2

I received an alert stating that a crypto engine was 'dead'. I did a bit of digging and was able to find some output to validate this:

#sh crypto eng config


    crypto engine name:  Virtual Private Network (VPN) Module
    crypto engine type:  hardware
                 State:  Enabled
              Location:  onboard 0
          Product Name:  Onboard-VPN
            FW Version:  1
          Time running:  2868294 seconds
           Compression:  Yes
                   DES:  Yes
                 3 DES:  Yes
               AES CBC:  Yes (128,192,256)
              AES CNTR:  No
 Maximum buffer length:  4096
      Maximum DH index:  0000
      Maximum SA index:  0000
    Maximum Flow index:  8000
  Maximum RSA key size:  0000

    crypto engine name:  Virtual Private Network (VPN) Module
    crypto engine type:  hardware
                 State:  Disabled
              Location:  slot 0
          Product Name:  ISM VPN Accelerator
          UBOOT Ver   : U-Boot 1.1.1 - ISRG2-Crypto-Engine - Version 2.7 (Build time: Mar  7 2011 - 09:12:23)
          Firmware Ver:   User: ssafari - View/Label: REVENTON_FW_COMMIT_IOS_12022013 - Date: Dec  2 2013 - Time: 16:18:14 

          HW State    : DEAD

           Compression:  No
                   DES:  Yes
                 3 DES:  Yes
               AES CBC:  Yes (128,192,256)
              AES CNTR:  No
 Maximum buffer length:  4096
      Maximum DH index:  5120
      Maximum SA index:  5120
    Maximum Flow index:  10230
  Maximum RSA key size:  2048

    crypto lib version:  22_421.0.0

    crypto lib version:  22_421.0.0

I'm unfamiliar with what this output is saying. Is the VPN Module like a line card that is plugged into the router and can be replaced? Does the HW State: DEAD mean the card is bad and needs to be replaced? What are some other show commands I can use to validate what this output is implying?

| improve this question | |
  • 1
    Yes, the VPN module is a linecard that's plugged into the router and can be replaced. You can try to reload the router, but the best bet would be to engage Cisco's TAC to identify whether it is a backplane problem on the router or a problem with the module itself. If it's possible that this router has rebooted recently, the software version of the ISM module and the router itself may be incompatible. What is the output of service-module ism (ISM #) status? – Arima Feb 9 '15 at 0:33
  • When I attempt to get that information - contextual help only displays "service-module embedded-service-engine" 'ism' is unknown. Any other thoughts? Thanks for your feedback so far! – A L Feb 9 '15 at 3:02
  • service-module ism 0/0 status, or service-module sm 0/0 status. If neither of these work, you may want to reseat the module as described in Cisco's guide. You will need to shut down and safely power off the router to accomplish that. Cisco TAC is probably the best bet. – Arima Feb 9 '15 at 3:18
  • I knew what you meant as far as the formatting for the command. I'm saying ism isn't an option at all under service-module. I've been told by colleagues that this error may be related to an IOS bug. If you want to respond to my questions as another post/answer (what does HW state: dead- mean, what are VPN modules, what are some sh commands to tshoot this) - I will mark as answer. – A L Feb 9 '15 at 4:06
4

Yes, the VPN module is a linecard that's plugged into the router and can be replaced.

A 'DEAD' hardware state simply means the router has lost communication with the ISM. This does not actually mean the hardware is dead, as a variety of issues in the field have caused this for me: Cards that somehow get unseated, incompatibilities with IOS and the card's firmware, etc. The first issue usually has different evidence, though.

You can try to reload the router, but the best bet would be to engage Cisco's TAC to identify whether it is a backplane problem on the router or a problem with the module itself.

The fact that the show crypto engine config command still returns results about the card is an indicator that the card itself may be OK and has just crashed, but the HW state 'DEAD' doesn't mean the hardware is gone forever (though it could indicate a hardware problem such as memory corruption, electrical failure, etc). Cisco bug CSCtz51773 may be relevant here, find a release that has a fix for this bug and try it out to see if it works for you.

| improve this answer | |
  • Brilliant answer, thank you for taking the time to re-structure this it has helped me immensely! It was bug related in the end. Marking as answer. – A L Feb 17 '15 at 0:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.