Supported 12.3 IOS for Stateful Crypto Maps

[erikhoehne]

I'm trying to figure out which 12.3 IOS version for a 7206 and 2651 support stateful crypto maps. All the docs I've found on cisco.com regarding recommended releases from the 12.3 train are deferred. I figured since this feature was added back in 12.2; then it would be available in 12.3. I've tried Enterprise, IP Plus, IPSEC, 3DES packages in several 12.3 releases, but none understand the stateful command at the end of the crypto map command applied to an interface.

[ajagadee]

Erik,

Stateful Failover for IPSEC was introduced in 12.3(11)T. That is why you are not finding the feature in 12.3 Mainline.

Please refer the below URL for details.

http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_guide09186a00802d03f2.html

You could run 12.3(11)T or higher in 12.3(x)T Train or if your company policy is to run only mainline code, then you can go to 12.4 Mainline.

I hope it helps.

Regards,

Arul

** Please rate all helpful posts **

[erikhoehne]

Good Afternoon Arul,

Ok, cool. Thanks for the quick reply! I haven't tried any of the T trains. I'll give it a whirl.

Later,

Erik

[erikhoehne]

Hi Arul,

I just saw the article you posted in your previous message. I remember looking over that one a while back. Unfortunately, there are no T trains available for download on CCO. Any ideas?

Thanks,

Erik

[erikhoehne]

Hi Arul,

One more thing. I tried 12.3.21 and it didn't understand the "stateful" command. Just a heads up!

Thanks,

Erik

[ajagadee]

Erik,

What platform are you trying to download the code for.

I checked for 7200's and 12.3(11)T, 12.3(14)T, 12.4 Mainline are available.

Try 12.3(14)T7 or 12.4(12). Also, make sure that you have sufficient Flash and RAM before you download the code and do the upgrade.

Regards,

Arul

** Please rate all helpful posts **

[erikhoehne]

Arul,

Whoops! I was in the 2600 section. One of my routers in my test bed is a 2651. Any idea what IOS for the 2600 understands the stateful command?

Thanks,

Erik

[ajagadee · Accepted solution]

Erik,

2651 routers are end of sale and 12.3 Mainline is the last mainline support. This is the reason you dont see any 12.3T or 12.4 Mainline for 2651 routers. Please refer the below URL for details.

http://www.cisco.com/en/US/products/hw/routers/ps259/prod_eol_notice09186a008032d4c2.html

You have to use a different chassis that supports 12.3T or 12.4 mainline to do the Stateful IPSEC Testing.

Regards,

Arul

** Please rate all helpful posts **

[erikhoehne]

Ok, no bigee.

Thanks!

Erik