Courseiva
VPNISAKMP Policy Config

encryption [aes|3des|des]

Specifies the encryption algorithm to use for IPsec phase 1 (ISAKMP) proposals, ensuring confidentiality of key management traffic.

Definition: encryption [aes|3des|des] is a Cisco IOS isakmp policy config command. Specifies the encryption algorithm to use for IPsec phase 1 (ISAKMP) proposals, ensuring confidentiality of key management traffic.

Overview

The `encryption` command in ISAKMP policy configuration mode specifies the encryption algorithm used to protect Internet Security Association and Key Management Protocol (ISAKMP) exchanges during IPsec Phase 1. This is a critical command because it defines the confidentiality strength for the key management traffic that establishes the IPsec tunnel. Without proper encryption, the negotiation of IPsec security associations (SAs) could be intercepted, exposing sensitive keying material.

The command is used when configuring an ISAKMP policy, which is a set of parameters (encryption, hash, authentication, Diffie-Hellman group, lifetime) that the peers must match to successfully establish Phase 1. The encryption algorithm is one of the most important parameters because it directly impacts security and performance. AES (Advanced Encryption Standard) is the modern standard, offering 128, 192, or 256-bit keys; 3DES (Triple DES) is legacy but still found in older networks; DES (Data Encryption Standard) is obsolete and insecure.

Network engineers reach for this command when setting up site-to-site VPNs, remote-access VPNs, or any IPsec-based connectivity. It fits into the broader workflow after defining the ISAKMP policy number and before configuring the hash, authentication, and group. The command is available in privileged EXEC mode (enable) and requires entering ISAKMP policy configuration mode via `crypto isakmp policy <number>`.

The running config immediately reflects the change, and the policy is active for new negotiations. Important IOS behavior: if you omit the encryption command, the default is DES (if available) or 3DES on some versions. However, best practice is to explicitly set AES.

Also, the encryption algorithm must match on both peers; otherwise, Phase 1 fails. The command does not affect existing SAs; only new negotiations use the updated policy. Understanding this command is foundational for CCNA and CCNP candidates because IPsec VPNs are a core topic, and misconfiguration here leads to common troubleshooting scenarios.

Syntax·ISAKMP Policy Config
encryption [aes|3des|des]

When to Use This Command

  • Configuring a site-to-site VPN between two branch offices requiring AES-256 encryption for security compliance.
  • Setting up a remote-access VPN for employees where the VPN concentrator must support 3DES for legacy client compatibility.
  • Migrating from DES to AES in a production VPN to meet updated security standards without disrupting existing tunnels.
  • Creating multiple ISAKMP policies with different encryption strengths to match peer capabilities during VPN negotiation.

Parameters

ParameterSyntaxDescription
encryption-typeaes | 3des | desSpecifies the encryption algorithm: 'aes' for AES (128-bit by default; use 'aes 192' or 'aes 256' for stronger keys), '3des' for Triple DES (168-bit), or 'des' for DES (56-bit). AES is recommended; DES is insecure and should not be used. Common mistake: forgetting to specify the key size for AES (e.g., 'aes 256' instead of just 'aes').

Command Examples

Configure ISAKMP policy with AES-256 encryption

crypto isakmp policy 10 encryption aes 256 authentication pre-share group 5 lifetime 86400
crypto isakmp policy 10
 encr aes 256
 authentication pre-share
 group 5
 lifetime 86400

The command 'encryption aes 256' sets the encryption algorithm to AES with a 256-bit key. The output shows the policy configuration after entering the commands. 'encr aes 256' confirms the encryption setting. 'authentication pre-share' sets the authentication method. 'group 5' specifies the Diffie-Hellman group. 'lifetime 86400' sets the SA lifetime in seconds.

Configure ISAKMP policy with 3DES encryption

crypto isakmp policy 20 encryption 3des authentication rsa-sig group 2 lifetime 3600
crypto isakmp policy 20
 encr 3des
 authentication rsa-sig
 group 2
 lifetime 3600

The command 'encryption 3des' sets the encryption algorithm to 3DES. The output shows the policy with 'encr 3des'. 'authentication rsa-sig' uses RSA signatures. 'group 2' is a weaker DH group. 'lifetime 3600' sets a shorter lifetime.

Understanding the Output

The output of 'show crypto isakmp policy' displays each configured ISAKMP policy with its parameters. The 'encr' field shows the encryption algorithm (e.g., 'aes 256', '3des', 'des'). A missing or incorrect encryption setting can cause negotiation failures.

In a real network, ensure both peers have matching encryption algorithms. Good values are 'aes 256' or 'aes 192' for strong security; 'des' is weak and should be avoided. Watch for mismatched policies that could prevent VPN establishment.

Configuration Scenarios

Configure ISAKMP Policy with AES-256 for Site-to-Site VPN

Two branch offices need a secure IPsec VPN. The security policy mandates AES-256 encryption for all key management traffic. Both routers must have matching ISAKMP policies.

Topology

R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2

Steps

  1. 1.Step 1: Enter global configuration mode on R1: configure terminal
  2. 2.Step 2: Create ISAKMP policy 10: crypto isakmp policy 10
  3. 3.Step 3: Set encryption to AES-256: encryption aes 256
  4. 4.Step 4: Set hash to SHA-256: hash sha256
  5. 5.Step 5: Set authentication to pre-share: authentication pre-share
  6. 6.Step 6: Set Diffie-Hellman group 14: group 14
  7. 7.Step 7: Set lifetime to 86400 seconds: lifetime 86400
  8. 8.Step 8: Exit policy mode: exit
  9. 9.Step 9: Repeat steps 1-8 on R2 with identical policy number and parameters.
Configuration
! R1 configuration
crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14
 lifetime 86400
 exit

Verify: Use 'show crypto isakmp policy' on both routers. Expected output shows policy 10 with encryption aes (256-bit keys).

Watch out: If you forget to specify the key size (e.g., just 'encryption aes'), the default is 128-bit, which may not meet security requirements and cause mismatch if the peer expects 256-bit.

Migrate Legacy ISAKMP Policy from 3DES to AES-128

A company is upgrading its VPN security from legacy 3DES to AES-128. The existing ISAKMP policy uses 3DES; a new policy must be created with AES-128 while keeping the old policy for backward compatibility during migration.

Topology

HQ-Router(Gi0/0)---10.1.1.0/30---(Gi0/0)Branch-Router

Steps

  1. 1.Step 1: On HQ-Router, create a new ISAKMP policy with a higher priority number (lower number = higher priority): crypto isakmp policy 5
  2. 2.Step 2: Set encryption to AES-128: encryption aes
  3. 3.Step 3: Set other parameters to match the old policy except encryption: hash sha, authentication pre-share, group 2, lifetime 86400
  4. 4.Step 4: Exit policy mode: exit
  5. 5.Step 5: On Branch-Router, create the same policy 5 with identical parameters.
  6. 6.Step 6: Verify that new VPN tunnels use policy 5 (higher priority).
  7. 7.Step 7: After all peers are migrated, remove the old policy 10: no crypto isakmp policy 10
Configuration
! HQ-Router new policy
crypto isakmp policy 5
 encryption aes
 hash sha
 authentication pre-share
 group 2
 lifetime 86400
 exit

Verify: Use 'show crypto isakmp sa detail' to see which policy ID is used for active SAs. Expected: policy 5 for new tunnels.

Watch out: The old policy (3DES) must remain until all peers are migrated; otherwise, existing tunnels using that policy will fail to rekey. Also, ensure the new policy has a lower number (higher priority) than the old one.

Troubleshooting with This Command

When troubleshooting ISAKMP Phase 1 failures, the encryption algorithm is a common culprit. Healthy output from 'show crypto isakmp policy' shows the configured encryption for each policy. For example, 'Encryption: aes (256 bit keys)' indicates AES-256.

Problem indicators include 'Encryption: des' (insecure) or a mismatch between peers. The most common symptom is that Phase 1 negotiation fails with a message like '%CRYPTO-4-IKMP_BAD_MESSAGE' or 'MM_NO_STATE'. To diagnose, first verify that both peers have a matching ISAKMP policy.

Use 'show crypto isakmp policy' on both devices and compare the encryption, hash, authentication, group, and lifetime. If encryption differs, the negotiation will fail. For example, if one peer has 'encryption aes' (128-bit) and the other has 'encryption aes 256', they will not match because the key sizes differ.

Another common issue is using DES, which is often disabled by default in newer IOS versions; if you see 'encryption des' but the peer expects AES, the policy won't match. To correlate with other commands, use 'debug crypto isakmp' to see detailed negotiation messages. Look for lines like 'Oakley Transform [AES_CBC] [SHA] [DH_GROUP]' – the encryption algorithm appears as AES_CBC, 3DES_CBC, or DES_CBC.

If you see 'NO MATCH' or 'proposal mismatch', check the encryption field. Also, 'show crypto isakmp sa' shows the state of SAs; if the state is 'MM_NO_STATE' or 'AG_NO_STATE', Phase 1 is stuck, often due to policy mismatch. Step-by-step diagnostic flow: 1) Check ISAKMP policies on both peers with 'show crypto isakmp policy'. 2) Verify encryption algorithm matches exactly (including key size for AES). 3) Use 'debug crypto isakmp' to see the proposed transforms. 4) If mismatch, correct the encryption on one peer to match the other. 5) Clear existing SAs with 'clear crypto isakmp' if needed.

