Cisco Catalyst SD-WAN Remote Access Configuration Guide, Releases 26.x and Later

PDF

Cisco Catalyst SD-WAN Remote Access Configuration Guide, Releases 26.x and Later

Configure an IKEv2 profile

Updated: March 10, 2026

Want to summarize with AI?

Log in

Configure an IKEv2 profile to enable grouping of peers by identity and specify authentication and authorization policy.

The IKEv2 profile enables grouping of peers by identity, and specifies authentication and authorization policy.

In Cisco SD-WAN Manager, use a CLI add-on template for the SD-WAN RA headend device to configure the following:

Procedure

  1. Configure an IKEv2 profile.

    1. Specify a name for the profile.

      Example:

      crypto ikev2 profile sdra_ikev2_profile
    2. Match peer identities and specify a local identity.

      Example:

      match identity remote { any |  id-type id-value}  
identity local id-type id-value
    3. Specify authentication types and credentials.

      Example:

      authentication local auth-type [ key pre-shared-key]  
authentication remote auth-type 
keyring aaa sdra-author-aaa-mlist password sdra-radius-password 
pki trustpoint sdra_trustpoint 
aaa authentication eap sdra_authen_mlist
    4. Specify user authorization parameters.

      Example:

      aaa authorization user peer-auth-type cached
    5. Specify group authorization parameters.

      Example:

      aaa authorization group peer-auth-type list sdra_author_mlist name-mangler sdra-group-author-name-mangler password sdra-radius-password
    6. Enable AAA accounting.

      Example:

      aaa accounting peer-auth-type list sdra_acc_mlist
    7. Specify an IPsec virtual-template interface.

      Example:

      virtual-template interface-number mode auto

    Example:

    Example:

    crypto ikev2 profile sdra_ikev2_profile
 match identity remote any 
 identity local email sdra_headend1@abc.com
 authentication local rsa-sig
 authentication remote anyconnect-eap aggregate
 pki trustpoint sdra_pki_trustpoint
 aaa authentication anyconnect-eap sdra_authen_mlist
 aaa authorization user anyconnect-eap cached
 aaa authorization group anyconnect-eap list sdra_author_mlist name-mangler sdra_group_author_name_mangler password sdra_radius_author_passwd
 aaa accounting anyconnect-eap sdra_acc_mlist
 virtual-template 1 mode auto

  2. Configure the IKEv2 name mangler to extract the domain portion from the peer identity, using a Cisco SD-WAN Manager CLI template.

    Example:

    crypto ikev2 name-mangler sdra_group_author_name 
 fqdn domain 
 email domain 
 eap suffix delimiter @

    Example:

    crypto ikev2 name-mangler sdra_group_author_name_mangler
fqdn domain
email domain
eap suffix delimiter @

The IKEv2 profile is configured with authentication and authorization policy, and the name mangler is configured to extract the domain portion from peer identities.