Cisco Cisco 1800 2800 3800 Series AP-AG 802.11a b g High-Speed WIC

Page 3 of 16

Notes

1. The lifetime of the ISAKMP sessions on the key server should be no less than 24 hours.

2. Advanced Encryption Standard (AES) mode is recommended for the Traffic Encryption Key and Key

Encryption Key.

3. Use multiple key servers with the co-operative protocol. There should be persistent multiple paths between co-

op key servers.

4. If there are multiple key servers, RSA keys should be generated on one of the co-op key servers as exportable

and should be imported on all other key servers.

5. The encryption policy should have explicit denies for traffic not requiring encryption followed by global permit

statements that are symmetric.

6. On the group member, specify the loopback address that is routed by NEMO as the source of rekey messages

with the command crypto map crypto-name local-address Loopback XYZ.

7. For a key system, it is recommended to always use a loopback interface as the key system IP address for the

Group Domain of Interpretation (GDOI) protocol.

8. Fail/open and fail/closed modes are both supported with DMNR.

9. Unicast rekey process is the only rekey method supported.

10. The GDOI crypto map must be applied to the NEMO Tunnel interface using the template method as shown in

Figure 1.

Assumptions and Guidelines

This document assumes the reader has followed the “Verizon Wireless Dynamic Mobile Network Routing - Mobile

Router Configuration Guide for Primary Wireless Access” document and DMNR is operating and verified before

attempting the tasks outlined herein.

For implementation please consult Cisco for proper customer-premises-equipment (CPE) hardware selection and

scalability.

Hardware Platforms and Software Images

This document is written based on the following software versions and hardware. The following list is not the

complete list of platforms supported. Consult Cisco for the required software image.

●

Key sever: 7206VXR: 12.4 (22)T ADVIPSERVICESK9-M, 3945: 15.1(3)T1 Universal K9, 3845: 15.1(3)T1

ADVIPSERVICESK9-MZ

●

MPLS/CE GM:

1900/2900/3900 with LTE eHWIC: IOS 15.3(3)M2 with security license

C819G-4G-V

IOS 15.3(3)M2 (security license included)

CGR2010 with LTE GRWIC:

15.3(1)T1 with security license

881G with EVDO:

15.1(1)T universalk9-MZ

ASR 1002:

15.1(1)S2 ADVENTERPRISEk9, 2911:15.1(2)T3 Universal K9

The Cisco 1941 Integrated Services Router is shown as the LTE/group member example. Many Cisco Integrated

Services Routers (ISRs) that can run NEMO and Group Encrypted Transport VPN can be used, but a Cisco IOS