[c-nsp] Can you apply crypto map to SVI

[Ge Moua]

Maybe; I've seen a situation with the me-6524 with the crypto commands 
available but functionality disabled.  What hardware platform are you 
running?

Regards,
Ge Moua | Email: moua0100 at umn.edu

Network Design Engineer
University of Minnesota | Networking & Telecommunications Services



Andy Saykao wrote:
> Hi Ge,
>
> Yes I see an active crypto engine in "software". 
>
> core1#sh cry engine configuration
>
>         crypto engine name:  unknown
>         crypto engine type:  software
>              serial number:  00016956
>        crypto engine state:  installed
>      crypto engine in slot:  N/A
>                   platform:  Cisco Software Crypto Engine
>
>    Encryption Process Info:
>           input queue size:  500
>            input queue top:  0
>            input queue bot:  0
>          input queue count:  0
>
>    Crypto Adjacency Counts:
>                 Lock Count:  0
>               Unlock Count:  0
>         crypto lib version:  17.0.0
>          ipsec lib version:  2.0.0
>
> Does this mean that if the crypto map is applied to the SVI that the
> IPSEC tunnel should be working (considering my IPSEC config is all
> good).
>
> Thanks.
>
> Andy
>
> -----Original Message-----
> From: Ge Moua [mailto:moua0100 at umn.edu] 
> Sent: Tuesday, 16 June 2009 7:03 PM
> To: Andy Saykao
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Can you apply crypto map to SVI
>
> Yes, this should work contigent on hw plaform.  If you do a "sh cry
> engine" do you see an active crypto engine in sw or hw?  If not then the
> crypto commands will never be invoked even though legal.
>
> Regards,
> Ge Moua | Email: moua0100 at umn.edu
>
> Network Design Engineer
> University of Minnesota | Networking & Telecommunications Services
>
>
>
> Andy Saykao wrote:
>   
>> Hi All,
>>  
>> Got a problem with a site-to-site IPSEC vpn implementation where one 
>> end is using SVI.
>>  
>> Does any body know if a crypto map can be applied to a SVI to bring up
>>     
>
>   
>> the IPSEC tunnel? It accepts the command but I can't pass any traffic 
>> to/from it.
>>  
>> interface vlan 10
>>  crypto map MY-MAP
>>  
>> Or do you need to apply the crypto map to a physical interface? 
>>  
>> I've gotten it working on a sub-interface (eg: interface
>> GigabitEthernet0/0.11) but can't find any documentation that talks 
>> about applying it to a SVI and whether this will work.
>>  
>> Thanks.
>>  
>> Andy
>>
>> This email and any files transmitted with it are confidential and 
>> intended  solely for the use of the individual or entity to whom they
>>     
> are addressed.
>   
>> Please notify the sender immediately by email if you have received 
>> this email by mistake and delete this email from your system. Please 
>> note that  any views or opinions presented in this email are solely 
>> those of the  author and do not necessarily represent those of the
>>     
> organisation.
>   
>> Finally, the recipient should check this email and any attachments for
>>     
>
>   
>> the presence of viruses. The organisation accepts no liability for any
>>     
>
>   
>> damage caused by any virus transmitted by this email.
>>
>> _______________________________________________
>> cisco-nsp mailing list  cisco-nsp at puck.nether.net 
>> https://puck.nether.net/mailman/listinfo/cisco-nsp
>> archive at http://puck.nether.net/pipermail/cisco-nsp/
>>   
>>     
>
> ______________________________________________________________________
> This email has been scanned by the MessageLabs Email Security System.
> For more information please visit http://www.messagelabs.com/email
> ______________________________________________________________________
>