IPSec Packet Size Calculator - SHA256 digest?

[sebastian.lemke]

Hi,

I recently discovered the IPSec Packet Size Calculator in this forum (see attachment).

It is very helpful to calculate the overhead when using IPSec, esp. DMVPN.

Unforunately it doesn't contain options for the following hashes:

  esp-sha256-hmac  ESP transform using HMAC-SHA256 auth

  esp-sha384-hmac  ESP transform using HMAC-SHA384 auth

  esp-sha512-hmac  ESP transform using HMAC-SHA512 auth

Where can I find information about how big the digest will be when using "esp-sha256-hmac" in my transform set?

Is somebody able and willing to implement these new options in the calculator?

Thanks

[sebastian.lemke]

Hi,

can nobody give me a hint?

:-)

[ctucker1405]

We are looking for similar information while troubleshooting what looks to be a fragmentation issue with our dmvpn ipsec solution. We have implemented AES128 and SHA256. I found the following for the lower hash/hmacs, but it stops with SHA-1. http://www.cisco.com/c/en/us/td/docs/interfaces_modules/services_modules/vspa/configuration/guide/ivmsw_book/ivmvpnb.html#wp2055737. Did you find any information? Anyone else?

[sebastian.lemke]

up until now I didn't find any reliable information either.

I contacted the authour of the above html file, but there is no new version...

Would also greatly appreciate an update :-)

[wzhang · Accepted solution]

This was just published about a week ago:

https://cway.cisco.com/tools/ipsec-overhead-calc/ipsec-overhead-calc.html

Thanks,

Wen

[sebastian.lemke]

Thanks Wen!!

Thats exactly what I was looking for!

[wzhang]

Sebastian:

Good to know the tool is useful to you. If you have any ideas on how it can be enhanced, provide your feedback using the feedback link, and we'll do what we can.

Thanks,

Wen