3

On a Cisco isr 4451 with base image I need to check if IPSec is available. Is there an command to list available vpn features?

UPDATE The image name includes K9 (UNIVERSALK9-M) but the command failed as invalid input detected at isakmp. How can I enable IPSEC on K9 Image.

UPDATE As mentioned here is the output of sh license

#sh license 
Index 1 Feature: appxk9                         
    Period left: Not Activated
    Period Used: 0  minute  0  second  
    License Type: EvalRightToUse
    License State: Active, Not in Use, EULA not accepted
    License Count: Non-Counted
    License Priority: None
Index 2 Feature: uck9                           
    Period left: Not Activated
    Period Used: 0  minute  0  second  
    License Type: EvalRightToUse
    License State: Active, Not in Use, EULA not accepted
    License Count: Non-Counted
    License Priority: None
Index 3 Feature: securityk9                     
    Period left: Not Activated
    Period Used: 0  minute  0  second  
    License Type: EvalRightToUse
    License State: Active, Not in Use, EULA not accepted
    License Count: Non-Counted
    License Priority: None
Index 4 Feature: ipbasek9                       
    Period left: Life time
    License Type: Permanent
    License State: Active, In Use
    License Count: Non-Counted
    License Priority: Medium
Index 5 Feature: cme-srst                       
    Period left: Not Activated
    Period Used: 0  minute  0  second  
    License Type: EvalRightToUse
    License State: Active, Not in Use, EULA not accepted
    License Count: 0/0  (In-use/Violation)
    License Priority: None
Index 6 Feature: hseck9                         
Index 7 Feature: throughput                     
    Period left: Not Activated
    Period Used: 0  minute  0  second  
    License Type: EvalRightToUse
    License State: Active, Not in Use, EULA not accepted
    License Count: Non-Counted
    License Priority: None
Index 8 Feature: internal_service      
  • if the command gives an error, IPsec is not available. – Ron Trunk May 4 '17 at 12:02
  • But in your answer you say it is available if K9 is in image name. Cisco Distributor also told me that the ISR4451 has IPSEC support enable – kockiren May 4 '17 at 12:04
  • Are you in enable mode? – Ron Trunk May 4 '17 at 12:28
  • yes I'am in enable mode – kockiren May 4 '17 at 12:29
4
+50

Check your license boot:
show run | include boot
And if you don't see it there already, add it like this:
license boot level appxk9

*edit: in your case, you need license boot level securityk9
After adding the boot level and reloading, you should be able to accept the EULA and gain access to ISAKMP/IKE commands.

| improve this answer | |
4

On the router console, type

show version

If the image name includes the letters "K9", as in C3000-UNIVERSALK9-M, then yes. Otherwise, no.

You can also type a command like

show crypto isakmp sa

If you don't get an error, then IPsec is available.

EDIT:

To enable IPSec with this IOS version, you have to buy the security license (securityk9) to enable that feature.

| improve this answer | |
  • 1
    You could also use Cisco Feature Navigator and check against available features if unsure – Alex Apr 25 '17 at 12:23
  • The image name includes K9 (UNIVERSALK9-M) but the command failed as invalid input detected at isakmp – kockiren Apr 27 '17 at 6:31
  • The securityk9 is installed but the Eula isn't accepted. So the image has the feature but the command show crypto isakmp failed – kockiren May 6 '17 at 14:58
  • Until you enable the feature, the command will fail. When the command succeeds you know the feature is available. – Ron Trunk May 6 '17 at 15:08
2

On this datasheet we can read :

When combined with an optional Cisco IOS XE Software Security license, enables WAN link security and VPN services.

So it seems that the K9 indicate that the image loaded on your ISR is IPSEC capable, but you need to activate a license to use it.

Issuing the show licence command should show you which license is active.

On the same page you will find:

Cisco IOS Software Licensing and Packaging

Universal Cisco IOS XE Image

A single Cisco IOS XE Universal image encompassing all functions is delivered with the platform. Advanced features can be enabled simply by activating a software license on the Universal image. Technology packages and feature licenses, enabled through right-to-use licenses, simplify software delivery and decrease the operational costs of deploying new features.

Four major technology licenses are available on the Cisco 4000 Series; these licenses can be activated through the Cisco software activation process identified at http://www.cisco.com/go/sa. The following licenses are available:

● IP Base: This technology package is available as the default.

● Application Experience (APPX): This license includes data and application performance features.

● Unified Communications (UC):[6] This license includes voice features.

● Security (SEC) or Security with No Payload Encryption (SEC-NPE): This license includes features for securing network infrastructure.

The Cisco 4000 Series has a performance-on-demand license to increase the base forwarding throughput with no hardware changes. Also present is the High Security (HSEC) license, which removes the curtailment enforced by the U.S. government export restrictions on the encrypted tunnel count and encrypted throughput. The HSECK9 license is a separately required license for a feature to have full crypto functionality. Without the HSECK9 license, only 225 secure tunnels and 85 Mbps of crypto bandwidth would be available.

| improve this answer | |
  • thx I have update the Question, it seemed that the Eula is not accepted – kockiren May 4 '17 at 12:33
  • then use the command license accept end user agreement (ref here : Cisco IOS Software Activation Command Reference – JFL May 4 '17 at 12:34
  • Invalid input detected while execute this command# – kockiren May 4 '17 at 12:36
  • did you issue the command in global configuration mode? I.E. Router(config)# license accept end user agreement – JFL May 4 '17 at 12:39
  • is in conf mode, sorry. I accept this Agreement but in enable mode the sh license command show Eula not accepted – kockiren May 4 '17 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.