Downloads |
Table Of Contents
Restrictions for Encrypted Preshared Key
Information About Encrypted Preshared Key
Using the Encrypted Preshared Key Feature to Securely Store Passwords
Unconfiguring Password Encryption
Configuring New or Unknown Passwords
Enabling the Encrypted Preshared Key
How to Configure an Encrypted Preshared Key
Configuring an Encrypted Preshared Key
Monitoring Encrypted Preshared Keys
Configuring an ISAKMP Preshared Key
Configuring an ISAKMP Preshared Key in ISAKMP Keyrings
Configuring ISAKMP Aggressive Mode
Configuring a Unity Server Group Policy
Configuring an Easy VPN Client
Configuration Examples for Encrypted Preshared Key
Encrypted Preshared Key: Example
No Previous Key Present: Example
Key Already Exists But the User Wants to Key In Interactively: Example
No Key Present But the User Wants to Key In Interactively: Example
Removal of the Password Encryption: Example
crypto ipsec client ezvpn (global)
crypto isakmp client configuration group
key config-key password-encryption
Encrypted Preshared Key
The Encrypted Preshared Key feature allows you to securely store plain text passwords in type 6 (encrypted) format in NVRAM.
Feature History for Encrypted Preshared Key
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•
Restrictions for Encrypted Preshared Key
•
•
•
Restrictions for Encrypted Preshared Key
•
•
Information About Encrypted Preshared Key
Before Using the Encrypted Preshared Key feature, you should understand the following concepts:
•
•
Using the Encrypted Preshared Key Feature to Securely Store Passwords
Using the Encrypted Preshared Key feature, you can securely store plain text passwords in type 6 format in NVRAM using a command-line interface (CLI). Type 6 passwords are encrypted. Although the encrypted passwords can be seen or retrieved, it is difficult to decrypt them to find out the actual password. Use the key config-key password-encryption command with the password encryption aes command to configure and enable the password (symmetric cipher AES is used to encrypt the keys). The password (key) configured using the config-key password-encryption command is the master encryption key that is used to encrypt all other keys in the router.
If you configure the password encryption aes command without configuring the key config-key password-encryption command, the following message is printed at startup or during any nonvolatile generation (NVGEN) process, such as when the show running-config or copy running-config startup-config commands have been configured:
"Can not encrypt password. Please configure a configuration-key with `key config-key'"Changing a Password
If the password (master key) is changed, or reencrypted, using the key config-key password-encryption command), the list registry passes the old key and the new key to the application modules that are using type 6 encryption.
Deleting a Password
If the master key that was configured using the key config-key password-encryption command is deleted from the system, a warning is printed (and a confirm prompt is issued) that states that all type 6 passwords will become useless. As a security measure, after the passwords have been encrypted, they will never be decrypted in the Cisco IOS software. However, passwords can be reencrypted as explained in the previous paragraph.
Caution
Unconfiguring Password Encryption
If you later unconfigure password encryption using the no password encryption aes command, all existing type 6 passwords are left unchanged, and as long as the password (master key) that was configured using the key config-key password-encryption command exists, the type 6 passwords will be decrypted as and when required by the application.
Storing Passwords
Because no one can "read" the password (configured using the key config-key password-encryption command), there is no way that the password can be retrieved from the router. Existing management stations cannot "know" what it is unless the stations are enhanced to include this key somewhere, in which case the password needs to be stored securely within the management system. If configurations are stored using TFTP, the configurations are not standalone, meaning that they cannot be loaded onto a router. Before or after the configurations are loaded onto a router, the password must be manually added (using the key config-key password-encryption command). The password can be manually added to the stored configuration but is not recommended because adding the password manually allows anyone to decrypt all passwords in that configuration.
Configuring New or Unknown Passwords
If you enter or cut and paste cipher text that does not match the master key, or if there is no master key, the cipher text is accepted or saved, but an alert message is printed. The alert message is as follows:
"ciphertext>[for username bar>] is incompatible with the configured master key."If a new master key is configured, all the plain keys are encrypted and made type 6 keys. The existing type 6 keys are not encrypted. The existing type 6 keys are left as is.
