Courseiva
VPNISAKMP Policy Config

group [2|5|14]

Specifies the Diffie-Hellman (DH) group identifier for an ISAKMP policy, determining the key exchange strength and security level.

Definition: group [2|5|14] is a Cisco IOS isakmp policy config command. Specifies the Diffie-Hellman (DH) group identifier for an ISAKMP policy, determining the key exchange strength and security level.

Overview

The `group` command in ISAKMP Policy Configuration mode specifies the Diffie-Hellman (DH) group identifier for an Internet Security Association and Key Management Protocol (ISAKMP) policy. This command is critical for establishing the cryptographic strength of the key exchange during IPsec VPN negotiations. DH groups determine the size of the prime number used in the Diffie-Hellman key exchange algorithm, directly impacting the security level and computational overhead.

Higher group numbers (e.g., group 14) provide stronger security but require more processing power and time, while lower groups (e.g., group 2) offer faster negotiation with weaker security. The command is used when configuring an ISAKMP policy, which defines the parameters for Phase 1 of IPsec VPN establishment. Network engineers reach for this command when they need to balance security requirements with performance constraints, such as in high-throughput VPN gateways or when connecting to legacy devices that only support certain groups.

The choice of DH group is often dictated by organizational security policies or compliance standards (e.g., NIST SP 800-77). In the broader VPN configuration workflow, the ISAKMP policy is configured first, followed by the IPsec transform set and crypto map. The `group` command is one of several mandatory parameters in an ISAKMP policy, alongside encryption, hash, authentication, and lifetime.

Without specifying a DH group, the default is typically group 1 (768-bit), which is considered weak and should be avoided. The command takes effect immediately upon configuration and is stored in the running configuration. It requires privilege level 15 (enable mode) to access ISAKMP Policy Configuration mode.

The command does not produce buffered output; it simply updates the running config. Understanding DH groups is essential for CCNA and CCNP candidates, as VPN technologies are heavily tested and widely deployed in enterprise networks.

Syntax·ISAKMP Policy Config
group [2|5|14]

When to Use This Command

  • Configuring a VPN policy that requires strong encryption by using DH group 14 (2048-bit) for secure key exchange.
  • Setting up a legacy VPN peer that only supports DH group 2 (1024-bit) due to older hardware constraints.
  • Standardizing on DH group 5 (1536-bit) as a balance between security and performance in a mixed-vendor environment.
  • Troubleshooting a VPN failure caused by DH group mismatch between peers.

Parameters

ParameterSyntaxDescription
group-number1 | 2 | 5 | 14 | 15 | 16 | 19 | 20 | 21 | 24Specifies the Diffie-Hellman group identifier. Valid values are 1 (768-bit), 2 (1024-bit), 5 (1536-bit), 14 (2048-bit), 15 (3072-bit), 16 (4096-bit), 19 (256-bit elliptic curve), 20 (384-bit elliptic curve), 21 (521-bit elliptic curve), and 24 (2048-bit with 256-bit subgroup). Common mistakes include using group 1 or 2 in security-sensitive environments, or selecting a group that the peer does not support, causing negotiation failure.

Command Examples

Setting DH group 14 for high security

group 14

No output is generated; the command silently configures the DH group. Use 'show crypto isakmp policy' to verify.

Verifying configured DH group

show crypto isakmp policy
Global IKE policy
Protection suite of priority 10
        encryption aes:    AES-CBC (128 bit key)
        hash:              sha
        group:             14
        lifetime:          86400 seconds
Protection suite of priority 20
        encryption des:    DES (56 bit keys)
        hash:              md5
        group:             2
        lifetime:          86400 seconds

The 'group' field shows the configured DH group (14 or 2). Ensure the group matches between peers; mismatched groups cause IKE negotiation failure.

Understanding the Output

The 'show crypto isakmp policy' command displays all configured ISAKMP policies. The 'group' field indicates the Diffie-Hellman group identifier. Common values: 1 (768-bit), 2 (1024-bit), 5 (1536-bit), 14 (2048-bit).

Higher numbers provide stronger security but require more CPU. A mismatch between peers will prevent IKE phase 1 from completing. Always verify that the group matches on both ends of the VPN tunnel.

Configuration Scenarios

Configure ISAKMP Policy with DH Group 14 for Site-to-Site VPN

Two branch offices need a secure site-to-site VPN with strong encryption. The security policy mandates at least 2048-bit DH key exchange. This scenario configures ISAKMP policy on R1 to use DH group 14.

Topology

R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2

Steps

  1. 1.Step 1: Enter global configuration mode: R1> enable
  2. 2.Step 2: Enter ISAKMP policy configuration for policy 10: R1# configure terminal
  3. 3.Step 3: Specify DH group 14: R1(config)# crypto isakmp policy 10
  4. 4.Step 4: Exit configuration mode: R1(config-isakmp)# group 14
  5. 5.Step 5: Verify the configuration: R1(config-isakmp)# end
Configuration
! Full IOS config block
R1> enable
R1# configure terminal
R1(config)# crypto isakmp policy 10
R1(config-isakmp)# group 14
R1(config-isakmp)# end

Verify: Use 'show crypto isakmp policy' to verify. Expected output includes 'Group 14' for policy 10.

Watch out: If the peer does not support group 14, the VPN negotiation will fail. Always verify peer capabilities before configuring.

Configure ISAKMP Policy with DH Group 2 for Legacy Device Compatibility

A remote site uses an older VPN device that only supports DH group 2 (1024-bit). To establish a VPN, the ISAKMP policy must be configured with group 2 on the Cisco router.

