Cisco 900 Series ISR Software Configuration Guide

Configuring Secure Storage

---

Secure Storage feature allows you to secure critical configuration information by encrypting it. It encrypts VPN, IPSec, and other asymmetric key-pairs, pre-shared secrets, the type 6 password encryption key and certain credentials. An instance-unique encryption key is stored in the hardware trust anchor to prevent it from being compromised.

By default, this feature is enabled on platforms that come with a hardware trust anchor. This feature is not supported on platforms that do not have hardware trust anchor.

• Enabling Secure Storage
• Disabling Secure Storage
• Verifying the Status of Encryption
• Verifying the Platform Identity
• Downgrading the Platform Image to an Older Version

Enabling Secure Storage

The following example shows how to enable Secure Storage:

Note By default, this feature is enabled on a platform. Use the above procedure on a platform where it is disabled.

Disabling Secure Storage

The following example shows how to disable Secure Storage:

Verifying the Status of Encryption

Use the show parser encrypt file status command to verify the status of encryption. The following command output indicates that the feature is available but the file is not encrypted. The file is in “plain text” format.

The following command output indicates that the feature is enabled and the file is encrypted. The file is in “cipher text” format.

Verifying the Platform Identity

Use the show platform sudi certificate command to display the SUDI certificate in standard PEM format. The command output helps you verify the platform identity.

In the command output, the first certificate is the Cisco Root CA 2048 and the second is the Cisco subordinate CA (ACT2 SUDI CA). The third is the SUDI certificate.

Downgrading the Platform Image to an Older Version

Before you downgrade the platform image to an older version where the Secure Storage is not supported, you have to disable the feature in the version where it is supported. To disable Secure Storage, see Disabling Secure Storage

If you do not disable this feature before downgrading to an older image, the private-config file will be in an encrypted format. The following Syslog message will be generated to indicate that the file is in an encrypted format:

If the file is in ‘plain text’, no Syslog message will be generated.