If the old master key is lost or unknown, you have the option of deleting the master key using the no key config-key password-encryption command. Deleting the master key using the no key config-key password-encryption command causes the existing encrypted passwords to remain encrypted in the router configuration. The passwords will not be decrypted.
Enabling the Encrypted Preshared Key
The password encryption aes command is used to enable the encrypted password.
How to Configure an Encrypted Preshared Key
This section contains the following procedures:
•
•
•
•
•
•
•
Configuring an Encrypted Preshared Key
To configure an encrypted preshared key, perform the following steps.
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Troubleshooting Tips
If you see the warning message "ciphertext >[for username bar>] is incompatible with the configured master key," you have entered or cut and pasted cipher text that does not match the master key or there is no master key. (The cipher text will be accepted or saved.) The warning message will allow you to locate the broken configuration line or lines.
Monitoring Encrypted Preshared Keys
To get logging output for encrypted preshared keys, perform the following steps.
1.
2.
DETAILED STEPS
Examples
The following password logging debug output shows that a new master key has been configured and that the keys have been encrypted with the new master key:
Router (config)# key config-key password-encryptNew key:Confirm key:Router (config)#01:40:57: TYPE6_PASS: New Master key configured, encrypting the keys withthe new master keypasRouter (config)# key config-key password-encryptOld key:New key:Confirm key:Router (config)#01:42:11: TYPE6_PASS: Master key change heralded, re-encrypting the keyswith the new master key01:42:11: TYPE6_PASS: Mac verification successful01:42:11: TYPE6_PASS: Mac verification successful01:42:11: TYPE6_PASS: Mac verification successfulWhat To Do Next
You can perform any of the following procedures. Each procedure is independent of the others.
•
•
•
•
•
Configuring an ISAKMP Preshared Key
To configure an ISAKMP preshared key, perform the following procedure.
SUMMARY STEPS
1.
2.
3.
4.
DETAILED STEPS
Example
The following sample output shows that an encrypted preshared key has been configured:
crypto isakmp key 6 _Hg[^^ECgLGGPF^RXTQfDDWQ][YAAB address 10.2.3.4crypto isakmp key 6 `eR\eTRaKCUZPYYQfDgXRWi_AAB hostname foo.comConfiguring an ISAKMP Preshared Key in ISAKMP Keyrings
To configure an ISAKMP preshared key in ISAKMP keyrings, which are used in IPSec Virtual Route Forwarding (VRF) configurations, perform the following procedure.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Example
The following show-running-config sample output shows that an encrypted preshared key in ISAKMP keyrings has been configured.
crypto keyring foopre-shared-key address 10.2.3.5 key 6 `WHCJYR_Z]GRPF^RXTQfDcfZ]GPAABpre-shared-key hostname foo.com key 6 aE_REHDcOfYCPF^RXTQfDJYVVNSAABConfiguring ISAKMP Aggressive Mode
To configure ISAKMP aggressive mode, perform the following steps.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Example
The following show-running-config sample output shows that an encrypted preshared key in ISAKMP aggressive mode has been configured.
crypto isakmp peer address 10.2.3.4set aggressive-mode password 6 ^aKPIQ_KJE_PPF^RXTQfDTIaLNeAABset aggressive-mode client-endpoint fqdn cisco.comConfiguring a Unity Server Group Policy
To configure a unity server group policy, perform the following steps.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
Example
The following show-running-config sample output shows that an encrypted key has been configured for a unity server group policy:
crypto isakmp client configuration group fookey 6 cZZgDZPOE\dDPF^RXTQfDTIaLNeAABdomain cisco.compool foopoolConfiguring an Easy VPN Client
To configure an Easy VPN client, perform the following steps.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
Example
The following show-running-config sample output shows that an Easy VPN client has been configured. The key has been encrypted.
crypto ipsec client ezvpn fooconnect manualgroup foo key 6 gdMI`S^^[GIcPF^RXTQfDFKEO\RAABmode clientpeer 10.2.3.4Configuration Examples for Encrypted Preshared Key
This section provides the following configuration examples:
•
•
•
•
•
Encrypted Preshared Key: Example
The following is an example of a configuration for which a type 6 preshared key has been encrypted. It includes the prompts and messages that a user might see.