Remember that the encryption command only affects new negotiations; existing SAs continue until they expire. Also, note that some IOS versions require the 'aes' keyword to be followed by the key size (e.g., 'aes 256'), while others accept just 'aes' for 128-bit. Always check the documentation for your specific IOS version.

CCNA Exam Tips

1.

CCNA exam tip: The encryption command is configured in ISAKMP policy configuration mode, not global config.

2.

CCNA exam tip: AES is the strongest encryption; DES is deprecated and rarely used in modern networks.

3.

CCNA exam tip: For the exam, remember that both peers must have at least one matching ISAKMP policy (including encryption) to form a VPN.

4.

CCNA exam tip: The default ISAKMP policy uses DES encryption; you must explicitly configure stronger encryption for security.

Common Mistakes

Mistake 1: Using 'encryption aes' without specifying key size (defaults to 128-bit, which may be insufficient).

Mistake 2: Configuring encryption in global config mode instead of ISAKMP policy config mode, causing syntax error.

Mistake 3: Forgetting to match encryption algorithms between peers, leading to 'no proposal chosen' errors.

encryption [aes|3des|des] vs crypto isakmp policy [priority]

Both commands are involved in configuring IPsec VPN phase 1 (ISAKMP/IKE), but at different levels. 'encryption' is a subcommand applied within a specific ISAKMP policy, while 'crypto isakmp policy' creates or selects that policy. This nesting can cause confusion.

Aspectencryption [aes|3des|des]crypto isakmp policy [priority]
ScopeSubcommand within an ISAKMP policyCreates or modifies an ISAKMP policy
Configuration modeISAKMP Policy Config (config-isakmp)Global Config (config)
PersistenceSaved as part of the ISAKMP policy blockDefines the entire policy including its parameters
PrecedenceOnly applicable after policy creation; multiple encryption options per policy? (No, only one per policy)Can define multiple policies with different priorities
Typical useSetting encryption algorithm inside an existing policyDefining a new IKE policy with all parameters

Use encryption [aes|3des|des] when you are inside a specific ISAKMP policy (config-isakmp) and need to set or change the encryption algorithm for that policy.

Use crypto isakmp policy [priority] when you need to create a new ISAKMP policy or enter configuration mode for an existing policy to define multiple parameters including encryption, hash, authentication, and Diffie-Hellman group.

Platform Notes

In IOS-XE (e.g., 16.x), the syntax is identical to classic IOS. However, IOS-XE may support additional encryption algorithms like 'aes-gcm' for newer IPsec implementations, but for ISAKMP Phase 1, only AES, 3DES, and DES are available. The output of 'show crypto isakmp policy' in IOS-XE includes the encryption algorithm and key size.

In NX-OS (Cisco Nexus switches), the equivalent command is 'crypto isakmp policy <number>' followed by 'encryption {aes | 3des | des}' – same syntax. However, NX-OS also supports 'aes-gcm-128' and 'aes-gcm-256' for IKEv2, but for IKEv1 (ISAKMP), it's the same. On Cisco ASA, the command is 'crypto isakmp policy <number>' then 'encryption {aes | 3des | des}' – identical.

ASA also supports 'aes-256' as 'encryption aes-256'. In IOS-XR, the command is different: ISAKMP is not used; instead, IKEv2 is the default. The equivalent is 'crypto ikev2 proposal <name>' with 'encryption {aes-cbc-128 | aes-cbc-192 | aes-cbc-256 | 3des | des}'.

So the 'encryption' command in ISAKMP policy config is not available in IOS-XR. For IOS versions, note that 12.x and early 15.x support DES, but many later 15.x and 16.x releases disable DES by default due to security concerns. If you need DES, you may have to enable it with 'crypto isakmp enable des' or similar.

Always verify with 'show crypto isakmp default-policy' to see the default encryption. In summary, the command is consistent across IOS, IOS-XE, NX-OS, and ASA, but not in IOS-XR.

Related Commands

crypto ipsec transform-set [name] esp-aes esp-sha-hmac

Defines an IPsec transform set specifying the encryption and authentication algorithms to protect VPN traffic, used when configuring an IPsec VPN policy.

crypto isakmp policy [priority]

Creates or modifies an ISAKMP (IKE) policy for IPsec VPN negotiations, defining encryption, authentication, and key exchange parameters.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions