Courseiva
VPNGlobal Config

crypto ikev1 enable [intf]

Enables IKEv1 (ISAKMP) on a specified interface for IPsec VPN negotiations.

Definition: crypto ikev1 enable [intf] is a Cisco ASA global config command. Enables IKEv1 (ISAKMP) on a specified interface for IPsec VPN negotiations.

Overview

The 'crypto ikev1 enable' command is used on Cisco ASA firewalls to activate Internet Key Exchange version 1 (IKEv1) on a specific interface. IKEv1 is a protocol used to establish security associations (SAs) for IPsec VPNs. It handles authentication, key exchange, and negotiation of security parameters.

This command is essential for any IPsec VPN configuration, as it allows the ASA to listen for and initiate IKEv1 traffic on the designated interface. Typically, this is applied to the outside interface for site-to-site or remote access VPNs. Without this command, the ASA will not respond to IKEv1 packets on that interface, causing VPN negotiations to fail.

The command is simple and does not require additional parameters; it just needs the interface name. It is often one of the first steps in configuring a VPN on an ASA. In troubleshooting, verifying that IKEv1 is enabled on the correct interface is a common check.

The command can be removed with the 'no' form to disable IKEv1 on an interface. Note that IKEv2 is the newer standard and is preferred for new deployments, but many legacy environments still use IKEv1.

Syntax·Global Config
crypto ikev1 enable [interface-name]

When to Use This Command

  • Enable IKEv1 on an outside interface to allow site-to-site VPN connections.
  • Enable IKEv1 on a DMZ interface for remote access VPN termination.
  • Enable IKEv1 on a management interface for VPN management traffic.
  • Enable IKEv1 on a backup interface for failover VPN scenarios.

Parameters

ParameterSyntaxDescription
interface-namestringThe name of the interface on which to enable IKEv1. This must be a valid interface configured on the ASA, such as 'outside', 'inside', or a custom name.

Command Examples

Enable IKEv1 on outside interface

crypto ikev1 enable outside

No output is displayed upon successful execution. Use 'show crypto ikev1 sa' to verify.

Enable IKEv1 on DMZ interface

crypto ikev1 enable dmz

Enables IKEv1 on the dmz interface. Verify with 'show run crypto ikev1'.

Understanding the Output

This command does not produce direct output. To verify that IKEv1 is enabled on an interface, use 'show running-config crypto ikev1' or 'show crypto ikev1 sa'. The running config will show lines like 'crypto ikev1 enable outside' if enabled.

The 'show crypto ikev1 sa' command displays active IKEv1 security associations; if no SAs are present, it indicates no current VPN negotiations. A healthy state shows active SAs with status 'ACTIVE'. Problem states may show 'MM_NO_STATE' or 'MM_WAIT_MSG' indicating negotiation issues.

Configuration Scenarios

Basic Site-to-Site VPN with IKEv1

Enable IKEv1 on the outside interface for a site-to-site VPN between two ASAs.

Topology

[ASA1]---(outside)---Internet---(outside)---[ASA2]

Steps

  1. 1.Configure the outside interface with an IP address.
  2. 2.Enable IKEv1 on the outside interface: crypto ikev1 enable outside
  3. 3.Configure IKEv1 policy: crypto ikev1 policy 10 authentication pre-share encryption aes-256 hash sha group 2
  4. 4.Configure IPsec transform set and crypto map.
Configuration
! Enable IKEv1 on outside
crypto ikev1 enable outside
! IKEv1 policy
crypto ikev1 policy 10
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400

Verify: Use 'show crypto ikev1 sa' to see active SAs. Use 'show crypto isakmp sa detail' for more details.

Watch out: Ensure that the interface is not already configured with 'no crypto ikev1 enable' and that the interface is up/up.

Troubleshooting with This Command

When troubleshooting IKEv1 issues, first verify that IKEv1 is enabled on the correct interface using 'show running-config crypto ikev1'. If the command is missing, add it. Next, check the interface status with 'show interface' to ensure it is up.

If VPN negotiations fail, use 'debug crypto ikev1 127' to see IKEv1 messages. Common issues include mismatched IKEv1 policies, incorrect pre-shared keys, or ACLs blocking UDP port 500. Also verify that the ASA is not behind NAT without proper NAT traversal configuration.

The 'show crypto ikev1 sa' command shows the state of IKEv1 SAs; a state of 'MM_NO_STATE' indicates no negotiation, while 'MM_WAIT_MSG' indicates waiting for a response. Use 'clear crypto ikev1 sa' to reset SAs if needed.

CCNA Exam Tips

1.

Remember that IKEv1 must be enabled on the interface used for VPN termination.

2.

IKEv1 is the legacy protocol; IKEv2 is preferred in newer deployments.

3.

Use 'no crypto ikev1 enable' to disable IKEv1 on an interface.

Common Mistakes

Forgetting to enable IKEv1 on the interface, causing VPN negotiation to fail.

Enabling IKEv1 on the wrong interface (e.g., inside instead of outside).

Not saving the configuration after enabling IKEv1.

crypto ikev1 enable [intf] vs anyconnect enable

Both commands enable VPN services but serve different VPN technologies: IKEv1 enables traditional IPsec tunnels, while anyconnect enables SSL VPN access. They are often confused because both involve enabling VPN on interfaces or groups, but they operate at different layers and with different clients.

Aspectcrypto ikev1 enable [intf]anyconnect enable
ScopeGlobal configuration, per interfaceWebVPN configuration mode, per tunnel-group or group-policy
VPN TypeIKEv1 (ISAKMP) for IPsecSSL/TLS or IKEv2 for AnyConnect client
PersistenceSurvives reload; interface specificSurvives reload; applies to group-policy or tunnel-group
DependenciesRequires IKEv1 policy and IPsec transform-setRequires SSL certificate or AAA configuration
Typical UseSite-to-site VPN or legacy remote accessModern remote access VPN for AnyConnect clients

Use crypto ikev1 enable [intf] when you need to enable IKEv1 negotiations on an interface for IPsec-based VPN connections, typically for site-to-site or legacy remote access VPN.

Use anyconnect enable when you need to enable SSL VPN access for a specific group-policy or tunnel-group to allow AnyConnect client connections.

Platform Notes

On Cisco ASA, the command is 'crypto ikev1 enable' while on Cisco IOS routers, it is 'crypto isakmp enable'. The ASA uses 'crypto ikev1' for IKEv1 and 'crypto ikev2' for IKEv2. On ASA version 9.x and later, IKEv2 is the default for new configurations.

The command is not available on ASA 5505 models running older software. On other platforms like Palo Alto, the equivalent is 'set network ike gateway' configuration. Always check the ASA version and documentation for exact syntax.

Practice for the CCNP Security

Test your knowledge with practice questions covering all CCNP Security exam domains.

Practice CCNP Security Questions