Router (config)# crypto isakmp key cisco address 10.0.0.2Router (config)# exitRouter# show runnning-config | include crypto isakmp keycrypto isakmp key cisco address 10.0.0.2Router#Router# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Router (config)# password encryption aesRouter (config)# key config-key password-encryptNew key:Confirm key:Router (config)#01:46:40: TYPE6_PASS: New Master key configured, encrypting the keys withthe new master keyRouter (config)# exitRouter # show running-config | include crypto isakmp keycrypto isakmp key 6 CXWdhVTZYB_Vcd^`cIHDOahiFTa address 10.0.0.2No Previous Key Present: Example
In the following configuration example, no previous key is present:
Router (config)# key config-key password-encryption testkey 123Key Already Exists: Example
In the following configuration example, a key already exists:
Router (config)# key config-key password-encryption testkey123Old key:Router (config)#Key Already Exists But the User Wants to Key In Interactively: Example
In the following configuration example, the user wants to key in interactively, but a key already exists. The Old key, New key, and Confirm key prompts will show on your screen if you enter the key config-key password-encryption command and press the enter key to get into interactive mode.
Router (config)# key config-key password-encryptionOld key:New key:Confirm key:No Key Present But the User Wants to Key In Interactively: Example
In the following example, the user wants to key in interactively, but no key is present. The New key and Confirm key prompts will show on your screen if you are in interactive mode.
Router (config)# key config-key password-encryptionNew key:Confirm key:Removal of the Password Encryption: Example
In the following configuration example, the user wants to remove the encrypted password. The "WARNING: All type 6 encrypted keys will become unusable. Continue with master key deletion? [yes/no]:" prompt will show on your screen if you are in interactive mode.
Router (config)# no key config-key password-encryptionWARNING: All type 6 encrypted keys will become unusable. Continue with master key deletion ? [yes/no]: yWhere to Go Next
Configure any other preshared keys.
Additional References
The following sections provide references related to Encrypted Preshared Key.
Related Documents
Configuring passwords
The section "Part 4: IP Security and Encryption" of the Cisco IOS Security Configuration Guide
Cisco IOS Security Command Reference, Release 12.3 T
Standards
MIBs
This feature has no new or modified MIBs.
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:
RFCs
Technical Assistance
Command Reference
This section documents new and modified commands. All other commands used with this feature are documented in the Cisco IOS Release 12.3 T command reference publications.
New Commands
•
Modified Commands
•
•
crypto ipsec client ezvpn (global)
To create a Cisco Easy VPN Remote configuration and enter the Cisco Easy VPN Remote configuration mode, use the crypto ipsec client ezvpn command in global configuration mode. To delete the Cisco Easy VPN Remote configuration, use the no form of this command.
crypto ipsec client ezvpn name
no crypto ipsec client ezvpn name
Note
Syntax Description
Defaults
Newly created Cisco Easy VPN Remote configurations default to the client mode.
Command Modes
Global configuration
Command History
Usage Guidelines
The crypto ipsec client ezvpn command creates a Cisco Easy VPN Remote configuration and then enters the Cisco Easy VPN Remote configuration mode, at which point you can enter the following subcommands:
•
–
–
•
•
•
Output for the group command will show that the preshared key is either encrypted or unencrypted. Output for an unencrypted key would be as follows:
group ez key key123Output for a type 6 encrypted key would be as follows:
group ez key 6 2GIS[FEoHPhROiBA/OgCi•
–
After specifying the local address used to source tunnel traffic, the IP address can be obtained in two ways:
–
–
•
–
–
•
•
Note
After configuring the Cisco Easy VPN Remote configuration, use the exit command to exit the Cisco Easy VPN Remote configuration mode and return to global configuration mode.
