Table Of Contents

crypto key decrypt rsa

crypto key encrypt rsa

crypto key export pem

crypto key generate rsa

crypto key import pem

crypto key lock rsa

crypto key pubkey-chain rsa

crypto key unlock rsa

crypto key zeroize rsa

crypto keyring

crypto map (global IPSec)

crypto map (interface IPSec)

crypto map client authentication list

crypto map client configuration address

crypto map isakmp authorization list

crypto map isakmp-profile

crypto map local-address

crypto map redundancy replay-interval

crypto mib ipsec flowmib history failure size

crypto mib ipsec flowmib history tunnel size

crypto pki authenticate

crypto pki cert validate

crypto pki certificate chain

crypto pki certificate map

crypto pki certificate query (ca-trustpoint)

crypto pki crl request

crypto pki enroll

crypto pki export pem

crypto pki export pkcs12

crypto pki import

crypto pki import pem

crypto pki import pkcs12

crypto pki profile enrollment

crypto pki server

crypto pki server grant

crypto pki server info crl

crypto pki server info requests

crypto pki server password generate

crypto pki server reject

crypto pki server remove

crypto pki server request pkcs10

crypto pki server revoke

crypto pki trustpoint

crypto provisioning petitioner

crypto provisioning registrar

crypto wui tti petitioner

crypto wui tti registrar

ctype

crypto key decrypt rsa

To delete the encrypted RSA key and leave only the unencrypted key on the running router, use the crypto key decrypt rsa command in global configuration mode.

crypto key decrypt [write] rsa [name key-name] passphrase passphrase

Syntax Description

write	(Optional) Clear text (unencrypted) key is immediately written to NvRAM. If the write keyword is not issued, the configuration must be manually written to NvRAM; otherwise, the key will remain encrypted the next time the router is reloaded.
name key-name	(Optional) Name of the RSA key pair that is to be decrypted.
passphrase passphrase	Passphrase that is used to decrypt the RSA key. The passphrase must match the passphrase that was specified via the crypto key encrypt rsa command.

Defaults

The private key running on the router is encrypted.

Command Modes

Global configuration

Command History

Release	Modification
12.3(7)T	This command was introduced.

Usage Guidelines

Use the crypto key decrypt rsa command to store the decrypted private key in NvRAM the next time NvRAM is written (which is immediately if the write keyword is issed).

Examples

The following example shows how to decrypt the RSA key "pki1-72a.cisco.com":

Router(config)# crypto key decrypt write rsa name pki1-72a.cisco.com passphrase cisco1234

Related Commands

Command	Description
crypto key encrypt rsa	Encrypts the RSA private key.
show crypto key mypubkey rsa	Displays the RSA public keys of your router.

crypto key encrypt rsa

To encrypt the RSA private key, use the crypto key encrypt rsa command in global configuration mode.

crypto key encrypt [write] rsa [name key-name] passphrase passphrase

Syntax Description

write	(Optional) Router configuration is immediately written to NVRAM. If the write keyword is not issued, the configuration must be manually written to NvRAM; otherwise, the encrypted key will be lost next time the router is reloaded.
name key-name	(Optional) Name of the RSA key pair that is to be encrypted. If a key name is not specified, the default key name, routername.domainname, is used.
passphrase passphrase	Passphrase that is used to encrypt the RSA key. To access the RSA key pair, the passphrase must be specified.

Defaults

RSA keys are not encrypted.

Command Modes

Global configuration

Command History

Release	Modification
12.3(7)T	This command was introduced.

Usage Guidelines

The private key is encrypted (protected) via the specified passphrase. After the key is protected, it may continue to be used by the router; that is Internet Key Exchange (IKE) tunnels and encrypted key export attempts should continue to work because the key remains "unlocked."

To lock the key, which can be used to disable the router, issue the crypto key lock rsa privileged EXEC command. (When you lock the encrypted key, all functions which use the locked key are disabled.)

Examples

The following example shows how to encrypt the RSA key "pki1-72a.cisco.com." Thereafter, the show crypto key mypubkey rsa command is issued to verify that the RSA key is encrypted and unlocked.

Router(config)# crypto key encrypt rsa name pki1-72a.cisco.com passphrase cisco1234

Router(config)# exit

Router# show crypto key mypubkey rsa

% Key pair was generated at:00:15:32 GMT Jun 25 2003

Key name:pki1-72a.cisco.com

Usage:General Purpose Key

*** The key is protected and UNLOCKED. ***

Key is not exportable.

Key Data:

305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00E0CC9A 1D23B52C

CD00910C ABD392AE BA6D0E3F FC47A0EF 8AFEE340 0EC1E62B D40E7DCC

23C4D09E

03018B98 E0C07B42 3CFD1A32 2A3A13C0 1FF919C5 8DE9565F 1F020301 0001

% Key pair was generated at:00:15:33 GMT Jun 25 2003

Key name:pki1-72a.cisco.com.server

Usage:Encryption Key

Key is exportable.

