing the System Board Tray 1 HIGH SPEED SERIAL 1HSSI LB/CN RC RD 4E TC TD IN USE IN USE SEE MANUAL BEFORE INSTALLATION EN ETH 3 ETH 2 ETH ETH Tray levers Loosen screws 2 Rotate levers out 3 Slide system board tray out Installing the VPN AIM in a Cisco 3660 Perform the following procedure to install a VPN AIM. You need a number 2 Phillips screwdriver or flat-blade screwdriver, and a 1/4-inch nut driver, to complete this procedure. Note Cisco 3745 routers have two AIM connectors AIM slot 0 and AIM slot 1. You can install a VPN encryption AIM in either slot, but not in both slots. 24 Installing the VPN AIM in a Cisco 3660

25 February 2002 Installing a VPN AIM in a Cisco 3660 Router Step 1 Remove two of the metal screws that are holding down the system board. (See Figure 20 for the location of the screws.) Figure 20 Removing Two of the System Board Screws A B A AIM slot 1 connector AIM slot 0 connector Step 2 Step 3 Step 4 Step 5 Install the two metal standoffs (provided with the VPN AIM) by inserting the threaded end into the system board. Hand tighten with the 1/4 inch nut driver. (See Figure 21.) Install the threaded plastic standoff (provided with the VPN AIM) into the system board. Tighten it firmly with fingers, or very carefully using a 3/16-inch open end wrench. (See Figure 21.) Plug the VPN AIM into the AIM connector on the system board. (See Figure 21.) Make sure that the plastic standoff fits into the hole in the AIM board, and the connector is fully seated. Insert the screws (provided with the VPN AIM) through the AIM into the metal standoffs. (See Figure 21.) Installing the VPN AIM in a Cisco

26 Installing a VPN AIM in a Cisco 3660 Router February 2002 Figure 21 Connect the VPN AIM to the System Board AIM Metal standoffs AIM connector Plastic standoff System board Step 6 Check that the VPN AIM is installed correctly on the system board. (See Figure 22.) 26 Installing the VPN AIM in a Cisco 3660

27 February 2002 Installing a VPN AIM in a Cisco 3660 Router Figure 22 Installed VPN AIM Replacing the System Board Tray To replace the system board tray in the chassis, do the following: Step 1 Step 2 Step 3 Step 4 Align the system board tray with the guides in the chassis and slide it gently into the slot. (See part 1 of Figure 23.) Push the system board tray into place until you feel its edge connector mate securely with the connector on the backplane. (See part 2 of Figure 23.) Rotate the tray levers into their closed position so that the system board tray is secure. (See part 3 of Figure 23.) Fasten the system board tray s captive mounting screw into the hole on the chassis, using a Phillips screwdriver. (See part 4 of Figure 23.) Replacing the System Board Tray 27

28 Installing a VPN AIM in a Cisco 3660 Router February 2002 Figure 23 Replacing the System Board Tray Align system board tray with guides 2 Insert system board tray 3 Rotate tray levers closed 4 Install captive screws Step 5 Step 6 Step 7 Apply the AIM-VPN/HP label that comes with the VPN AIM onto the faceplate of the system board tray. (See Figure 24.) Reinstall the chassis on the rack, desktop, or table. Reconnect all cables. 28 Replacing the System Board Tray

29 February 2002 Installing a VPN AIM in a Cisco 3745 Chassis Figure 24 VPN AIM Label Location AIM-VPN/HP Front of system board tray AIM label Installing a VPN AIM in a Cisco 3745 Chassis This section contains procedures for installing and removing an encryption AIM in a Cisco 3745 router. The AIM connectors are on the CPU/mainboard, which you can unplug and remove from the router chassis. AIM connectors are located as shown in Figure 25. Figure 25 CPU/Mainboard Board Layout in a Cisco AIM slot 0 connector AIM slot 1 connector Front of CPU/mainboard To install a VPN AIM in a Cisco 3745 router, complete the following procedures: 1. Removing the Plug-in CPU/Mainboard from Cisco 3745, page Installing the VPN AIM in a Cisco 3745, page Reinstalling the Plug-in CPU/Mainboard, page Verifying VPN AIM installation, page Configuring Internet Encryption, page 38 The sections that follow describe these procedures. Installing a VPN AIM in a Cisco 3745 Chassis 29