Topology

R1(Gi0/0)---Internet---(Gi0/0)Legacy-Device

Steps

  1. 1.Step 1: Enter global configuration mode: R1> enable
  2. 2.Step 2: Create ISAKMP policy 20: R1# configure terminal
  3. 3.Step 3: Set DH group to 2: R1(config)# crypto isakmp policy 20
  4. 4.Step 4: Exit and save: R1(config-isakmp)# group 2
  5. 5.Step 5: Verify: R1(config-isakmp)# end
Configuration
! Full IOS config block
R1> enable
R1# configure terminal
R1(config)# crypto isakmp policy 20
R1(config-isakmp)# group 2
R1(config-isakmp)# end

Verify: Use 'show crypto isakmp policy' to confirm group 2 is set. Also check 'debug crypto isakmp' during negotiation to see if the peer accepts the proposal.

Watch out: Using group 2 is considered weak by modern standards. Ensure this is only used when necessary for legacy compatibility and consider upgrading the remote device.

Troubleshooting with This Command

When troubleshooting ISAKMP negotiations, the `group` command's configuration is critical. Healthy output from `show crypto isakmp policy` will display the configured DH group for each policy. For example, 'Group 14' indicates a strong 2048-bit key exchange.

Problem indicators include mismatched DH groups between peers, which causes Phase 1 to fail. Common symptoms include 'No proposal chosen' errors in `debug crypto isakmp` or the VPN never coming up. Focus on the 'Group' field in the policy output.

If the peer's policy lists a different group, negotiation fails. The diagnostic flow: 1) Verify local ISAKMP policy with `show crypto isakmp policy`. 2) Check peer's policy (if accessible) or use `debug crypto isakmp` to see the proposals exchanged. 3) Look for 'Group mismatch' or 'No acceptable offer' messages. 4) Correlate with `show crypto isakmp sa` to see the state of the security association; if it stays in 'MM_NO_STATE', the DH group mismatch is likely. Another common issue is using a group that requires more CPU than the router can handle, causing timeouts.

In such cases, reduce the group size or upgrade hardware. Also, ensure that the lifetime and other parameters match. The `debug crypto isakmp` command is invaluable for real-time troubleshooting, showing the exact DH group being proposed and rejected.

For example, 'Group 2' in the debug output indicates the peer is offering group 2. If the local router expects group 14, it will respond with 'NO_PROPOSAL_CHOSEN'. Always correlate the debug output with the configured policy.

Additionally, `show crypto ipsec sa` can help confirm if Phase 2 fails due to Phase 1 issues. Remember that DH group negotiation happens during Main Mode (MM) or Aggressive Mode; mismatches are caught early in the exchange.

CCNA Exam Tips

1.

CCNA exam may ask which DH group is the most secure among options (group 14 > 5 > 2).

2.

Remember that DH group 2 is the default on many Cisco IOS versions; exam questions might test default values.

3.

Know that DH group mismatch is a common cause of IKE phase 1 failure; exam scenarios often include troubleshooting such issues.

4.

The 'group' command is configured in ISAKMP policy configuration mode; you must first enter 'crypto isakmp policy <priority>'.

Common Mistakes

Setting different DH groups on peers, causing IKE negotiation to fail.

Forgetting to apply the ISAKMP policy to the crypto map or interface, so the group setting is never used.

Using a DH group that is not supported by the peer device (e.g., group 14 on very old hardware).

group [2|5|14] vs crypto isakmp policy [priority]

These two commands are commonly confused because both are used in ISAKMP policy configuration but operate at different levels: 'crypto isakmp policy' creates the policy structure, while the 'group' command is a subcommand that sets the Diffie-Hellman group within an existing policy.

Aspectgroup [2|5|14]crypto isakmp policy [priority]
ScopeParameter within a single ISAKMP policyEntire ISAKMP policy
Configuration modeISAKMP Policy Config (submode)Global Config
PersistenceSaved as part of the policyPolicy itself saved in running config
PrecedenceLower (set within policy)Higher (policy priority order)
Typical useSpecify DH group for key exchangeCreate or edit ISAKMP policy

Use group [2|5|14] when you are inside an ISAKMP policy configuration and need to define the Diffie-Hellman group for that specific policy.

Use crypto isakmp policy [priority] when you need to create a new ISAKMP policy or modify an existing one from global configuration mode.

Platform Notes

In IOS-XE (e.g., 16.x), the `group` command syntax is identical to classic IOS. However, IOS-XE supports additional DH groups like 19, 20, 21, and 24, which are also available in IOS 15.x and later. In NX-OS, the equivalent command is `crypto isakmp policy <policy-number>` followed by `group <group-number>` within the policy configuration, but NX-OS uses a different configuration hierarchy (e.g., `config t`, `crypto isakmp policy 10`, `group 14`).

The output of `show crypto isakmp policy` on NX-OS is similar but may have different formatting. For ASA firewalls, the command is `crypto isakmp policy <priority>` then `group <group-number>`, but ASA also supports the `crypto ikev1 policy` and `crypto ikev2 policy` commands for newer versions. In ASA, the group is specified with the `group` command within the policy.

For IOS-XR, the command is `crypto isakmp policy <policy-number>` and then `group <group-number>`, but IOS-XR uses a different configuration mode (e.g., `configure`, `crypto isakmp policy 10`, `group 14`). Note that older IOS versions (12.x) only support groups 1, 2, and 5, while 15.x and later add groups 14, 15, 16, 19, 20, 21, and 24. Always check the specific platform documentation for supported groups.

The command behavior is consistent across platforms: it sets the DH group for the ISAKMP policy.

Related Commands

crypto isakmp policy [priority]

Creates or modifies an ISAKMP (IKE) policy for IPsec VPN negotiations, defining encryption, authentication, and key exchange parameters.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions