Courseiva
VPNISAKMP Policy Config

authentication pre-share

Specifies the authentication method as pre-shared keys for an ISAKMP policy, used to authenticate IKE phase 1 peers in IPsec VPNs.

Definition: authentication pre-share is a Cisco IOS isakmp policy config command. Specifies the authentication method as pre-shared keys for an ISAKMP policy, used to authenticate IKE phase 1 peers in IPsec VPNs.

Overview

The `authentication pre-share` command is used in ISAKMP (Internet Security Association and Key Management Protocol) policy configuration mode to specify that pre-shared keys (PSKs) will be used for authenticating IKE (Internet Key Exchange) phase 1 peers in an IPsec VPN. This is one of the most common authentication methods for site-to-site VPNs because it is simple to configure and does not require a public key infrastructure (PKI). The command is entered under an ISAKMP policy, which defines the parameters for IKE phase 1 negotiations.

When two peers attempt to establish an IPsec tunnel, they must agree on a common ISAKMP policy, including the authentication method. If both peers are configured with `authentication pre-share`, they will use a shared secret (the pre-shared key) to authenticate each other during the main mode or aggressive mode exchange. This command is critical because it directly impacts the security and interoperability of the VPN.

Without proper authentication, an attacker could impersonate a legitimate peer and compromise the VPN. The alternative to pre-shared keys is digital certificates (using `authentication rsa-sig`), which provide stronger security through PKI but require more complex setup. Network engineers typically reach for `authentication pre-share` in small to medium-sized deployments where certificate infrastructure is not justified, or in lab environments.

In larger enterprises, certificates are often preferred for scalability and security. The command is configured in ISAKMP policy configuration mode, which is entered via `crypto isakmp policy <priority>`. The priority number (1-10000) determines the order in which policies are evaluated; lower numbers have higher priority.

When configuring multiple ISAKMP policies, the router will attempt to match with the peer using the highest priority policy first. The `authentication pre-share` command does not require any additional parameters; it simply sets the authentication method. After configuring the authentication method, you must also configure the pre-shared key itself using the `crypto isakmp key` command in global configuration mode.

The key must match on both peers. A common mistake is forgetting to configure the key or using mismatched keys, which will cause IKE negotiation to fail. The command takes effect immediately and is stored in the running configuration.

It does not require a reload. Privilege level 15 (privileged EXEC) is required to enter global configuration mode and ISAKMP policy configuration mode. The command is available in IOS versions 12.0 and later, including IOS-XE.

In NX-OS, the equivalent is `authentication pre-shared-key` under the IKE policy. Understanding this command is fundamental for CCNA and CCNP candidates as IPsec VPNs are a core topic in the security and WAN sections.

Syntax·ISAKMP Policy Config
authentication pre-share

When to Use This Command

  • Configuring a site-to-site VPN between two branch offices using a shared secret.
  • Setting up a remote access VPN where the remote user and VPN gateway share a pre-configured key.
  • Establishing a VPN tunnel with a third-party vendor that requires pre-shared key authentication.
  • Quickly deploying a VPN test lab without needing a PKI infrastructure.

Command Examples

Basic pre-share authentication configuration

crypto isakmp policy 10 authentication pre-share
crypto isakmp policy 10
 hash sha
 authentication pre-share
 group 2
 lifetime 86400

The 'authentication pre-share' command sets the authentication method to pre-shared keys. The output shows the full policy configuration: hash algorithm SHA, authentication pre-share, Diffie-Hellman group 2, and lifetime of 86400 seconds (24 hours).

Verifying ISAKMP policy authentication

show crypto isakmp policy
Global IKE policy
Protection suite of priority 10
        encryption algorithm:   AES - Advanced Encryption Standard (256 bit keys).
        hash algorithm:         Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #2 (1024 bit)
        lifetime:               86400 seconds, no volume limit

The 'show crypto isakmp policy' output displays the configured policies. The 'authentication method: Pre-Shared Key' line confirms that pre-share authentication is set. Other fields show encryption, hash, DH group, and lifetime.

Understanding the Output

The 'authentication pre-share' command itself produces no output; it simply sets the authentication method in the ISAKMP policy configuration. To verify, use 'show crypto isakmp policy'. The output lists each configured policy with its priority.

Key fields: 'encryption algorithm' (e.g., AES-256), 'hash algorithm' (e.g., SHA), 'authentication method' (should show 'Pre-Shared Key'), 'Diffie-Hellman group' (e.g., #2), and 'lifetime' in seconds. Ensure the authentication method matches the peer's configuration; mismatches cause IKE negotiation failures. A common issue is forgetting to set the pre-shared key globally with 'crypto isakmp key' command, which is required for pre-share authentication to work.

Configuration Scenarios

Configure Site-to-Site VPN with Pre-Shared Keys between Two Branch Routers

Two branch offices need to securely communicate over the internet. Each office has a Cisco router with a public IP address. The goal is to establish an IPsec VPN tunnel using pre-shared keys for IKE authentication.

Topology

R1(Gi0/0)---203.0.113.1/30---Internet---203.0.113.2/30---(Gi0/0)R2

Steps

  1. 1.Step 1: Enter global configuration mode on R1: R1> enable; R1# configure terminal
  2. 2.Step 2: Create an ISAKMP policy with priority 10: R1(config)# crypto isakmp policy 10
  3. 3.Step 3: Set the authentication method to pre-share: R1(config-isakmp)# authentication pre-share
  4. 4.Step 4: (Optional) Set encryption and hash algorithms, e.g., encryption aes 256 and hash sha256
  5. 5.Step 5: Exit ISAKMP policy mode: R1(config-isakmp)# exit
  6. 6.Step 6: Configure the pre-shared key for the remote peer: R1(config)# crypto isakmp key cisco123 address 203.0.113.2
  7. 7.Step 7: Repeat similar configuration on R2 with the same key and matching policy parameters.
Configuration
! R1 configuration
crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14
 lifetime 86400
crypto isakmp key cisco123 address 203.0.113.2
! R2 configuration
crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14
 lifetime 86400
crypto isakmp key cisco123 address 203.0.113.1

Verify: Use 'show crypto isakmp sa' to verify IKE phase 1 SA. Expected output shows state MM_ACTIVE for the peer. Example: 'IPv4 Crypto ISAKMP SA dst=203.0.113.2 src=203.0.113.1 conn-id=1001 status=ACTIVE'

Watch out: Ensure that the pre-shared key matches exactly on both peers. Also, the ISAKMP policy parameters (encryption, hash, group) must match; otherwise, IKE negotiation fails.

Configure Remote Access VPN with Pre-Shared Keys for a Mobile User

A remote employee needs to connect to the corporate network using a VPN client. The corporate router acts as the VPN headend. Pre-shared keys are used for IKE authentication, and the client uses a group password.

Topology

Client---Internet---203.0.113.1/30---(Gi0/0)R1 (Corporate)

Steps

  1. 1.Step 1: On R1, create an ISAKMP policy for remote access: R1(config)# crypto isakmp policy 20
  2. 2.Step 2: Set authentication pre-share: R1(config-isakmp)# authentication pre-share
  3. 3.Step 3: Configure a group policy for remote clients: R1(config)# crypto isakmp client configuration group VPNGroup
  4. 4.Step 4: Set the pre-shared key for the group: R1(config-isakmp-group)# key cisco123
  5. 5.Step 5: Configure IPsec transform set and dynamic map for clients.
  6. 6.Step 6: On the client, configure the same group name and key.
Configuration
! R1 configuration
crypto isakmp policy 20
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14
 lifetime 86400
crypto isakmp client configuration group VPNGroup
 key cisco123
 pool VPNPool
 acl 100
! (Additional IPsec configuration not shown)

Verify: Use 'show crypto isakmp sa' to see the client's SA. Also 'show crypto ipsec sa' to verify IPsec SAs. Expected: client IP address appears in the output.

Watch out: For remote access, the pre-shared key is often configured per group, not per IP address. Ensure the client uses the correct group name and key. Also, the ISAKMP policy on the router must match the client's proposal.

Troubleshooting with This Command

When troubleshooting IKE phase 1 authentication failures with pre-shared keys, the first step is to verify that the ISAKMP policy parameters match between peers. Use `show crypto isakmp policy` to display configured policies. If the policies do not match, IKE negotiation will fail.

Next, check the pre-shared key configuration with `show running-config | include crypto isakmp key`. Ensure that the key is configured for the correct peer IP address (or hostname) and that the key string is identical on both sides. A common symptom is the IKE SA state remaining in MM_NO_STATE or MM_WAIT_MSG, indicating that authentication failed.

Use `debug crypto isakmp` to see detailed negotiation messages. Look for lines like 'ISAKMP: authentication failed' or 'ISAKMP: no pre-shared key found'. If the debug shows 'no pre-shared key found', verify that the key is configured for the correct peer address.

If the debug shows 'authentication failed', the keys likely do not match. Another useful command is `show crypto isakmp sa detail`, which shows the status and authentication method. Healthy output shows 'status: ACTIVE' and 'auth: pre-share'.

If the status is 'ACTIVE' but IPsec SAs are not established, the issue may be in phase 2. Also, check that the ISAKMP policy priority is not causing a mismatch; the router uses the highest priority policy that matches the peer's proposal. Use `show crypto isakmp sa` to list all active SAs.

If no SAs are present, IKE negotiation did not complete. Correlate with `ping` to ensure IP connectivity between peers. Additionally, check ACLs that might block UDP port 500 (ISAKMP) or UDP port 4500 (NAT-T).

Use `show ip access-lists` to verify. In summary, a systematic approach: 1) Verify connectivity, 2) Check ISAKMP policy match, 3) Verify pre-shared key, 4) Enable debugs, 5) Check for ACL blocks. This command is essential for diagnosing the most common VPN misconfigurations.

CCNA Exam Tips

1.

CCNA exam tip: The 'authentication pre-share' command is configured under ISAKMP policy, not globally. Remember the order: encryption, hash, authentication, group, lifetime.

2.

CCNA exam tip: Pre-shared keys are less secure than certificate-based authentication but simpler to configure. The exam may test your knowledge of when to use each.

3.

CCNA exam tip: You must also configure a matching pre-shared key using 'crypto isakmp key' for the peer; otherwise, authentication fails even if the policy is correct.

4.

CCNA exam tip: The default authentication method is 'rsa-sig' (RSA signatures). If you don't specify 'pre-share', the router will use RSA, which requires certificates.

Common Mistakes

Mistake: Forgetting to configure the pre-shared key with 'crypto isakmp key' after setting authentication pre-share. Consequence: IKE phase 1 fails with 'invalid authentication method' or 'no pre-shared key' errors.

Mistake: Using 'authentication pre-share' but the peer uses a different method (e.g., rsa-sig). Consequence: IKE negotiation fails due to policy mismatch.

Mistake: Configuring authentication pre-share in the wrong ISAKMP policy or not matching the peer's policy parameters (encryption, hash, group). Consequence: No matching policy found, tunnel does not come up.

authentication pre-share vs crypto isakmp policy [priority]

These two commands are commonly confused because both relate to ISAKMP policy configuration for IPsec VPNs, but one creates or enters the policy (crypto isakmp policy [priority]) while the other sets a specific parameter within that policy (authentication pre-share). Understanding their distinct roles is essential for accurate IKE phase 1 configuration.

Aspectauthentication pre-sharecrypto isakmp policy [priority]
ScopeSubcommand within an ISAKMP policyGlobal command to create or enter an ISAKMP policy
Configuration modeISAKMP Policy Configuration sub-mode (config-isakmp)Global Configuration mode (config)
PersistenceStored as a parameter of the specific policyCreates a new policy entry or modifies existing one
PrecedenceOnly effective within the current policy contextDetermines policy priority (lower number = higher priority)
Typical useSet authentication method to pre-shared keysDefine encryption, hash, DH group, and lifetime for IKE phase 1

Use authentication pre-share when you are inside an ISAKMP policy and need to specify pre-shared keys as the authentication method for IKE peers.

Use crypto isakmp policy [priority] when you need to create a new ISAKMP policy or enter an existing one to define its encryption, hash, authentication, and Diffie-Hellman parameters.

Platform Notes

In IOS-XE, the `authentication pre-share` command syntax is identical to classic IOS. However, IOS-XE may have additional options like `authentication pre-share` under IKEv2 policies (using `crypto ikev2 proposal`). For IKEv2, the command is `authentication pre-share` as well, but it is configured under the IKEv2 proposal.

In NX-OS, the equivalent command is `authentication pre-shared-key` under the IKE policy configuration mode. For example: `crypto ike policy 10` then `authentication pre-shared-key`. The key is then configured with `crypto ike key` command.

On ASA firewalls, the authentication method is set within the ISAKMP policy using `authentication pre-share` as well, but the configuration is done via `crypto isakmp policy` similar to IOS. In IOS-XR, the command is not directly available; instead, IKE is configured under `crypto ikev2` and the authentication method is set using `authentication local pre-share` and `authentication remote pre-share` under the IKEv2 profile. For IOS versions, the command has been available since IOS 12.0.

In older versions (12.x), the ISAKMP policy configuration mode is entered with `crypto isakmp policy`, and the command is the same. In IOS 15.x and 16.x, there are no syntax changes. However, in IOS 15.0(1)M and later, IKEv2 support was added, but the classic IKEv1 command remains unchanged.

When migrating from IOS to IOS-XE, the configuration is directly compatible. For NX-OS, note that the default authentication method is pre-shared key, so the command may be omitted. Always verify with `show crypto ike policy` on NX-OS.

On ASA, the command is identical but the key configuration uses `crypto isakmp key` with the peer IP. In summary, while the core concept is consistent across platforms, the exact syntax and context may vary slightly, especially for IKEv2 and on NX-OS.

Related Commands

crypto isakmp policy [priority]

Creates or modifies an ISAKMP (IKE) policy for IPsec VPN negotiations, defining encryption, authentication, and key exchange parameters.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions