© 2014 Cisco and/or its affiliates. All rights reserved. This document is Cisco/Verizon Pu lic Information. Page 3 of 16
Notes
1. The lifetime of the ISAKMP sessions on the key server should e no less than 24 hours.
2. Advanced Encryption Standard (AES) mode is recommended for the Traffic Encryption Key and Key
Encryption Key.
3. Use multiple key servers with the co-operative protocol. There should e persistent multiple paths etween co-
op key servers.
4. If there are multiple key servers, RSA keys should e generated on one of the co-op key servers as exporta le
and should e imported on all other key servers.
5. The encryption policy should have explicit denies for traffic not requiring encryption followed y glo al permit
statements that are symmetric.
6. On the group mem er, specify the loop ack address that is routed y NEMO as the source of rekey messages
with the command crypto map crypto-name local-address Loopback XYZ.
7. For a key system, it is recommended to always use a loop ack interface as the key system IP address for the
Group Domain of Interpretation (GDOI) protocol.
8. Fail/open and fail/closed modes are oth supported with DMNR.
9. Unicast rekey process is the only rekey method supported.
10. The GDOI crypto map must e applied to the NEMO Tunnel interface using the template method as shown in
Figure 1.
Assumptions and Guidelines
This document assumes the reader has followed the “Verizon Wireless Dynamic Mo ile Network Routing - Mo ile
Router Configuration Guide for Primary Wireless Access” document and DMNR is operating and verified efore
attempting the tasks outlined herein.
For implementation please consult Cisco for proper customer-premises-equipment (CPE) hardware selection and
scala ility.
Hardware Platforms and Software Images
This document is written ased on the following software versions and hardware. The following list is not the
complete list of platforms supported. Consult Cisco for the required software image.
●
Key sever: 7206VXR: 12.4 (22)T ADVIPSERVICESK9-M, 3945: 15.1(3)T1 Universal K9, 3845: 15.1(3)T1
ADVIPSERVICESK9-MZ
●
MPLS/CE GM:
900/2900/3900 with LTE eHWIC: IOS 15.3(3)M2 with security license
C8 9G-4G-V IOS 15.3(3)M2 (security license included)
CGR20 0 with LTE GRWIC: 15.3(1)T1 with security license
88 G with EVDO: 15.1(1)T universalk9-MZ
ASR 002: 15.1(1)S2 ADVENTERPRISEk9, 29 :15.1(2)T3 Universal K9
The Cisco 1941 Integrated Services Router is shown as the LTE/group mem er example. Many Cisco Integrated
Services Routers (ISRs) that can run NEMO and Group Encrypted Transport VPN can e used, ut a Cisco IOS
®
