Cisco Systems SM-ISM manual

Cor porat e Headqu ar ters Cisco Syst ems, I nc. 170 West Tasm an Drive San Jose, CA 9513 4-1706 USA http ://www .cisco .com Tel: 40 8 526-4000 800 55 3-NETS (6387) Fax: 40 8 526-4100 In tegr ate d Se rvice s Ad apte r an d Inte grated Se r vic es Mo dul e In stalla t ion an d C onf igu rat ion P roduct Number s: SA-I SA(=) and SM-ISM(=) Platform s[...]

THE SPE CIFI CAT IONS AND I NFO RMATI ON R EGARD ING T HE P RODUC TS I N TH IS MA NU AL ARE SUBJ ECT TO CHA NG E WIT HOUT NOTI CE. ALL STA TEM EN TS , INFO R MATI ON, AN D RE C OMME NDAT IO NS IN TH IS MA NU AL ARE BELI EV ED TO BE ACCU RAT E B U T ARE PRE SEN TED W ITH O UT WA RRANT Y OF ANY KIND, EX PRES S OR IMPL IED. USER S MUS T TAK E F ULL RE[...]

i Integrat ed Ser vices A dapter and Inte grated Services Module I nstal lation an d C onfiguratio n OL-3575-01 B0 CONT ENTS Preface iii Objec tives iii Audien ce iv Installa tion W arning iv Docu ment Organiza tion v Docu ment Conven tions v Term s and Acrony m s vii Relate d Do cument ation vi ii Obta ining D ocum entation x Cisc o.com x Docu me [...]

(DRA FT L ABE L) AL PHA DRAF T - C ISC O C ONFID ENTI AL Cont ents ii Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Interop erabi lity Be tween IS A/ISM and VAM 2- 2 Safet y Gu idelines 2-3 Safety Wa rnings 2-3 El ec tr ic al Eq uip m ent Gui del ines 2-5 Preven ting E lectro stati[...]

iii Integrat ed Ser vices A dapter and Inte grated Services Module I nstal lation an d C onfiguratio n OL-3575-01 B0 Preface This p refa ce des crib es t he o bj ect ives an d organ iza tio n o f th is d o cu men t and ex pl ai ns how to fi nd add itio nal i nfo rmati on on r elate d pr oduct s and s ervi ces. This pr e fa ce cont ains the fol lo w[...]

iv Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Pref ace Audi ence Not e T o ens ure c omplia nce wit h U.S. e xport laws an d regul ati ons , and to pr ev ent pr oble ms late r on, s ee the “Co mpli anc e with U.S. Expo rt La ws and Re gula tions Reg ardin g Enc rypti on ” se[...]

v Integrat ed Ser vices A dapter and Inte grated Services Module I nstal lation an d C onfiguratio n OL-3575-01 B0 Pref ace Document Organi zation Document Organ ization This d o cu men t cont ain s t he f ol lowin g ch ap ter s : Document Conventi ons Com mand de scr ipti ons us e th e foll o wing con ven ti ons: Screen ex am p le s u se t he f ol[...]

vi Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Pref ace Docu ment Co nven t ions Not es, cauti on ar y sta tem en ts, and sa fety w ar ni ng s u s e th ese convention s : Not e Mean s r ead er tak e not e . Not es con tai n help ful sugges ti ons or ref eren ces to mate ria ls no[...]

vii Integrat ed Ser vices A dapter and Inte grated Services Module I nstal lation an d C onfiguratio n OL-3575-01 B0 Pref ace Ter ms and Acrony ms Terms a nd Acronyms T o ful ly under stand t he cont ent o f this user guid e, yo u sho uld be fam ili ar wit h the f ol lo win g terms and acro ny m s: • DCE—da ta c ommuni catio ns eq uipme nt • [...]

vi ii Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Pref ace Rel ated D ocu ment ati on • DT E—d ata t er min al equi pmen t • EPR OM—erasa ble prog ram mable rea d-onl y m emory • EEPROM—e le ctric ally er as ab l e p rog ra mm a bl e r ea d- o nly m emo r y • GB—g[...]

ix Integrat ed Ser vices A dapter and Inte grated Services Module I nstal lation an d C onfiguratio n OL-3575-01 B0 Pref ace Re late d Do cumen tati on • F or con f igura tio n infor m ation and s upport , r efer to t he modul ar co nf igur ati on and m odul ar comm and refe rence publ ica tion s i n t he C isco IOS so ft ware conf igurat ion do [...]

x Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Pref ace Ob ta in i n g D o cu me nt at io n – Ci sc o I O S R el ea se 1 2. 0 Se cu r ity C on fig ur at io n G ui de – Cis co IOS Rele ase 12.0 Secur it y Comman d Ref er enc e – Cis co IOS Qual ity of Ser vice Solut io ns Con[...]

xi Integrat ed Ser vices A dapter and Inte grated Services Module I nstal lation an d C onfiguratio n OL-3575-01 B0 Pref ace Obt ain ing Do cu ment ati on I ntern ati onal Cisc o web si tes can be acc essed fr om this URL : http ://w ww .c isco .com /pub lic/ countr ies_l anguag es. shtml Docu men t at i on CD- ROM Cis co docum en tatio n and addi [...]

xi i Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Pref ace Obt aining Tech nical Assista nce Obtai ning T echnical Assist ance Cis co p rovi des Cis co .co m, w hi ch in cl ud es th e C isc o T ec hnic al As sista nce C ente r (T AC) W e bs i te, as a sta rting poin t for all tech[...]

xiii Integrat ed Ser vices A dapter and Inte grated Services Module I nstal lation an d C onfiguratio n OL-3575-01 B0 Pref ace Obtaini ng A ddi tiona l Publicati ons and Inf or mation All cu s to m er s , pa rt ne rs, an d re se l le r s w h o ha ve a vali d Ci sc o s er v ice c o n tr a ct have c o m p let e a c ce ss to the tec hnical supp ort re[...]

xi v Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Pref ace Obta in in g Addi tio n al Pu b lic a tio ns and Info rm a tio n • I nterne t P r otocol Jo urna l is a qu arte rly jo urn al pub lishe d b y Cisc o Syst ems fo r engi neer ing pr of essi onal s in vol v ed in the des ig[...]

C HAP TER 1-1 Inte gra ted Services Adap ter and Integrat ed Service s Module In stal l ation and Conf ig uration OL-3575-01 B0 1 Overview Thi s chap ter de sc ribe s the ISA and t he IS M and co ntai ns th e fol low in g sect ions : • I SA and ISM Over vie w , pa ge 1-1 • Da ta En cry ptio n Ove rvi e w , pa ge 1-2 • Fea tures , page 1-3 •[...]

1- 2 Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Cha pter 1 O ver vie w Data En cr ypti on Overv iew Not e The Cisc o 710 0 series VP N rou ters do not supp ort ISM an d ISA i n the sa me c hassis. The C isco 71 00 se ries ro uter s do no t sup port on li ne inse rti on and re mo[...]

1-3 Inte gra ted Services Adap ter and Integrat ed Service s Module In stal l ation and Conf ig uration OL-3575-01 B0 Chapt er 1 Overvi ew Features • CA—I n addi tion, Cert i fic ate Author ity (C A) in tero pera bili ty is prov ided in sup port of the IPSe c st an dard, usi ng Certi fi cat e Enroll men t P ro to co l (CEP) . CEP perm i ts C is[...]

1- 4 Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Cha pter 1 O ver vie w Port Ada pter Sl ot Loca tio ns on the S uppor ted Pl at for m s Po rt A dapter Slot Locatio ns on t he Su ppor ted Pl atfor ms Thi s sec tion disc usse s por t ada pter slot loca tio ns on t he suppo rt ed p[...]

