IKE Initiate Aggressive Mode

The IKE: Initiate Aggressive Mode feature allows you to configure IKE preshared keys as RADIUS tunnel attributes for IPsec peers. Thus, you can scale your IKE preshared keys in a hub-and-spoke topology.

Although IKE preshared keys are simple to understand and easy to deploy, they do not scale well with an increasing number of users and are therefore prone to security threats. Instead of keeping your preshared keys on the hub router, this feature allows you to scale your preshared keys by storing and retrieving them from an authentication, authorization, and accounting (AAA) server. The preshared keys are stored in the AAA server as Internet Engineering Task Force (IETF) RADIUS tunnel attributes and are retrieved when a user tries to “speak” to the hub router. The hub router retrieves the preshared key from the AAA server and the spokes (the users) initiate aggressive mode to the hub by using the preshared key that is specified in the Internet Security Association Key Management Policy (ISAKMP) peer policy as a RADIUS tunnel attribute.

To initiate an IKE aggressive mode negotiation, the Tunnel-Client-Endpoint (66) and Tunnel-Password (69) attributes must be configured in the ISAKMP peer policy. The Tunnel-Client-Endpoint attribute will be communicated to the server by encoding it in the appropriate IKE identity payload; the Tunnel-Password attribute will be used as the IKE preshared key for the aggressive mode negotiation

SUMMARY STEPS

1.    enable

2.    configure terminal

3.    crypto map map-name isakmp authorization list list-name

4.    crypto isakmp peer {ip-address ip-address | fqdn fqdn}

5.    set aggressive-mode client-endpoint client-endpoint

6.    set aggressive-mode password password

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	crypto map map-name isakmp authorization list list-name Example: Router (config)# crypto map testmap10 isakmp authorization list list ike	Enables IKE querying of AAA for tunnel attributes in aggressive mode.
Step 4	crypto isakmp peer {ip-address ip-address | fqdn fqdn} Example: Router (config)# crypto isakmp peer ip address 10.10.10.1	Enables an IPsec peer for IKE querying of AAA for tunnel attributes in aggressive mode and enters ISAKMP policy configuration mode.
Step 5	set aggressive-mode client-endpoint client-endpoint Example: Router (config-isakmp)# set aggressive-mode client-endpoint user-fqdn user@cisco.com	Specifies the Tunnel-Client-Endpoint attribute within an ISAKMP peer configuration.
Step 6	set aggressive-mode password password Example: Router (config-isakmp)#set aggressive-mode password cisco123	Specifies the Tunnel-Password attribute within an ISAKMP peer configuration.

To verify that the Tunnel-Client-Endpoint and Tunnel-Password attributes have been configured within the ISAKMP peer policy, use the show running-configglobal configuration command.

SUMMARY STEPS

1.    enable

2.    debug aaa authorization

3.    debug crypto isakmp

4.    debug radius

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	debug aaa authorization Example: Router# debug aaa authorization	Displays information about AAA authorization.
Step 3	debug crypto isakmp Example: Router# debug crypto isakmp	Displays messages about IKE events.
Step 4	debug radius Example: Router# debug radius	Displays information associated with RADIUS.