Note
Examples
The following example shows a Cisco Easy VPN Remote configuration named telecommuter-client being created on a Cisco uBR905 or Cisco uBR925 cable access router and being assigned to cable interface 0:
Router# configure terminalRouter(config)# crypto ipsec client ezvpn telecommuter-clientRouter(config-crypto-ezvpn)# group telecommute-group key secret-telecommute-keyRouter(config-crypto-ezvpn)# peer telecommuter-serverRouter(config-crypto-ezvpn)# mode clientRouter(config-crypto-ezvpn)# exitRouter(config)# interface c0Router(config-if)# crypto ezvpn telecommuter-clientRouter(config-if)# exit
Note
The following example shows the Cisco Easy VPN Remote configuration named telecommuter-client being removed from the interface and then deleted:
Router# configure terminalRouter(config)# interface e1Router(config-if)# no crypto ipsec client ezvpn telecommuter-clientRouter(config-if)# exitRouter(config)# no crypto ipsec client ezvpn telecommuter-clientRelated Commands
crypto ipsec client ezvpn (interface)
Assigns a Cisco Easy VPN Remote configuration to an interface.
crypto isakmp client configuration group
To specify to which group a policy profile will be defined, use the crypto isakmp client configuration group command in global configuration mode. To remove this command and all associated subcommands from your configuration, use the no form of this command.
crypto isakmp client configuration group {group-name | default}
no crypto isakmp client configuration group {group-name | default}
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
Use the crypto isakmp client configuration group command to specify group policy information that needs to be defined or changed. You may wish to change the group policy on your router if you decide to connect to the client using a group ID that does not match the group-name argument.
After enabling this command, which puts you in Internet Security Association Key Management Protocol (ISAKMP) group configuration mode, you can specify characteristics for the group policy using the following commands:
•
•
•
•
•
•
•
•
•
•
•
•
Output for the crypto isakmp client configuration group command (using the key subcommand) will show that the preshared key is either encrypted or unencrypted. An output example for an unencrypted preshared key would be as follows:
crypto isakmp client configuration group key testAn output example for a type 6 encrypted preshared key would be as follows:
crypto isakmp client configuration group
key 6 JK_JHZPeJV_XFZTKCQFYAABExamples
The following example shows how to define group policy information for Mode Configuration push. In this example, the first group name is "cisco" and the second group name is "default." Thus, the default policy will be enforced for all users who do not offer a group name that matches "cisco."
crypto isakmp client configuration group ciscokey ciscodns 2.2.2.2 2.2.2.3wins 6.6.6.6domain cisco.compool fredacl 199!crypto isakmp client configuration group defaultkey ciscodns 2.2.2.2 2.3.2.3pool fredacl 199Related Commands
crypto isakmp key
To configure a preshared authentication key, use the crypto isakmp key command in global configuration mode. To delete a preshared authentication key, use the no form of this command.
crypto isakmp key keystring {address peer-address [mask] | hostname hostname} [no-xauth]
no crypto isakmp key keystring {address peer-address [mask] | hostname hostname}
Syntax Description
Defaults
There is no default preshared authentication key.
Command Modes
Global configuration
Command History
Usage Guidelines
You must use this command to configure a key whenever you specify preshared keys in an Internet Key Exchange (IKE) policy; you must enable this command at both peers.
If an IKE policy includes preshared keys as the authentication method, these preshared keys must be configured at both peers—otherwise the policy cannot be used (the policy will not be submitted for matching by the IKE process). The crypto isakmp key command is the second task required to configure the preshared keys at the peers. (The first task is accomplished using the crypto isakmp identity command.)
Use the address keyword if the remote peer ISAKMP identity was set with its IP address.
With the address keyword, you can also use the mask argument to indicate the remote peer ISAKMP identity will be established using the preshared key only. If the mask argument is used, preshared keys are no longer restricted between two users.