30 Installing a VPN AIM in a Cisco 3745 Chassis February 2002 Removing the Plug-in CPU/Mainboard from Cisco 3745 Perform the following procedure to access a VPN AIM mounted on a CPU/mainboard in a Cisco 3745 router. You need a number 2 Phillips or flat-blade screwdriver to perform this procedure. Observe the following warning if your router uses AC power: Warning Do not touch the power supply when the power cord is connected. For systems with a power switch, line voltages are present within the power supply even when the power switch is OFF and the power cord is connected. For systems without a power switch, line voltages are present within the power supply when the power cord is connected. To see translations of the various warnings that appear in this publication, refer to the Regulatory Compliance and Safety Information document that accompanied this device. Observe the following warning if your router uses DC power: Warning Before performing any of the following procedures, ensure that power is removed from the DC circuit. To ensure that all power is OFF, locate the circuit breaker on the panel board that services the DC circuit, switch the circuit breaker to the OFF position, and tape the switch handle of the circuit breaker in the OFF position. To see translations of the various warnings that appear in this publication, refer to the Regulatory Compliance and Safety Information document that accompanied this device. Step 1 Power OFF the router. However, to channel ESD voltages to ground, do not unplug the power cable. Caution The Cisco 3745 can have more than one power supply. Be sure that all power supplies are powered OFF, and that all the LEDs are dark. Step 2 Place the router on a flat surface so that the front panel is facing you, and open the small access door at the right-hand edge of the front panel. Step 3 Loosen the two captive screws located behind the access door. (See Figure 26.) Step 4 Open the front panel to the straight-out position, and lift it off its hinges. (See Figure 26.) Step 5 Loosen the captive retention screws; there is one at each side of the CPU/mainboard. (See Figure 27.) Step 6 Step 7 Pull the ejector levers at both sides, and carefully pull the CPU/mainboard straight out of the chassis. Place it on an antistatic surface. (See Figure 27.) When you are ready to reinstall the CPU/mainboard, refer to the Reinstalling the Plug-in CPU/Mainboard section on page Removing the Plug-in CPU/Mainboard from Cisco 3745

31 February 2002 Installing a VPN AIM in a Cisco 3745 Chassis Figure 26 Removing the Front Panel from a Cisco 3745 Router Hinges 1 2 Access door Fan tray 1 Open the front panel 2 Lift and remove the front panel Removing the Plug-in CPU/Mainboard from Cisco

32 Installing a VPN AIM in a Cisco 3745 Chassis February 2002 Figure 27 Removing the CPU/Mainboard from a Cisco 3745 Router Captive retention screw Captive retention screw Ejector levers Installing the VPN AIM in a Cisco 3745 Perform the following procedure to install a VPN AIM. You need a number 2 Phillips screwdriver or flat-blade screwdriver, and a 1/4-inch nut driver, to complete this procedure. Note Cisco 3745 routers have two AIM connectors AIM slot 0 and AIM slot 1. You can install a VPN encryption AIM in either slot, but not in both slots. 32 Installing the VPN AIM in a Cisco 3745

33 February 2002 Installing a VPN AIM in a Cisco 3745 Chassis Step 1 Remove the three screws from the CPU/mainboard near the AIM connector you are going to use. (See Figure 28 for the locations of the screws.) Figure 28 Removing Screws from the CPU/Mainboard (AIM Slot 1 Installation Shown) A A B A B A AIM slot 1 connector System board AIM slot 0 connector Step 2 Install the two metal standoffs (provided with the VPN AIM) by inserting the threaded end into the CPU/mainboard. Use a 1/4 inch nut driver to tighten the standoffs. (See Figure 29.) Caution Step 3 Step 4 Step 5 Make sure that the standoffs are installed straight. Tighten them gently but firmly. Install the plastic standoff (provided with the VPN AIM) in place of the third screw that you removed. Tighten it firmly with fingers, or very carefully using a 3/16-inch open end wrench. (See Figure 21.) Plug the VPN AIM into the AIM connector on the CPU/mainboard. (See Figure 29.) Make sure that the plastic standoff fits into the hole in the AIM board, and the connector is fully seated. Insert the screws (provided with the VPN AIM) through the AIM into the metal standoffs. (See Figure 29.) Installing the VPN AIM in a Cisco

34 Installing a VPN AIM in a Cisco 3745 Chassis February 2002 Figure 29 Connect a VPN AIM to the CPU/Mainboard (AIM Slot 1 Shown) AIM Threaded plastic standoff Metal standoffs AIM slot 1 connector AIM slot 0 connector Step 6 Check that the VPN AIM is installed correctly on the CPU/mainboard. (See Figure 30.) 34 Installing the VPN AIM in a Cisco 3745

35 February 2002 Installing a VPN AIM in a Cisco 3745 Chassis Figure 30 VPN AIM Installed in AIM Slot Installing the VPN AIM in a Cisco

36 Installing a VPN AIM in a Cisco 3745 Chassis February 2002 Reinstalling the Plug-in CPU/Mainboard Perform the following procedure to reinstall a plug-in CPU/mainboard. You need a number 2 Phillips screwdriver or flat-blade screwdriver to perform this procedure: Step 1 Step 2 Step 3 Place the chassis so that the empty CPU/mainboard slot faces you. Make sure that the ejector levers are fully open. Carefully insert the CPU/mainboard into the chassis slot until the connector is engaged, then close the ejector levers to fully seat the CPU/mainboard connector. (See Figure 31.) Tighten the two captive retention screws; there is one at each edge of the CPU/mainboard. Figure 31 Inserting Plug-in CPU/Mainboard into a Cisco 3745 Chassis Captive retention screw Captive retention screw Ejector levers Step 4 Step 5 Step 6 Hold the front panel straight out from the chassis, engage the hinges, and close the front panel. (See Figure 32.) Tighten the two captive screws behind the small access door at the right-hand edge. Power ON the router. Observe the following warning if your router uses DC power: Warning After wiring the DC power supply, remove the tape from the circuit breaker switch handle and reinstate power by moving the handle of the circuit breaker to the ON position. To see translations of the various warnings that appear in this publication, refer to the Regulatory Compliance and Safety Information document that accompanied this device. 36 Reinstalling the Plug-in CPU/Mainboard

37 February 2002 Installing a VPN AIM in a Cisco 3745 Chassis Figure 32 Installing the Front Panel on a Cisco 3745 Router Hinges 2 1 Access door Front panel 1 Engage hinges and lower the front panel 2 Close the front panel Step 7 Apply the label (AIM-VPN/HP, for example) that comes with the VPN AIM onto the top of the chassis near the front edge. Do not apply the label over any existing labels. Reinstalling the Plug-in CPU/Mainboard 37

38 Verifying VPN AIM installation February 2002 Verifying VPN AIM installation Use the show version command to verify that the VPN module has been installed correctly. Router# show version Cisco Internetwork Operating System Software IOS (tm) C2600 Software (C2600-JK8O3S-M), Version 12.2(1)T Copyright (c) by cisco Systems, Inc. Compiled Fri 06-Apr-01 21:56 Image text-base: 0x , data-base: 0x81654AD0 ROM: System Bootstrap, Version 12.1(3r)T1, RELEASE SOFTWARE (fc1) ROM: C2600 Software (C2600-JK8O3S-M), Version 12.2(0.18)T Router uptime is 2 weeks, 6 days, 19 hours, 35 minutes System returned to ROM by power-on System image file is "flash:c2600-jk8o3s-mz t" cisco 2651 (MPC860P) processor (revision 0x00) with 60416K/5120K bytes of memor. Processor board ID JAB043003AV ( ) M860P processor: part number 5, mask 1 Bridging software. X.25 software, Version SuperLAT software (copyright 1990 by Meridian Technology Corp). TN3270 Emulation software. 2 FastEthernet/IEEE interface(s) 4 Serial(sync/async) network interface(s) 1 Virtual Private Network (VPN) Module(s) 32K bytes of non-volatile configuration memory K bytes of processor board System flash (Read/Write) Configuration register is 0x2102 Configuring Internet Encryption There are no configuration commands specific to the encryption hardware. Both software-based and hardware-based encryption are configured in the same way. The system automatically detects the presence of an encryption module at bootup and uses it to encrypt data; if no encryption hardware is detected, software is used to encrypt data. To disable the VPN encryption module, and revert to software encryption, enter the no crypto engine accel command. To re-enable the VPN encryption module, enter the crypto engine accel command. Whenever you install a new interface, or if you want to change the configuration of an existing interface, you must configure the interface. If you replace a module that was already configured, the router recognizes it and brings up the interface in the existing configuration. Before you configure an interface, have the following information available: Protocols you plan to route on the new interface IP addresses, subnet masks, network numbers, zones, or other information related to the routing protocol Static address mappings (address lists) Location and type of interface through which encrypted data will enter and exit the router 38 Verifying VPN AIM installation

