Cisco ASR 1001 User Manual

Page 32 of 72
Crypto map entries also include transform sets. A transform set is an acceptable combination of
security protocols, algorithms, and other settings that can be applied to IPsec-protected traffic.
During the IPsec SA negotiation, the peers agree to use a particular transform set when
protecting a particular data flow.
4.6.1.1 IKEv1 Transform Sets
An Internet Key Exchange version 1 (IKEv1) transform set represents a certain combination of
security protocols and algorithms. During the IPsec SA negotiation, the peers agree to use a
particular transform set for protecting a particular data flow.
Privileged administrators can specify multiple transform sets and then specify one or more of
these transform sets in a crypto map entry. The transform set defined in the crypto map entry is
used in the IPsec SA negotiation to protect the data flows specified by that crypto map entry's
access list.
During IPsec security association negotiations with IKE, peers search for a transform set that is
the same at both peers. When such a transform set is found, it is selected and applied to the
protected traffic as part of both peers' IPsec SAs. (With manually established SAs, there is no
negotiation with the peer, so both sides must specify the same transform set.)
Note: If a transform set definition is changed during operation that the change is not applied to
existing security associations, but is used in subsequent negotiations to establish new SAs. If you
want the new settings to take effect sooner, you can clear all or part of the SA database by using
the clear crypto sa command.
The following settings must be set in configuring the IPsec with IKEv1 functionality for the
TOE:
TOE-common-criteria # conf t
TOE-common-criteria (config)#crypto isakmp policy 1
TOE-common-criteria (config-isakmp)# hash sha
TOE-common-criteria (config-isakmp)# encryption aes
This configures IPsec IKEv1 to use AES-CBC-128 for payload encryption. AES-
CBC-256 can be selected with ‘encryption aes 256’.
Note: the authorized administrator must ensure that the keysize for this setting is
greater than or equal to the keysize selected for ESP in Section 4.6.2 below. If
AES 128 is selected here, then the highest keysize that can be selected on the TOE
for ESP is AES 128 (either CBC or GCM).
Note: Both confidentiality and integrity are configured with the hash sha and
encryption aes commands respectively. As a result, confidentiality-only mode is
disabled.
TOE-common-criteria (config-isakmp)# authentication pre-share
This configures IPsec to use pre-shared keys. X.509 v3 certificates are also
supported for authentication of IPsec peers. See Section 4.6.3 below for additional
information.

Cisco ASR 1001 Specifications

General

Ethernet LAN	Yes
Cabling technology	10/100/1000Base-T(X)
Networking standards	-
Ethernet LAN data rates	10, 100, 1000 Mbit/s
Ethernet interface type	Gigabit Ethernet
USB ports quantity	1
Ethernet LAN (RJ-45) ports	4
VPN tunnels quantity	8000
Product color	Gray
Rack capacity	1U
AC input voltage	85 - 264 V
Power source type	AC
AC input frequency	50 - 60 Hz
Power consumption (typical)	250 W
Safety	UL60950-1 CSA, C22.2 No. 60950-1-03, EN 60950-1, IEC 60950-1, AS/NZS 60950.1
Certification	FCC 47CFR15 Class A AS/NZS CISPR 22 CISPR 22 Class A EN55022 Class A ICES-003 Class A VCCI Class A CNS-13438 Class A EN61000-3-2 EN61000-3-3
Internal memory	8192 MB
Operating altitude	0 - 3048 m
Storage temperature (T-T)	0 - 50 °C
Operating temperature (T-T)	0 - 40 °C
Storage relative humidity (H-H)	5 - 95 %
Operating relative humidity (H-H)	5 - 90 %

Weight and Dimensions

Depth	461.5 mm
Width	439.42 mm
Height	43.43 mm
Weight	11350 g