Cisco Cisco 3G Wireless WAN (1xRTT, EVDO Rev A Rel 0) HWIC - Verizon
© 2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco/Verizon Public Information.
Page 3 of 16
Notes
1. The lifetime of the ISAKMP sessions on the key server should be no less than 24 hours.
2. Advanced Encryption Standard (AES) mode is recommended for the Traffic Encryption Key and Key
Encryption Key.
3. Use multiple key servers with the co-operative protocol. There should be persistent multiple paths between co-
op key servers.
4. If there are multiple key servers, RSA keys should be generated on one of the co-op key servers as exportable
and should be imported on all other key servers.
5. The encryption policy should have explicit denies for traffic not requiring encryption followed by global permit
statements that are symmetric.
6. On the group member, specify the loopback address that is routed by NEMO as the source of rekey messages
with the command crypto map crypto-name local-address Loopback XYZ.
7. For a key system, it is recommended to always use a loopback interface as the key system IP address for the
Group Domain of Interpretation (GDOI) protocol.
8. Fail/open and fail/closed modes are both supported with DMNR.
9. Unicast rekey process is the only rekey method supported.
10. The GDOI crypto map must be applied to the NEMO Tunnel interface using the template method as shown in
Figure 1.
Assumptions and Guidelines
This document assumes the reader has followed the “Verizon Wireless Dynamic Mobile Network Routing - Mobile
Router Configuration Guide for Primary Wireless Access” document and DMNR is operating and verified before
attempting the tasks outlined herein.
For implementation please consult Cisco for proper customer-premises-equipment (CPE) hardware selection and
scalability.
Hardware Platforms and Software Images
This document is written based on the following software versions and hardware. The following list is not the
complete list of platforms supported. Consult Cisco for the required software image.
●
Key sever: 7206VXR: 12.4 (22)T ADVIPSERVICESK9-M, 3945: 15.1(3)T1 Universal K9, 3845: 15.1(3)T1
ADVIPSERVICESK9-MZ
●
MPLS/CE GM:
1900/2900/3900 with LTE eHWIC: IOS 15.3(3)M2 with security license
C819G-4G-V
IOS 15.3(3)M2 (security license included)
CGR2010 with LTE GRWIC:
15.3(1)T1 with security license
881G with EVDO:
15.1(1)T universalk9-MZ
ASR 1002:
15.1(1)S2 ADVENTERPRISEk9, 2911:15.1(2)T3 Universal K9
The Cisco 1941 Integrated Services Router is shown as the LTE/group member example. Many Cisco Integrated
Services Routers (ISRs) that can run NEMO and Group Encrypted Transport VPN can be used, but a Cisco IOS
®