Note
Preshared keys no longer work when the hostname keyword is sent as the identity; thus, the hostname keyword as the identity in preshared key authentication is no longer supported. According to the way preshared key authentication is designed in IKE main mode, the preshared keys must be based on the IP address of the peers. Although a user can still send the hostname as identity in preshared key authentication, the key is searched on the IP address of the peer; if the key is not found (based on the IP address), the negotiation will fail.
If crypto isakmp identity hostname is configured as identity, the preshared key must be configured with the peer's IP address for the process to work.
Use the no-xauth keyword to prevent the router from prompting the peer for Xauth information (username and password). This keyword disables Xauth for static IPSec peers. The no-xauth keyword should be enabled when configuring the preshared key for router-to-router IPSec—not VPN-client-to-Cisco-IOS IPSec.
Output for the crypto isakmp key command will show that the preshared key is either encrypted or unencrypted. An output example for an unencrypted preshared key would be as follows:
crypto isakmp key test123 address 10.1.0.1An output example for a type 6 encrypted preshared key would be as follows:
crypto isakmp key 6 RHZE[JACMUI\bcbTdELISAAB address 10.1.0.1Examples
In the following example, the remote peer "RemoteRouter" specifies an ISAKMP identity by address:
crypto isakmp identity addressNow, the preshared key must be specified at each peer.
In the following example, the local peer specifies the preshared key and designates the remote peer by its IP address and a mask:
crypto isakmp key sharedkeystring address 172.21.230.33 255.255.255.255Related Commands
key config-key password-encryption
To store a type 6 encryption key in private NVRAM, use the key config-key password-encryption command in global configuration mode. To disable the encryption, use the no form of this command.
key config-key password-encryption [text]
no key config-key password-encryption [text]
Syntax Description
Defaults
No type 6 password encryption
Command Modes
Global configuration
Command History
Usage Guidelines
You can securely store plain text passwords in type 6 format in NVRAM using a command-line interface (CLI). Type 6 passwords are encrypted. Although the encrypted passwords can be seen or retrieved, it is difficult to decrypt them to find out the actual password. Use the key config-key password-encryption command with the password encryption aes command to configure and enable the password (symmetric cipher Advanced Encryption Standard [AES] is used to encrypt the keys). The password (key) configured using the config-key password-encryption command is the master encryption key that is used to encrypt all other keys in the router.
If you configure the password encryption aes command without configuring the key config-key password-encryption command, the following message is printed at startup or during any nonvolatile generation (NVGEN) process, such as when the show running-config or copy running-config startup-config commands have been configured:
"Can not encrypt password. Please configure a configuration-key with `key config-key'"Changing a Password
If the password (master key) is changed, or reencrypted, using the key config-key password-encryption command), the list registry passes the old key and the new key to the application modules that are using type 6 encryption.
Deleting a Password
If the master key that was configured using the key config-key password-encryption command is deleted from the system, a warning is printed (and a confirm prompt is issued) that states that all type 6 passwords will become useless. As a security measure, after the passwords have been encrypted, they will never be decrypted in the Cisco IOS software. However, passwords can be reencrypted as explained in the previous paragraph.
Caution
Unconfiguring Password Encryption
If you later unconfigure password encryption using the no password encryption aes command, all existing type 6 passwords are left unchanged, and as long as the password (master key) that was configured using the key config-key password-encryption command exists, the type 6 passwords will be decrypted as and when required by the application.
Storing Passwords
Because no one can "read" the password (configured using the key config-key password-encryption command), there is no way that the password can be retrieved from the router. Existing management stations cannot "know" what it is unless the stations are enhanced to include this key somewhere, in which case the password needs to be stored securely within the management system. If configurations are stored using TFTP, the configurations are not standalone, meaning that they cannot be loaded onto a router. Before or after the configurations are loaded onto a router, the password must be manually added (using the key config-key password-encryption command). The password can be manually added to the stored configuration but is not recommended because adding the password manually allows anyone to decrypt all passwords in that configuration.
Configuring New or Unknown Passwords
If you enter or cut and paste cipher text that does not match the master key, or if there is no master key, the cipher text is accepted or saved, but an alert message is printed. The alert message is as follows:
"ciphertext>[for username bar>] is incompatible with the configured master key."If a new master key is configured, all the plain keys are encrypted and made type 6 keys. The existing type 6 keys are not encrypted. The existing type 6 keys are left as is.
If the old master key is lost or unknown, you have the option of deleting the master key using the no key config-key password-encryption command. Deleting the master key using the no key config-key password-encryption command causes the existing encrypted passwords to remain encrypted in the router configuration. The passwords will not be decrypted.
Examples
The following example shows that a type 6 encryption key is to be stored in NVRAM:
Router (config)# key config-key password-encryptionRelated Commands
password encryption aes
Enables a type 6 encrypted preshared key.
password logging
Provides a log of debugging output for a type 6 password operation.
password encryption aes
To enable a type 6 encrypted preshared key, use the password encryption aes command in global configuration mode. To disable password encryption, use the no form of this command.
password encryption aes
no password encryption aes
Syntax Description
This command has no arguments or keywords.
Defaults
Preshared keys are not encrypted.
Command Modes
Global configuration
Command History
Usage Guidelines
You can securely store plain text passwords in type 6 format in NVRAM using a command-line interface (CLI). Type 6 passwords are encrypted. Although the encrypted passwords can be seen or retrieved, it is difficult to decrypt them to find out the actual password. Use the key config-key password-encryption command with the password encryption aes command to configure and enable the password (symmetric cipher Advanced Encryption Standard [AES] is used to encrypt the keys). The password (key) configured using the config-key password-encryption command is the master encryption key that is used to encrypt all other keys in the router.
If you configure the password encryption aes command without configuring the key config-key password-encryption command, the following message is printed at startup or during any nonvolatile generation (NVGEN) process, such as when the show running-config or copy running-config startup-config commands have been configured:
"Can not encrypt password. Please configure a configuration-key with `key config-key'"
Note
Changing a Password
If the password (master key) is changed, or reencrypted, using the key config-key password-encryption command), the list registry passes the old key and the new key to the application modules that are using type 6 encryption.
Deleting a Password
If the master key that was configured using the key config-key password-encryption command is deleted from the system, a warning is printed (and a confirm prompt is issued) that states that all type 6 passwords will become useless. As a security measure, after the passwords have been encrypted, they will never be decrypted in the Cisco IOS software. However, passwords can be reencrypted as explained in the previous paragraph.
Caution
Unconfiguring Password Encryption
If you later unconfigure password encryption using the no password encryption aes command, all existing type 6 passwords are left unchanged, and as long as the password (master key) that was configured using the key config-key password-encryption command exists, the type 6 passwords will be decrypted as and when required by the application.
Storing Passwords
Because no one can "read" the password (configured using the key config-key password-encryption command), there is no way that the password can be retrieved from the router. Existing management stations cannot "know" what it is unless the stations are enhanced to include this key somewhere, in which case the password needs to be stored securely within the management system. If configurations are stored using TFTP, the configurations are not standalone, meaning that they cannot be loaded onto a router. Before or after the configurations are loaded onto a router, the password must be manually added (using the key config-key password-encryption command). The password can be manually added to the stored configuration but is not recommended because adding the password manually allows anyone to decrypt all passwords in that configuration.
Configuring New or Unknown Passwords
If you enter or cut and paste cipher text that does not match the master key, or if there is no master key, the cipher text is accepted or saved, but an alert message is printed. The alert message is as follows:
"ciphertext>[for username bar>] is incompatible with the configured master key."If a new master key is configured, all the plain keys are encrypted and made type 6 keys. The existing type 6 keys are not encrypted. The existing type 6 keys are left as is.
