How to check if IPSec is available on Cisco ISR 4451

Question

On a Cisco isr 4451 with base image I need to check if IPSec is available. Is there an command to list available vpn features?

UPDATE The image name includes K9 (UNIVERSALK9-M) but the command failed as invalid input detected at isakmp. How can I enable IPSEC on K9 Image.

UPDATE As mentioned here is the output of sh license

#sh license 
Index 1 Feature: appxk9                         
    Period left: Not Activated
    Period Used: 0  minute  0  second  
    License Type: EvalRightToUse
    License State: Active, Not in Use, EULA not accepted
    License Count: Non-Counted
    License Priority: None
Index 2 Feature: uck9                           
    Period left: Not Activated
    Period Used: 0  minute  0  second  
    License Type: EvalRightToUse
    License State: Active, Not in Use, EULA not accepted
    License Count: Non-Counted
    License Priority: None
Index 3 Feature: securityk9                     
    Period left: Not Activated
    Period Used: 0  minute  0  second  
    License Type: EvalRightToUse
    License State: Active, Not in Use, EULA not accepted
    License Count: Non-Counted
    License Priority: None
Index 4 Feature: ipbasek9                       
    Period left: Life time
    License Type: Permanent
    License State: Active, In Use
    License Count: Non-Counted
    License Priority: Medium
Index 5 Feature: cme-srst                       
    Period left: Not Activated
    Period Used: 0  minute  0  second  
    License Type: EvalRightToUse
    License State: Active, Not in Use, EULA not accepted
    License Count: 0/0  (In-use/Violation)
    License Priority: None
Index 6 Feature: hseck9                         
Index 7 Feature: throughput                     
    Period left: Not Activated
    Period Used: 0  minute  0  second  
    License Type: EvalRightToUse
    License State: Active, Not in Use, EULA not accepted
    License Count: Non-Counted
    License Priority: None
Index 8 Feature: internal_service      

Answer 1

Check your license boot:
show run | include boot
And if you don't see it there already, add it like this:
license boot level appxk9

*edit: in your case, you need license boot level securityk9
After adding the boot level and reloading, you should be able to accept the EULA and gain access to ISAKMP/IKE commands.

Answer 2

On the router console, type

show version

If the image name includes the letters "K9", as in C3000-UNIVERSALK9-M, then yes. Otherwise, no.

You can also type a command like

show crypto isakmp sa

If you don't get an error, then IPsec is available.

EDIT:

To enable IPSec with this IOS version, you have to buy the security license (securityk9) to enable that feature.

Answer 3

On this datasheet we can read :

When combined with an optional Cisco IOS XE Software Security license, enables WAN link security and VPN services.

So it seems that the K9 indicate that the image loaded on your ISR is IPSEC capable, but you need to activate a license to use it.

Issuing the show licence command should show you which license is active.

On the same page you will find:

Cisco IOS Software Licensing and Packaging

Universal Cisco IOS XE Image

A single Cisco IOS XE Universal image encompassing all functions is delivered with the platform. Advanced features can be enabled simply by activating a software license on the Universal image. Technology packages and feature licenses, enabled through right-to-use licenses, simplify software delivery and decrease the operational costs of deploying new features.

Four major technology licenses are available on the Cisco 4000 Series; these licenses can be activated through the Cisco software activation process identified at http://www.cisco.com/go/sa. The following licenses are available:

● IP Base: This technology package is available as the default.

● Application Experience (APPX): This license includes data and application performance features.

● Unified Communications (UC):[6] This license includes voice features.

● Security (SEC) or Security with No Payload Encryption (SEC-NPE): This license includes features for securing network infrastructure.

The Cisco 4000 Series has a performance-on-demand license to increase the base forwarding throughput with no hardware changes. Also present is the High Security (HSEC) license, which removes the curtailment enforced by the U.S. government export restrictions on the encrypted tunnel count and encrypted throughput. The HSECK9 license is a separately required license for a feature to have full crypto functionality. Without the HSECK9 license, only 225 secure tunnels and 85 Mbps of crypto bandwidth would be available.