Key Data:

307C300D 06092A86 4886F70D 01010105 00036B00 30680261 00D3491E 2A21D383

854D7DA8 58AFBDAC 4E11A7DD E6C40AC6 66473A9F 0C845120 7C0C6EC8 1FFF5757

3A41CE04 FDCB40A4 B9C68B4F BC7D624B 470339A3 DE739D3E F7DDB549 91CD4DA4

DF190D26 7033958C 8A61787B D40D28B8 29BCD0ED 4E6275C0 6D020301 0001

Router#

Related Commands

Command	Description
crypto key decrypt rsa	Deletes the encrypted RSA key and leaves only the unencrypted key on the running router.
crypto key lock rsa	Locks the RSA private key in a router.
show crypto key mypubkey rsa	Displays the RSA public keys of your router.

crypto key export pem

To export Rivest, Shamir, and Adelman (RSA) keys in privacy-enhanced mail (PEM)-formatted files, use the crypto key export pem command in global configuration mode.

crypto key export rsa key-label pem {terminal | url url} {3des | des} passphrase

Syntax Description

rsa key-label	Name of the RSA key pair that will be exported. The key-label argument must match the key pair name that was specified via the crypto key generate rsa command.
terminal	RSA key pair will be displayed in PEM format on the console terminal.
url url	URL of the file system where your router should export the RSA key pair.
3des	Export the RSA key pair using the Triple Data Encryption Standard (3DES) encryption algorithm.
des	Export the RSA key pair using the DES encryption algorithm.
passphrase	Passphrase that is used to encrypt the PEM file for import. Note The passphrase can be any phrase that is at least eight characters in length; it can include spaces and punctuation, excluding the question mark (?), which has special meaning to the Cisco IOS parser.

Defaults

No default behavior or values

Command Modes

Global configuration

Command History

Release	Modification
12.3(4)T	This command was introduced.

Usage Guidelines

The crypto key export pem command allows you to export RSA key pairs in PEM-formatted files. The PEM files can then be imported back into a Cisco IOS router or other public key infrastructure (PKI) applications.

---

Note Before you can export a RSA key pair in a PEM file, ensure that the RSA key pair is exportable. To generate an exportable RSA key pair, issue the crypto key generate rsa command and specify the exportable keyword.

---

Examples

The following example shows how to generate, export, bring the key back (import), and verify the status of the RSA key pair "mycs":

! Generate the key pair 

!

Router(config)# crypto key generate rsa general-purpose label mycs exportable 

The name for the keys will be: mycs

Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose 
Keys. Choosing a key modulus greater than 512 may take a few minutes.

How many bits in the modulus [512]: 1024

% Generating 1024 bit RSA keys ...[OK]

!

! Archive the key pair to a remote location, and use a good password.

!

Router(config)# crypto key export rsa mycs pem url nvram: 3des PASSWORD

% Key name: mycs

Usage: General Purpose Key

Exporting public key...

Destination filename [mycs.pub]? 

Writing file to nvram:mycs.pub

Exporting private key...

Destination filename [mycs.prv]? 

Writing file to nvram:mycs.prv

!

! Import the key as a different name.

!

Router(config)# crypto key import rsa mycs2 pem url nvram:mycs PASSWORD

% Importing public key or certificate PEM file...

Source filename [mycs.pub]? 

Reading file from nvram:mycs.pub

% Importing private key PEM file...

Source filename [mycs.prv]? 

Reading file from nvram:mycs.prv% Key pair import succeeded.

!

! After the key has been imported, it is no longer exportable.

!

! Verify the status of the key.

!

Router# show crypto key mypubkey rsa

% Key pair was generated at: 18:04:56 GMT Jun 6 2003

Key name: mycs

Usage: General Purpose Key

Key is exportable.

Key Data:

  30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00E65253 

  9C30C12E 295AB73F B1DF9FAD 86F88192 7D4FA4D2 8BA7FB49 9045BAB9 373A31CB 

  A6B1B8F4 329F2E7E 8A50997E AADBCFAA 23C29E19 C45F4F05 DBB2FA51 4B7E9F79 

  A1095115 759D6BC3 5DFB5D7F BCF655BF 6317DB12 A8287795 7D8DC6A3 D31B2486 

  C9C96D2C 2F70B50D 3B4CDDAE F661041A 445AE11D 002EEF08 F2A627A0 5B020301 0001

% Key pair was generated at: 18:17:25 GMT Jun 6 2003

Key name: mycs2

Usage: General Purpose Key

Key is not exportable.

Key Data:

  30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00E65253 

  9C30C12E 295AB73F B1DF9FAD 86F88192 7D4FA4D2 8BA7FB49 9045BAB9 373A31CB 

  A6B1B8F4 329F2E7E 8A50997E AADBCFAA 23C29E19 C45F4F05 DBB2FA51 4B7E9F79 

  A1095115 759D6BC3 5DFB5D7F BCF655BF 6317DB12 A8287795 7D8DC6A3 D31B2486 

  C9C96D2C 2F70B50D 3B4CDDAE F661041A 445AE11D 002EEF08 F2A627A0 5B020301 0001

Related Commands

Command	Description
crypto key generate rsa	Generates RSA key pairs.
crypto key import pem	Imports RSA keys in PEM-formatted files.

crypto key generate rsa

To generate Rivest, Shamir, and Adelman (RSA) key pairs, use the crypto key generate rsa command in global configuration mode.

crypto key generate rsa [general-keys | usage-keys | signature | encryption] [label key-label] [exportable] [modulus modulus-size] [storage devicename:] [on devicename:]

Syntax Description

general-keys	(Optional) Specifies that a general-purpose key pair will be generated, which is the default.
usage-keys	(Optional) Specifies that two RSA special-usage key pairs, one encryption pair and one signature pair, will be generated.
signature	(Optional) Specifies that the RSA public key generated will be a signature special usage key.
encryption	(Optional) Specifies that the RSA public key generated will be an encryption special usage key.
label key-label	(Optional) Name that is used for an RSA key pair when they are being exported. If a key label is not specified, the fully qualified domain name (FQDN) of the router is used.
exportable	(Optional) Specifies that the RSA key pair can be exported to another Cisco device, such as a router.
modulus modulus-size	(Optional) Specifies the IP size of the key modulus. By default, the modulus of a CA key is 1024 bits. The recommended modulus for a CA key is 2048 bits. The range of a CA key modulus is from 350 to 2048 bits. If you do not enter the modulus keyword and specify a key size, you will be prompted.
storage devicename:	(Optional) Specifies the key storage location. The name of the storage device is followed by a colon (:).
on devicename:	(Optional) Specifies that the RSA key pair will be created on the specified device, including a USB token, local disk, or NVRAM. The name of the device is followed by a colon (:). Keys created on a USB token have a maximum size of 1024 bits.

Command Default

RSA key pairs do not exist.

Command Modes

Global configuration

Command History

Release	Modification
11.3	This command was introduced.
12.2(8)T	The key-label argument was added.
12.2(15)T	The exportable keyword was added.
12.2(18)SXD	This command was integrated into Cisco IOS Release 12.2(18)SXD.
12.4(4)T	The storage keyword and devicename: argument were added.
12.2(33)SRA	This command was integrated into Cisco IOS Release 12.2(33)SRA.
12.4(11)T	The storage keyword and devicename: argument were implemented on the Cisco 7200VXR NPE-G2 platform. The signature, encryption and on keywords and devicename: argument were added.

Usage Guidelines

Use this command to generate RSA key pairs for your Cisco device (such as a router).

RSA keys are generated in pairs—one public RSA key and one private RSA key.

If your router already has RSA keys when you issue this command, you will be warned and prompted to replace the existing keys with new keys.

---

Note Before issuing this command, ensure that your router has a hostname and IP domain name configured (with the hostname and ip domain-name commands). You will be unable to complete the crypto key generate rsa command without a hostname and IP domain name. (This situation is not true when you only generate a named key pair.)

---

---

Note Secure Shell (SSH) may generate an additional RSA key pair if you generate a key pair on a router having no RSA keys. The additional key pair is used only by SSH and will have a name such as {router_FQDN}.server. For example, if a router name is "router1.cisco.com," the key name is "router1.cisco.com.server."

---

This command is not saved in the router configuration; however, the RSA keys generated by this command are saved in the private configuration in NVRAM (which is never displayed to the user or backed up to another device) the next time the configuration is written to NVRAM.

---

Note If the configuration is not saved to NVRAM, the generated keys are lost on the next reload of the router.

---

There are two mutually exclusive types of RSA key pairs: special-usage keys and general-purpose keys. When you generate RSA key pairs, you will be prompted to select either special-usage keys or general-purpose keys.

Special-Usage Keys

If you generate special-usage keys, two pairs of RSA keys will be generated. One pair will be used with any Internet Key Exchange (IKE) policy that specifies RSA signatures as the authentication method, and the other pair will be used with any IKE policy that specifies RSA encrypted keys as the authentication method.

A certification authority (CA) is used only with IKE policies specifying RSA signatures, not with IKE policies specifying RSA-encrypted nonces. (However, you could specify more than one IKE policy and have RSA signatures specified in one policy and RSA-encrypted nonces in another policy.)

If you plan to have both types of RSA authentication methods in your IKE policies, you may prefer to generate special-usage keys. With special-usage keys, each key is not unnecessarily exposed. (Without special-usage keys, one key is used for both authentication methods, increasing the exposure of that key.)

General-Purpose Keys

If you generate general-purpose keys, only one pair of RSA keys will be generated. This pair will be used with IKE policies specifying either RSA signatures or RSA encrypted keys. Therefore, a general-purpose key pair might get used more frequently than a special-usage key pair.

Named Key Pairs

If you generate a named key pair using the key-pair-label argument, you must also specify the usage-keys keyword or the general-keys keyword. Named key pairs allow you to have multiple RSA key pairs, enabling the Cisco IOS software to maintain a different key pair for each identity certificate.

Modulus Length

When you generate RSA keys, you will be prompted to enter a modulus length. The longer the modulus, the stronger the security. However a longer modules takes longer to generate (see Table 18 for sample times) and takes longer to use.

Cisco IOS software does not support a modulus greater than 4096 bits. A length of less than 512 bits is normally not recommended. In certain situations, the shorter modulus may not function properly with IKE, so we recommend using a minimum modulus of 1024 bits.

---

Note As of Cisco IOS Release 12.4(11)T, peer public RSA key modulus values up to 4096 bits are automatically supported.

The largest private RSA key modulus is 2048 bits. Therefore, the largest RSA private key a router may generate or import is 2048 bits.

The recommended modulus for a CA is 2048 bits; the recommended modulus for a client is 1024 bits.

---

Table 18 Sample Times by Modulus Length to Generate RSA Keys

Router	360 bits	512 bits	1024 bits	2048 bits (maximum)
Cisco 2500	11 seconds	20 seconds	4 minutes, 38 seconds	more than 1 hour
Cisco 4700	less than 1 second	1 second	4 seconds	50 seconds

Specifying a Storage Location for RSA Keys

When you issue the crypto key generate rsa command with the storage devicename: keyword and argument, the RSA keys will be stored on the specified device. This location will supersede any crypto key storage command settings.

Specifying a Device for RSA Key Generation

As of Cisco IOS Release 12.4(11)T and later releases, you may specify the device where RSA keys are generated. Devices supported include NVRAM, local disks, and USB tokens. If your router has a USB token configured and available, the USB token can be used as cryptographic device in addition to a storage device. Using a USB token as a cryptographic device allows RSA operations such as key generation, signing, and authentication of credentials to be performed on the token. The private key never leaves the USB token and is not exportable. The public key is exportable.

RSA keys may be generated on a configured and available USB token, by the use of the on devicename: keyword and argument. Keys that reside on a USB token are saved to persistent token storage when they are generated. The number of keys that can be generated on a USB token is limited by the space available. If you attempt to generate keys on a USB token and it is full you will receive the following message:

% Error in generating keys:no available resources 

Key deletion will remove the keys stored on the token from persistent storage immediately. (Keys that do not reside on a token are saved to or deleted from non-token storage locations when the write memory or similar command is issued.)

For information on configuring a USB token, see "Storing PKI Credentials" chapter in the Cisco IOS Security Configuration Guide, Release 12.4T. For information on using on-token RSA credentials, see "Configuring and Managing a Cisco IOS Certificate Server for PKI Deployment chapter in the Cisco IOS Security Configuration Guide, Release 12.4T.

Examples

The following example generates a general usage 1024-bit RSA key pair on a USB token with the label "ms2" with crypto engine debugging messages shown:

Router(config)# crypto key generate rsa on usbtoken0 label ms2 modulus 1024

The name for the keys will be: ms2 

% The key modulus size is 1024 bits 

% Generating 1024 bit RSA keys, keys will be on-token, non-exportable... 

Jan 7 02:41:40.895: crypto_engine: Generate public/private keypair [OK] 

Jan 7 02:44:09.623: crypto_engine: Create signature 

Jan 7 02:44:10.467: crypto_engine: Verify signature 

Jan 7 02:44:10.467: CryptoEngine0: CRYPTO_ISA_RSA_CREATE_PUBKEY(hw)(ipsec) 

Jan 7 02:44:10.467: CryptoEngine0: CRYPTO_ISA_RSA_PUB_DECRYPT(hw)(ipsec) 

Now, the on-token keys labeled "ms2" may be used for enrollment.

The following example generates special-usage RSA keys:

Router(config)# crypto key generate rsa usage-keys

The name for the keys will be: myrouter.example.com

Choose the size of the key modulus in the range of 360 to 2048 for your Signature Keys. 
Choosing a key modulus greater than 512 may take a few minutes.

How many bits in the modulus[512]? <return>

Generating RSA keys.... [OK].

Choose the size of the key modulus in the range of 360 to 2048 for your Encryption Keys. 
Choosing a key modulus greater than 512 may take a few minutes.

How many bits in the modulus[512]? <return>

Generating RSA keys.... [OK].

The following example generates general-purpose RSA keys:

---

Note You cannot generate both special-usage and general-purpose keys; you can generate only one or the other.

---

Router(config)# crypto key generate rsa general-keys

The name for the keys will be: myrouter.example.com

Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose 
Keys. Choosing a key modulus greater than 512 may take a few minutes.

How many bits in the modulus[512]? <return>

Generating RSA keys.... [OK].

The following example generates the general purpose RSA key pair "exampleCAkeys":

crypto key generate rsa general-keys exampleCAkeys

crypto ca trustpoint exampleCAkeys

 enroll url http://exampleCAkeys/certsrv/mscep/mscep.dll

 rsakeypair exampleCAkeys 1024 1024

The following example specifies the RSA key storage location of "usbtoken0:" for "tokenkey1":

crypto key generate rsa general-keys label tokenkey1 storage usbtoken0:

Related Commands

Command	Description
crypto key storage	Sets the default storage location for RSA key pairs.
debug crypto engine	Displays debug messages about crypto engines.
hostname	Specifies or modifies the hostname for the network server.
ip domain-name	Defines a default domain name to complete unqualified hostnames (names without a dotted-decimal domain name).
show crypto key mypubkey rsa	Displays the RSA public keys of your router.
show crypto pki certificates	Displays information about your PKI certificate, certification authority, and any registration authority certificates.

crypto key import pem

To import Rivest, Shamir, and Adelman (RSA) keys in privacy-enhanced mail (PEM)-formatted files, use the crypto key import pem command in global configuration mode.

crypto key import rsa key-label pem [usage-keys] {terminal | url url} [exportable] passphrase

Syntax Description

rsa key-label	Name of the RSA key pair that will be imported. The key-label argument must match the key pair name that was specified via the crypto key generate rsa command.
usage-keys	(Optional) Specifies that two RSA special usage key pairs will be imported (that is, one encryption pair and one signature pair), instead of one general-purpose key pair.
terminal	Certificates and RSA key pairs will be manually imported to the console terminal.
url url	URL of the file system where your router should import certificates and RSA key pairs.
exportable	(Optional) Specifies that imported RSA key pair can be exported again to another Cisco device such as a router.
passphrase	Passphrase that is used to encrypt the PEM file for import. Note The passphrase can be any phrase that is at least eight characters in length; it can include spaces and punctuation, excluding the question mark (?), which has special meaning to the Cisco IOS parser.

Defaults

No default behavior or values

Command Modes

Global configuration

Command History

Release	Modification
12.3(4)T	This command was introduced.

Usage Guidelines

The crypto key import pem command allows you to import RSA key pairs in PEM-formatted files. The files can be previously exported from another Cisco IOS router or generated by other public key infrastructure (PKI) applications.

Examples

The following example shows how to generate, export, bring the key back (import), and verify the status of the RSA key pair "mycs":

! Generate the key pair 

!

Router(config)# crypto key generate rsa general-purpose label mycs exportable 

The name for the keys will be: mycs

Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose 
Keys. Choosing a key modulus greater than 512 may take a few minutes.

How many bits in the modulus [512]: 1024

% Generating 1024 bit RSA keys ...[OK]

!

! Archive the key pair to a remote location, and use a good password.

!

Router(config)# crypto key export rsa mycs pem url nvram: 3des PASSWORD

% Key name: mycs

Usage: General Purpose Key

Exporting public key...

Destination filename [mycs.pub]? 

Writing file to nvram:mycs.pub

Exporting private key...

Destination filename [mycs.prv]? 

Writing file to nvram:mycs.prv

!

! Import the key as a different name.

!

Router(config)# crypto key import rsa mycs2 pem url nvram:mycs PASSWORD

% Importing public key or certificate PEM file...

Source filename [mycs.pub]? 

Reading file from nvram:mycs.pub

% Importing private key PEM file...

Source filename [mycs.prv]? 

Reading file from nvram:mycs.prv% Key pair import succeeded.

!

! After the key has been imported, it is no longer exportable.

!

! Verify the status of the key.

!

Router# show crypto key mypubkey rsa

% Key pair was generated at: 18:04:56 GMT Jun 6 2003

Key name: mycs

Usage: General Purpose Key

Key is exportable.

Key Data:

  30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00E65253 

  9C30C12E 295AB73F B1DF9FAD 86F88192 7D4FA4D2 8BA7FB49 9045BAB9 373A31CB 

  A6B1B8F4 329F2E7E 8A50997E AADBCFAA 23C29E19 C45F4F05 DBB2FA51 4B7E9F79 

  A1095115 759D6BC3 5DFB5D7F BCF655BF 6317DB12 A8287795 7D8DC6A3 D31B2486 

  C9C96D2C 2F70B50D 3B4CDDAE F661041A 445AE11D 002EEF08 F2A627A0 5B020301 0001

% Key pair was generated at: 18:17:25 GMT Jun 6 2003

Key name: mycs2

Usage: General Purpose Key

Key is not exportable.