1-5 Inte gra ted Services Adap ter and Integrat ed Service s Module In stal l ation and Conf ig uration OL-3575-01 B0 Chapt er 1 Overvi ew Port A dap ter Slot Locat ions on the Support ed P latfo r ms Not e The C is c o 71 0 0 se ries V PN ro u ters d o not s upp or t an I SM an d an I SA in th e same ch as si s . Figur e 1-1 Servi ce Module Slot 5[...]

1- 6 Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Cha pter 1 O ver vie w LE D s Figur e 1 -3 P ort Adapt e r Slot s in the Cisco 7206 LEDs Th e I SA h as t hre e LE Ds , as s how n in Fi gure 1- 4 . Ta b l e 1 - 2 lis ts t he co lor s an d fu n cti o ns o f th e IS A LEDs. Not e T[...]

1-7 Inte gra ted Services Adap ter and Integrat ed Service s Module In stal l ation and Conf ig uration OL-3575-01 B0 Chapt er 1 Overvi ew LEDs Figur e 1 -4 ISA Fr ont P anel LEDs ( SA - ISA sho wn) The foll owi ng cond it ions m ust al l be m et befor e the enabl ed LED go es on: • The I SA i s co rre ctl y co nn ect ed t o t he b ack p lane and[...]

1- 8 Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Cha pter 1 O ver vie w LE D s The foll owi ng cond it ions m ust al l be m et befor e the enabl ed LED go es on: • The I SM is co rrec tl y con n ect ed to t he b ack p lan e an d r ec eivi ng p ower . • The sy s te m bu s r ec[...]

C HAP TER 2-1 Inte gra ted Services Adap ter and Integrat ed Service s Module In stal l ation and Conf ig uration OL-3575-01 B0 2 Preparing for Installation This chapte r desc ribe s the g ener al equ ipme nt, saf ety , and si te prep arati on req uirem ents f or inst allin g the ISA an d t h e IS M . Thi s chap ter c onta ins t he fol lo wing s ec[...]

2- 2 Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Cha p t er 2 Prepa r i ng fo r In s t alla ti on So ftwar e and Har dware Requi remen ts an d Com patibi lity Not e The Cisc o IOS Rel ease 12. 1 M ain line does not supp ort the ISA /ISM . Software Com patibility T o chec k the m [...]

2-3 Inte gra ted Services Adap ter and Integrat ed Service s Module In stal l ation and Conf ig uration OL-3575-01 B0 Cha pter 2 Prepa ring for In stalla tion Safe ty Gu i de l in e s • I f ISA and V AM are i n the c hass is at s yste m boot up, a nd the en cr ypt io n m ppe c omm and is i n th e r outer ’ s ru nn ing conf i gur ati on, then bo[...]

2- 4 Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Cha p t er 2 Prepa r i ng fo r In s t alla ti on Sa fety G uide lines Warn ing This warning s ymbol means danger . Y ou are in a situation that could caus e bodily injury . Before you work on any equipment, be aware of the hazards [...]

2-5 Inte gra ted Services Adap ter and Integrat ed Service s Module In stal l ation and Conf ig uration OL-3575-01 B0 Cha pter 2 Prepa ring for In stalla tion Safe ty Gu i de l in e s . El ect ri c al Equ ipm ent G uide l i nes F ollo w these bas ic guide l ines whe n work in g with a ny el ect ric al eq uipmen t: • Be for e b egi nn in g any p r[...]

2- 6 Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Cha p t er 2 Prepa r i ng fo r In s t alla ti on Co mp lia nce wit h U.S . Ex por t L aws an d R egu lat io ns R ega rdi ng Enc ry ption • Wh en in sta llin g a com p o nent , us e a ny availab le eje ct or l evers o r cap tive i[...]

C HAP TER 3-1 Inte gra ted Services Adap ter and Integrat ed Service s Module In stal l ation and Conf ig uration OL-3575-01 B0 3 Removing and Ins t alling the ISA and the ISM Thi s cha pte r desc ribe s how to remo ve the I SA or I SM from s uppo rted pla tform s an d al so how to inst all a new o r rep lac eme nt I SA or I SM . T his ch ap te r c[...]

