I'm currently debugging an issue with IPsec tunnels and it seems like one of our client's NW engineers didn't install the HSEC-K9 license.

The issue is that the new IPsec tunnels are not coming up even though both peers are rightly configured with all the necessary configurations.

While cross checking in the design specification document, I could see that the Licensing detail is mentioned as "U.S. Export Restriction Compliance license for 4400 series". It is also clearly mentioned to procure two licenses and to install the same in the core router.

I'm confused with the term here. Can someone confirm whether the "U.S. Export Restriction Compliance license for 4400 series" and HSEC-K9 License is same?

Query Two:

I can see the following error in the router console log. I have more or less confirmed that the this is the reason behind our issue.

Feb 22 10:48:53.170: %CERM-4-TUNNEL_LIMIT: Maximum tunnel limit of 225 reached for Crypto functionality with securityk9 technology package license.

show platform cerm-information doesn't seems to working in the router. The model is Cisco ISR4451-X/K9.

These are the only commands available in the router.

RT#show crypto ipsec ?

policy Show IPSEC client policies
profile Show ipsec profile information
sa IPSEC SA table
security-association Show parameters for IPSec security associations
spi-lookup IPSEC SPI table
transform-set Crypto transform sets
  • It is illegal to export strong crypto from the U.S. (that is the same as exporting weapons without a license, seriously), so companies will have a parallel product with weaker crypto to export. You, apparently, have the export version of the license. – Ron Maupin Feb 23 '19 at 15:58
  • Okay Ron.I understood. Can you confirm whether the "U.S. Export Restriction Compliance license for 4400 series" and HSEC-K9 License is same? – Maverick Feb 24 '19 at 0:01
  • According to the Cisco web site, the HSEC license is the, "U.S. Export Restriction Compliance license for 4400 series." – Ron Maupin Feb 24 '19 at 3:26
  • Could you please share the link to the particular page where it is mentioned in the Cisco portal? – Maverick Feb 24 '19 at 7:35
  • I pulled it up in the Cisco Commerce web page. I started an estimate for a 4451-X, then went to the licensing. That is not something for which I can provide a link. – Ron Maupin Feb 24 '19 at 7:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.