Key Data:

  30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00E65253 

  9C30C12E 295AB73F B1DF9FAD 86F88192 7D4FA4D2 8BA7FB49 9045BAB9 373A31CB 

  A6B1B8F4 329F2E7E 8A50997E AADBCFAA 23C29E19 C45F4F05 DBB2FA51 4B7E9F79 

  A1095115 759D6BC3 5DFB5D7F BCF655BF 6317DB12 A8287795 7D8DC6A3 D31B2486 

  C9C96D2C 2F70B50D 3B4CDDAE F661041A 445AE11D 002EEF08 F2A627A0 5B020301 0001

Related Commands

Command	Description
crypto key export pem	Exports RSA keys in PEM-formatted files.
crypto key generate rsa	Generates RSA key pairs.

crypto key lock rsa

To lock the RSA private key in a router, use the crypto key lock rsa command in privileged EXEC mode.

crypto key lock rsa [name key-name] passphrase passphrase

Syntax Description

name key-name	(Optional) Name of the RSA key pair that is to be locked. The name must match the name that was specified via the crypto key encrypt rsa command.
passphrase passphrase	Passphrase that is used to lock the RSA key. The passphrase must match the passphrase that was specified via the crypto key encrypt rsa command.

Defaults

RSA keys are encrypted, but not locked.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.3(7)T	This command was introduced.

Usage Guidelines

When the crypto key lock rsa command is issued, the unencrypted copy of the key is deleted. Because the private key is not available, all RSA operations will fail.

This command affects only the "run-time" access to the key; that is, it does not affect the key that is stored in NVRAM.

Examples

The following example shows how to lock the key "pki1-72a.cisco.com." Thereafter, the show crypto key mypubkey rsa command is issued to verify that the key is protected (encrypted) and locked.

Router# crypto key lock rsa name pki1-72a.cisco.com passphrase cisco1234

! 

Router# show crypto key mypubkey rsa

% Key pair was generated at:20:29:41 GMT Jun 20 2003

Key name:pki1-72a.cisco.com

Usage:General Purpose Key

*** The key is protected and LOCKED. ***

Key is exportable.

Key Data:

305C300D 06092A86 4886F70D 01010105 00034B00 30480241 00D7808D C5FF14AC

0D2B55AC 5D199F2F 7CB4B355 C555E07B 6D0DECBE 4519B1F0 75B12D6F 902D6E9F

B6FDAD8D 654EF851 5701D5D7 EDA047ED 9A2A619D 5639DF18 EB020301 0001

Related Commands

Command	Description
crypto key encrypt rsa	Encrypts the RSA private key.
crypto key unlock rsa	Unlocks the RSA private key in a router.
show crypto key mypubkey rsa	Displays the RSA public keys of your router.

crypto key pubkey-chain rsa

To enter public key configuration mode (so you can manually specify other devices' RSA public keys), use the crypto key pubkey-chain rsa command in global configuration mode.

crypto key pubkey-chain rsa

Syntax Description

This command has no arguments or keywords.

Defaults

No default behavior or values.

Command Modes

Global configuration

Command History

Release	Modification
11.3 T	This command was introduced.

Usage Guidelines

Use this command to enter public key chain configuration mode. Use this command when you need to manually specify other IPSec peers' RSA public keys. You need to specify other peers' keys when you configure RSA encrypted nonces as the authentication method in an Internet Key Exchange policy at your peer router.

Examples

The following example specifies the RSA public keys of two other IPSec peers. The remote peers use their IP address as their identity.

Router(config)# crypto key pubkey-chain rsa

Router(config-pubkey-chain)# addressed-key 10.5.5.1

Router(config-pubkey-key)# key-string

Router(config-pubkey)# 00302017 4A7D385B 1234EF29 335FC973

Router(config-pubkey)# 2DD50A37 C4F4B0FD 9DADE748 429618D5

Router(config-pubkey)# 18242BA3 2EDFBDD3 4296142A DDF7D3D8

Router(config-pubkey)# 08407685 2F2190A0 0B43F1BD 9A8A26DB

Router(config-pubkey)# 07953829 791FCDE9 A98420F0 6A82045B

Router(config-pubkey)# 90288A26 DBC64468 7789F76E EE21

Router(config-pubkey)# quit

Router(config-pubkey-key)# exit

Router(config-pubkey-chain)# addressed-key 10.1.1.2

Router(config-pubkey-key)# key-string

Router(config-pubkey)# 0738BC7A 2BC3E9F0 679B00FE 53987BCC

Router(config-pubkey)# 01030201 42DD06AF E228D24C 458AD228

Router(config-pubkey)# 58BB5DDD F4836401 2A2D7163 219F882E

Router(config-pubkey)# 64CE69D4 B583748A 241BED0F 6E7F2F16

Router(config-pubkey)# 0DE0986E DF02031F 4B0B0912 F68200C4

Router(config-pubkey)# C625C389 0BFF3321 A2598935 C1B1

Router(config-pubkey)# quit

Router(config-pubkey-key)# exit

Router(config-pubkey-chain)# exit

Router(config)#

Related Commands

Command	Description
address	Specifies the IP address of the remote RSA public key of the remote peer you will manually configure.
addressed-key	Specifies the RSA public key of the peer you will manually configure.
key-string (IKE)	Specifies the RSA public key of a remote peer.
named-key	Specifies which peer RSA public key you will manually configure.
show crypto key pubkey-chain rsa	Displays peer RSA public keys stored on your router.

crypto key unlock rsa

To unlock the RSA private key in a router, use the crypto key unlock rsa command in privileged EXEC mode.

crypto key unlock rsa [name key-name] passphrase passphrase

Syntax Description

name key-name	(Optional) Name of the RSA key pair that is to be unlocked. The name must match the name that was specified via the crypto key encrypt rsa command.
passphrase passphrase	Passphrase that is used to unlock the RSA key. The passphrase must match the passphrase that was specified via the crypto key encrypt rsa command.

Defaults

The encrypted private key is locked.

Command Modes

Privileged EXEC

Command History

Release	Modification
12.3(7)T	This command was introduced.

Usage Guidelines

When a router with an encrypted RSA key (via the crypto key encrypt rsa command) initially boots up, the key does not exist in plain text and is therefore considered to be locked. Because the private key is not available, all RSA operations will fail. After you unlock the private key, RSA operations will function again.

This command affects only the "run-time" access to the key; that is, it does not affect the key that is stored in NVRAM.

Examples

The following example shows how to unlock the key "pki1-72a.cisco.com":

Router# crypto key unlock rsa name pki1-72a.cisco.com passphrase cisco1234

Related Commands

Command	Description
crypto key encrypt rsa	Encrypts the RSA private key.
crypto key lock rsa	Locks the RSA private key in a router.
show crypto key mypubkey rsa	Displays the RSA public keys of your router.

crypto key zeroize rsa

To delete all RSA keys from your router, use the crypto key zeroize rsa command in global configuration mode.

crypto key zeroize rsa [key-pair-label]

Syntax Description

key-pair-label

(Optional) Specifies the name of the key pair that router will delete.

Defaults

No default behavior or values.

Command Modes

Global configuration

Command History

Release	Modification
11.3 T	This command was introduced.
12.2(8)T	The key-pair-label argument was added.

Usage Guidelines

This command deletes all Rivest, Shamir, and Adelman (RSA) keys that were previously generated by your router unless you include the key-pair-label argument, which will delete only the specified RSA key pair. If you issue this command, you must also perform two additional tasks for each trustpoint that is associated with the key pair that was deleted:

•Ask the certification authority (CA) administrator to revoke your router's certificates at the CA; you must supply the challenge password you created when you originally obtained the router's certificates using the crypto ca enroll command.

•Manually remove the router's certificates from the configuration by removing the configured trustpoint (using the no crypto ca trustpoint name command.)

---

Note This command cannot be undone (after you save your configuration), and after RSA keys have been deleted, you cannot use certificates or the CA or participate in certificate exchanges with other IP Security (IPSec) peers unless you reconfigure CA interoperability by regenerating RSA keys, getting the CA's certificate, and requesting your own certificate again.

---

This command is not saved to the configuration.

Examples

The following example deletes the general-purpose RSA key pair that was previously generated for the router. After deleting the RSA key pair, the administrator contacts the CA administrator and requests that the certificate of the router be revoked. The administrator then deletes the certificate of the router from the configuration.

crypto key zeroize rsa

crypto ca certificate chain

 no certificate

Related Commands

Command	Description
certificate	Adds certificates manually.
crypto ca certificate chain	Enters the certificate chain configuration mode.
crypto ca trustpoint	Declares the CA that your router should use.
show crypto ca timers	Specifies which key pair to associate with the certificate.

crypto keyring

To define a crypto keyring to be used during Internet Key Exchange (IKE) authentication, use the crypto keyring command in global configuration mode. To remove the keyring, use the no form of this command.

crypto keyring keyring-name [vrf fvrf-name]

no crypto keyring keyring-name [vrf fvrf-name]

Syntax Description

keyring-name	Name of the crypto keyring.
vrf fvrf-name	(Optional) Front door virtual routing and forwarding (FVRF) name to which the keyring will be referenced. The fvrf-name must match the FVRF name that was defined during virtual routing and forwarding (VRF) configuration.

Defaults

All the Internet Security Association and Key Management Protocol (ISAKMP) keys that were defined in the global configuration are part of the default global keyring.

Command Modes

Global configuration

Command History

Release	Modification
12.2(15)T	This command was introduced.

Usage Guidelines

A keyring is a repository of preshared and Rivest, Shamir, and Adelman (RSA) public keys. The keyring is used in the isakmp profile configuration mode. The ISAKMP profile successfully completes authentication of peers if the peer keys are defined in the keyring that is attached to this profile.

Examples

The following example shows that a keyring and its usage have been defined:

crypto keyring vpnkeys

  pre-shared-key address 10.72.23.11 key vpnsecret

crypto isakmp profile vpnprofile

  keyring vpnkeys

crypto map (global IPSec)

To enter crypto map configuration mode and create or modify a crypto map entry, to create a crypto profile that provides a template for configuration of dynamically created crypto maps, or to configure a client accounting list, use the crypto map command in global configuration mode. To delete a crypto map entry, profile, or set, use the no form of this command.

crypto map map-name seq-num [ipsec-manual]

crypto map map-name seq-num [ipsec-isakmp] [dynamic dynamic-map-name] [discover] [profile profile-name]

crypto map map-name [client-accounting-list aaalist]

no crypto map map-name seq-num

---

Note Issue the crypto map map-name seq-num command without a keyword to modify an existing crypto map entry.

---

Syntax Description

map-name	Name that identifies the crypto map set. This is the name assigned when the crypto map was created.
seq-num	Sequence number you assign to the crypto map entry. See additional explanation for using this argument in the "Usage Guidelines" section.
ipsec-manual	(Optional) Indicates that Internet Key Exchange (IKE) will not be used to establish the IP Security (IPSec) security associations (SAs) for protecting the traffic specified by this crypto map entry.
ipsec-isakmp	(Optional) Indicates that IKE will be used to establish the IPSec SAs for protecting the traffic specified by this crypto map entry.
dynamic	(Optional) Specifies that this crypto map entry is to reference a preexisting dynamic crypto map. Dynamic crypto maps are policy templates used in processing negotiation requests from a peer IPSec device. If you use this keyword, none of the crypto map configuration commands will be available.
dynamic-map-name	(Optional) Specifies the name of the dynamic crypto map set that should be used as the policy template.
discover	(Optional) Enables peer discovery. By default, peer discovery is not enabled.
profile	(Optional) Designates a crypto map as a configuration template. The security configurations of this crypto map will be cloned as new crypto maps are created dynamically on demand.
profile-name	(Optional) Name of the crypto profile being created.
client-accounting- list	(Optional) Designates a client accounting list.
aaalist	(Optional) List name.

Defaults

No crypto maps exist.

Peer discovery is not enabled.

Command Modes

Global configuration

Command History

Release	Modification
11.2	This command was introduced.
11.3 T	The following keywords and arguments were added: •ipsec-manual •ipsec-isakmp •dynamic •dynamic-map-name
12.0(5)T	The discover keyword was added to support Tunnel Endpoint Discovery (TED).
12.2(4)T	The profile profile-name keyword and argument combination was introduced to allow the generation of a crypto map profile that is cloned to create dynamically created crypto maps on demand.
12.2(11)T	Support was added for the Cisco 1760, Cisco AS5300, Cisco AS5400, and Cisco AS5800 platforms.
12.2(15)T	The client-accounting-list keyword and aaalist argument were added.

Usage Guidelines

Use this command to create a new crypto map entry, to create a crypto map profile, or to modify an existing crypto map entry or profile.

After a crypto map entry has been created, you cannot change the parameters specified at the global configuration level because these parameters determine which of the configuration commands are valid at the crypto map level. For example, after a map entry has been created using the ipsec-isakmp keyword, you cannot change it to the option specified by the ipsec-manual keyword; you must delete and reenter the map entry.

After you define crypto map entries, you can assign the crypto map set to interfaces using the crypto map (interface IPSec) command.

Crypto Map Functions

Crypto maps provide two functions: filtering and classifying traffic to be protected and defining the policy to be applied to that traffic. The first use affects the flow of traffic on an interface; the second affects the negotiation performed (via IKE) on behalf of that traffic.

IPSec crypto maps define the following:

•What traffic should be protected

•To which IPSec peers the protected traffic can be forwarded—these are the peers with which an SA can be established

•Which transform sets are acceptable for use with the protected traffic

•How keys and security associations should be used or managed (or what the keys are, if IKE is not used)

Multiple Crypto Map Entries with the Same Map Name Form a Crypto Map Set

A crypto map set is a collection of crypto map entries, each with a different seq-num argument but the same map-name argument. Therefore, for a given interface, you could have certain traffic forwarded to one IPSec peer with specified security applied to that traffic and other traffic forwarded to the same or a different IPSec peer with different IPSec security applied. To accomplish differential forwarding you would create two crypto maps, each with the same map-name argument, but each with a different seq-num argument. Crypto profiles must have unique names within a crypto map set.

Sequence Numbers

The number you assign to the seq-num argument should not be arbitrary. This number is used to rank multiple crypto map entries within a crypto map set. Within a crypto map set, a crypto map entry with a lower seq-num is evaluated before a map entry with a higher seq-num; that is, the map entry with the lower number has a higher priority.

For example, consider a crypto map set that contains three crypto map entries: mymap 10, mymap 20, and mymap 30. The crypto map set named "mymap" is applied to serial interface 0. When traffic passes through serial interface 0, the traffic is evaluated first for mymap 10. If the traffic matches any access list permit statement entry in the extended access list in mymap 10, the traffic will be processed according to the information defined in mymap 10 (including establishing IPSec SAs when necessary). If the traffic does not match the mymap 10 access list, the traffic will be evaluated for mymap 20, and then mymap 30, until the traffic matches a permit entry in a map entry. (If the traffic does not match a permit entry in any crypto map entry, it will be forwarded without any IPSec security.)

Dynamic Crypto Maps

Refer to the "Usage Guidelines" section of the crypto dynamic-map command for a discussion on dynamic crypto maps.