3- 2 Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Ch a pt e r 3 R em ov i n g a n d Ins t alli n g th e IS A a nd th e IS M On line Insert ion a nd R emoval Figur e 3-1 Handling the I SM Figur e 3-2 Handling the I SA Onli ne Insert ion and Removal Se v e ral p lat forms su pport o[...]

3-3 Inte gra ted Services Adap ter and Integrat ed Service s Module In stal l ation and Conf ig uration OL-3575-01 B0 Chapt e r 3 Removi ng and Inst all in g the I SA a nd the I SM W arnin gs and Ca utions Eac h mo d ule ha s a bus conn ect or th at co n ne cts it to the rout er . The co n ne cto r has a s et of tier e d pin s in thr ee len gth s t[...]

3- 4 Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Ch a pt e r 3 R em ov i n g a n d Ins t alli n g th e IS A a nd th e IS M ISA or I SM R emov al an d Inst alla tion ISA or I SM Removal and Instal lat ion I n this se ctio n, the i ll ust rati ons t ha t fo llo w g iv e ste p-b y-s[...]

3-5 Inte gra ted Services Adap ter and Integrat ed Service s Module In stal l ation and Conf ig uration OL-3575-01 B0 Chapt e r 3 Removi ng and Inst all in g the I SA a nd the I SM ISA or IS M Re m o v a l a n d Ins t alla t io n Ci sco 7 100 S eries—Removin g an d Insta lling th e ISM 29332 Step 1 To remove the ISM, use a number 2 Phillips screw[...]

3- 6 Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Ch a pt e r 3 R em ov i n g a n d Ins t alli n g th e IS A a nd th e IS M ISA or I SM R emov al an d Inst alla tion Ci sco 7 200 S eries—Removin g an d Insta lling th e ISA Step 1 To remove the service adapter, place the port ada[...]

C HAP TER 4-1 Inte gra ted Services Adap ter and Integrat ed Service s Module In stal l ation and Conf ig uration OL-3575-01 B0 4 Configuring the ISA and ISM This c ha pt er co n tai ns th e i nfo rm ati o n a nd p r oc ed ur es ne ed ed to co nfig ure th e IS A o r th e I S M in t he Cis co 71 00 seri es VPN ro uter s and Cisc o 7200 se ries ro ut[...]

4- 2 Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Chapter 4 Configur i ng the ISA and ISM Using the EXE C Co mm a nd Interp r e ter Con fig urin g I P Sec requ ir es privileged - level acce ss t o t he EX E C c om m an d in ter p r ete r . Al s o , pr i vile g ed-l ev e l ac cess [...]

4-3 Inte gra ted Services Adap ter and Integrat ed Service s Module In stal l ation and Conf ig uration OL-3575-01 B0 Chapt e r 4 Confi guri ng the ISA and ISM Co nf igurin g IKE Use the ppp encrypt mppe { auto | 40 | 12 8 } [ passive | req u i re d ] [ st ateful ] co m ma nd i n i n ter face con f igura tio n mode to e nabl e MPPE on the vi rt ual[...]

4- 4 Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Chapter 4 Configur i ng the ISA and ISM Confi g u rin g IPSe c Co nfi gurin g IPSec Af ter yo u ha ve c omplet ed IKE conf igur ati on, co nfi gu re IPS ec at ea ch part ici pati ng I PSec pe er . This section contains b a si c st [...]

4-5 Inte gra ted Services Adap ter and Integrat ed Service s Module In stal l ation and Conf ig uration OL-3575-01 B0 Chapt e r 4 Confi guri ng the ISA and ISM Configuring IP Sec Later, you w il l a ss oc iat e t he cr y pto acc ess l ists to p ar ti cu lar i nter fac es w h en y ou c onfigur e an d ap pl y cry pto map set s t o the inte rf ace s ([...]

4- 6 Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Chapter 4 Configur i ng the ISA and ISM Confi g u rin g IPSe c I f you c hange a tran sfor m set de f i n iti on, the chan ge is onl y appli ed to cryp to map en tri es t hat re fe renc e the t r ans for m s et . T he ch an ge is n[...]

4-7 Inte gra ted Services Adap ter and Integrat ed Service s Module In stal l ation and Conf ig uration OL-3575-01 B0 Chapt e r 4 Confi guri ng the ISA and ISM Cr eati ng Cry pto Maps Ta b l e 4 - 1 shows allo wed t ransform combinat ions. Creat i ng Crypto Maps Cryp to map entr ies cr eated for IPSe c pul l toge the r th e v ariou s el ement s use[...]

4- 8 Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Chapter 4 Configur i ng the ISA and ISM C re a tin g Cry p to Ma ps For IPS ec to succe ed be twee n two I PSec pee rs, both p eers ’ cr ypto m ap entries mus t con tain c om patib le configu r ati on s t at emen t s . Wh en tw o[...]

4-9 Inte gra ted Services Adap ter and Integrat ed Service s Module In stal l ation and Conf ig uration OL-3575-01 B0 Chapt e r 4 Confi guri ng the ISA and ISM Applying C rypto Maps to Interfaces Apply ing Crypto Maps to Inter faces Y ou ne ed to ap p ly a cryp to m ap s et to ea ch in te rface th r ou g h w hic h IPSe c t ra f fic f low s. A p p l[...]

4-1 0 Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Chapter 4 Configur i ng the ISA and ISM Veri fy ing Co nf ig urat i on T o cle ar ( an d re in iti al ize ) IPSe c se cur i ty as so ci ati ons, use o ne of t he f ol low in g co mm an d s in g lo b al con f igura tio n mode : T o[...]

4-11 Inte gra ted Services Adap ter and Integrat ed Service s Module In stal l ation and Conf ig uration OL-3575-01 B0 Chapt e r 4 Confi guri ng the ISA and ISM Verifying Conf igur ati on Peer = 172.21.114.67 Extended IP access list 141 access-list 141 permit ip source: addr = 172.21.114.123/0.0.0.0 dest: addr = 172.21.114.67/0.0.0.0 Current peer: [...]

4-1 2 Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Chapter 4 Configur i ng the ISA and ISM IPSe c Ex a m pl e outbound esp sas: spi: 0x20890A6F(545852015) transform: esp-des esp-md5-hmac, in use settings ={Tunnel,} slot: 0, conn id: 27, crypto map: router-alice sa timing: remainin[...]

4-13 Inte gra ted Services Adap ter and Integrat ed Service s Module In stal l ation and Conf ig uration OL-3575-01 B0 Chapt e r 4 Confi guri ng the ISA and ISM IPS e c E x am pl e Not e In th e abo ve e xample , th e enc rypti on DES of pol icy 15 woul d no t appea r in the writt en co nfi gur ati on becau s e th is i s t he defau lt valu e fo r t[...]

4-1 4 Integrat ed Ser vices A dapter an d Inte grated Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 Chapter 4 Configur i ng the ISA and ISM IPSe c Ex a m pl e[...]

IN-1 Integrat ed Ser vices A dapter and Inte grated Services Module I nstal lation an d C onfiguratio n OL-3575-01 B0 INDE X A acc ess- li s t (e n cr y ptio n) c om man d 4-5 access lists Se e al s o I PSe c, cr yp to a cce s s li s ts ac ronym s lis t o f vi i C cache memory viii clea r cr y pt o sa c om man d 4-10 cryp t o ips ec tr ans form - s[...]

Index IN-2 Integrat ed Ser vices A dapter an d Int egrate d Services Modul e Instal lation a nd C onfigurat ion OL-3575-01 B0 M ma tch a ddress comm and 4-8 P pa rt s r eq uir ed fo r V I P in s ta ll a ti on a nd m a inte nan ce 2-1 POSIP LED s, ch eck in g 1-6 to ?? prereq uisi tes VIP in sta lla tion 2- 1 S sa fety guide line s 2-3 SAs cl ear in[...]