If the old master key is lost or unknown, you have the option of deleting the master key using the no key config-key password-encryption command. Deleting the master key using the no key config-key password-encryption command causes the existing encrypted passwords to remain encrypted in the router configuration. The passwords will not be decrypted.
Examples
The following example shows that a type 6 encrypted preshared key has been enabled:
Router (config)# password encryption aesRelated Commands
key config-key password-encryption
Stores a type 6 encryption key in private NVRAM.
password logging
Provides a log of debugging output for a type 6 password operation.
password logging
To get a log of debugging output for a type 6 password operation, use the password logging command in privileged EXEC mode. To disable the debugging, use the no form of this command.
password logging
no password logging
Syntax Description
This command has no arguments or keywords.
Defaults
Debug logging is not enabled.
Command Modes
Privileged EXEC
Command History
Examples
The following example shows that debug logging is configured:
Router# password loggingRelated Commands
key config-key password-encryption
Stores an encryption key in private NVRAM.
password encryption aes
Enables a type 6 encrypted preshared key.
pre-shared-key
To define a preshared key to be used for Internet Key Exchange (IKE) authentication, use the pre-shared-key command in keyring configuration mode. To disable the preshared key, use the no form of this command.
pre-shared-key {address address [mask] | hostname hostname} key key
no pre-shared-key {address address [mask] | hostname hostname} key key
Syntax Description
Defaults
No default behaviors or values
Command Modes
Keyring configuration
Command History
Usage Guidelines
Before configuring preshared keys, you must configure an Internet Security Association and Key Management Protocol (ISAKMP) profile.
Output for the pre-shared-key command will show that the preshared key is either unencrypted or encrypted. An output example for an unencrypted preshared key would be as follows:
pre-shared-key address 10.1.0.1 key test123An output example for a type 6 encrypted preshared key would be as follows:
pre-shared-key address 10.1.0.1 key 6 RHZE[JACMUI\bcbTdELISAAB
Examples
The following example shows how to configure a preshared key using an IP address and host name:
Router (config)# crypto keyring vpnkeyringRouter (config-keyring)# pre-shared-key address 10.72.23.11 key vpnkeyRouter (config-keyring)# pre-shared-key hostname www.vpn.com key vpnkeyset aggressive-mode password
To specify the Tunnel-Password attribute within an Internet Security Association Key Management Protocol (ISAKMP) peer configuration, use the set aggressive-mode password command in ISAKMP policy configuration mode. To remove this attribute from your configuration, use the no form of this command.
set aggressive-mode password password
no set aggressive-mode password password
Syntax Description
password
Password that is used to authenticate the peer to a remote server. The tunnel password is used as the Internet Key Exchange (IKE) preshared key.
Defaults
The Tunnel-Password attribute is not defined.
Command Modes
ISAKMP policy configuration
Command History
12.2(8)T
This command was introduced.
12.3(2)T
This command was modified so that output for this command will show that the preshared key is either encrypted or unencrypted.
Usage Guidelines
Before you can use this command, you must enable the crypto isakmp peer command.
To initiate an IKE aggressive mode negotiation, the set aggressive-mode password command, along with the set aggressive-mode client-endpoint command, must be configured in the ISAKMP peer policy. The Tunnel-Password attribute will be used as the IKE preshared key for the aggressive mode negotiation.
Output for the set aggressive-mode password command will show that the preshared key is either unencrypted or encrypted. An output example for an unencrypted preshared key would be as follows:
set aggressive-mode password test123An output example for a type 6 encrypted preshared key would be as follows:
set aggressive-mode password 6 DV'P[aTVWWbcgKU]T\T\QhZAAB
Examples
The following example shows how to initiate aggressive mode using RADIUS tunnel attributes:
Router (config)# crypto isakmp peer address 10.4.4.1Router (config-isakmp-peer)# set aggressive-mode client-endpoint user-fqdn user@cisco.comRouter (config-isakmp-peer)# set aggressive-mode password cisco123
Related Commands
Copyright © 2003 Cisco Systems, Inc. All rights reserved.