39 February 2002 Configuring Internet Encryption Timesaver Obtain this information from your system administrator or network plan before you begin router configuration. This section describes basic encryption configuration including: Configuring Internet Key Exchange Security Protocol, page 39 Configuring IPSec Network Security, page 40 Configuring the T1 Channel Group, page 41 Configuring Encryption on the T1 Channel Group Serial Interface, page 41 Checking the Configuration, page 42 For more information about configuring IPSec, see the IP Security and Encryption section of the Cisco IOS Security Configuration Guide, Release 12.1 or the Cisco IOS Security Configuration Guide, Release Note Depending on your own requirements and the protocols you plan to route, you might also need to enter other configuration commands. Configuring Internet Key Exchange Security Protocol To configure the Internet Key Exchange Security Protocol, complete this procedure: Command Purpose Step 1 Router(config)# crypto isakmp policy priority Create an Internet Key Exchange (IKE) policy with a unique priority number. You can configure multiple policies on each peer, but at least one of these policies must contain exactly the same encryption, authentication, and other parameters as one of the policies on the remote peer. Step 2 Router(config-isakmp)# authentication rsa-sig/rsa-encr/pre-share Note This command enters the ISAKMP policy configuration mode. Specify the authentication method to be used in an IKE policy. Note The VPN encryption products described in this document do not currently support RSA authentication. Step 3 Router(config-isakmp)# exit Exit the ISAKMP policy configuration mode and return to global configuration mode. Step 4 Router(config)# crypto isakmp key keystring address peer-address/peer-hostname Configure the authentication key that will be shared by each peer. Note This must be configured at both peers that will share a key. Configuring Internet Key Exchange Security Protocol 39

40 Configuring Internet Encryption February 2002 Configuring IPSec Network Security To configure IPSec network security, complete this procedure: Step 1 Step 2 Command Router(config)# crypto ipsec security-association lifetime seconds seconds/ kilobytes kilobytes Router(config)# crypto ipsec transform-set transform-set-name transform1 [transform2 [transform3]] Purpose Specify the time a security association will live before expiring. The default lifetimes are 3600 seconds (1 hour) and 4,608,000 kilobytes (10 megabytes per second for one hour). A transform set represents a specific combination of security protocols and algorithms. During the IPSec security association negotiation, the peers search for a transform set that is the same at both peers. When such a transform set is found, it is selected and applied to the protected traffic as part of both peers IPSec security associations. Note This command enters the transform-set configuration mode. Step 3 Router(cfg-crypto-trans)# exit Exit the transform-set configuration mode and return to global configuration mode. Step 4 Step 5 Step 6 Step 7 Router(config)# crypto map map-name seq-num ipsec-isakmp [dynamic dynamic-map-name] [discover] Router(config-crypto map)# set peer hostname/ip-address Router(config-crypto map)# set transform-set transform-set-name Router(config-crypto map)# match address [access-list-id name] Create a crypto map. Note This command enters the crypto map configuration mode, unless you enter the dynamic keyword. Specify a remote IPSec peer. Note This should be the same peer specified in Step 4 in the previous procedure. Specify the transform set allowed for this crypto map entry. Note This should be the same transform set specified in Step 2 of this procedure. Specify an extended access list for a crypto map entry. Step 8 Router(cfg-crypto-map)# exit Exit the crypto map configuration mode and return to global configuration mode. Step 9 Router(config)# access-list access-list-number {permit deny} {type-code wild-mask address mask} Create an access list. 40 Configuring IPSec Network Security