Courseiva
VPNISAKMP Policy Config

hash [sha|md5]

Specifies the hash algorithm (SHA or MD5) used for authentication in ISAKMP Phase 1 proposals to ensure data integrity and peer authentication.

Definition: hash [sha|md5] is a Cisco IOS isakmp policy config command. Specifies the hash algorithm (SHA or MD5) used for authentication in ISAKMP Phase 1 proposals to ensure data integrity and peer authentication.

Overview

The `hash` command in ISAKMP Policy Configuration mode specifies the hash algorithm used for authentication in Internet Security Association and Key Management Protocol (ISAKMP) Phase 1 proposals. This command is critical for ensuring data integrity and peer authentication during the establishment of IPsec VPN tunnels. In ISAKMP Phase 1, two peers negotiate a secure channel by agreeing on encryption, authentication, hash, Diffie-Hellman group, and lifetime parameters.

The hash algorithm (SHA or MD5) is used to create a message digest that verifies the integrity of the ISAKMP messages exchanged between peers. Without a proper hash, an attacker could modify the messages in transit, compromising the security of the VPN. The hash command is typically used when configuring a crypto ISAKMP policy (via `crypto isakmp policy <priority>`).

You would reach for this command when you need to define the authentication integrity method for IKE Phase 1. Alternatives include using the `authentication` command (which specifies the authentication method like pre-shared keys or certificates) and the `encryption` command (which specifies the encryption algorithm). The hash command is specifically for integrity, not confidentiality.

In the broader VPN configuration workflow, you first define ISAKMP policies (including hash), then configure IPsec transform sets, crypto ACLs, and crypto maps. Important IOS behavior: The hash command is entered in ISAKMP Policy Configuration mode (prompt: `Router(config-isakmp-policy)#`). The command takes effect immediately and is saved to the running configuration.

There is no buffered output; the command simply sets the parameter. Privilege level 15 (enable) is required to enter global configuration mode and then ISAKMP policy configuration mode. The hash algorithm must match on both peers; otherwise, Phase 1 negotiation fails.

Common mistake: using MD5 in production environments due to known vulnerabilities; SHA is recommended. The command does not affect other services; it only applies to the specific ISAKMP policy being configured. The hash algorithm is used in conjunction with the authentication method: for pre-shared keys, the hash is applied to the key and other parameters to create a hash for peer authentication.

For digital certificates, the hash is used in the signature process. Understanding the hash command is essential for CCNA and CCNP candidates as it appears in VPN configuration tasks and troubleshooting scenarios.

Syntax·ISAKMP Policy Config
hash [sha|md5]

When to Use This Command

  • Configuring a VPN between two branch offices requiring SHA-1 for stronger security.
  • Setting up a remote-access VPN with legacy devices that only support MD5.
  • Aligning hash algorithm with a peer that uses SHA-256 (though only SHA-1 and MD5 are available, this command sets the base).
  • Creating multiple ISAKMP policies with different hash algorithms for different peers.

Parameters

ParameterSyntaxDescription
hash-algorithmsha | md5Specifies the hash algorithm to use. Valid values are `sha` (Secure Hash Algorithm, 160-bit digest) and `md5` (Message Digest 5, 128-bit digest). SHA is more secure and recommended over MD5, which has known vulnerabilities. Common mistake: using MD5 for compatibility without considering security implications. The algorithm must match on both peers.

Command Examples

Setting SHA as the hash algorithm

hash sha

No output is displayed; the command configures the hash algorithm silently. Use 'do show crypto isakmp policy' to verify.

Setting MD5 as the hash algorithm

hash md5

No output is displayed; the command configures the hash algorithm silently. Use 'do show crypto isakmp policy' to verify.

Understanding the Output

This command does not produce any output when executed. To verify the configured hash algorithm, use 'show crypto isakmp policy'. In the output, look for the 'hash' field under the policy details.

For example: 'hash : sha' or 'hash : md5'. A correct configuration shows the desired algorithm. A mismatch with the peer will cause Phase 1 failures.

Ensure both ends use the same hash algorithm.

Configuration Scenarios

Configure ISAKMP Policy with SHA Hash for Site-to-Site VPN

Two branch offices (R1 and R2) need to establish a secure site-to-site VPN. The security policy requires SHA for integrity and pre-shared keys for authentication.

Topology

R1(Gi0/0)---10.0.12.0/30---(Gi0/0)R2

Steps

  1. 1.Step 1: Enter global configuration mode on R1: R1> enable
  2. 2.Step 2: Create ISAKMP policy with priority 10: R1# configure terminal
  3. 3.Step 3: Specify SHA hash: R1(config)# crypto isakmp policy 10
  4. 4.Step 4: Set authentication method to pre-share: R1(config-isakmp-policy)# hash sha
  5. 5.Step 5: Set encryption to AES 256: R1(config-isakmp-policy)# authentication pre-share
  6. 6.Step 6: Set Diffie-Hellman group 5: R1(config-isakmp-policy)# encryption aes 256
  7. 7.Step 7: Set lifetime to 86400 seconds: R1(config-isakmp-policy)# group 5
  8. 8.Step 8: Exit and configure pre-shared key: R1(config-isakmp-policy)# lifetime 86400
  9. 9.Step 9: Repeat similar configuration on R2 with matching parameters: R1(config-isakmp-policy)# exit
  10. 10.Step 10: Verify ISAKMP policy: R1(config)# crypto isakmp key cisco123 address 10.0.12.2
Configuration
! R1 ISAKMP Policy
crypto isakmp policy 10
 hash sha
 authentication pre-share
 encryption aes 256
 group 5
 lifetime 86400
crypto isakmp key cisco123 address 10.0.12.2
! R2 ISAKMP Policy
crypto isakmp policy 10
 hash sha
 authentication pre-share
 encryption aes 256
 group 5
 lifetime 86400
crypto isakmp key cisco123 address 10.0.12.1

Verify: Use `show crypto isakmp policy` to display configured policies. Expected output shows policy 10 with hash SHA. Also use `debug crypto isakmp` to see Phase 1 negotiation; successful output includes 'ISAKMP (0:0): phase 1 packet...' and 'ISAKMP (0:0): processing SA payload. proposal #1'.

Watch out: Common mistake: Forgetting to configure the pre-shared key on both peers with matching keys. If the key does not match, Phase 1 fails with 'invalid payload' errors.

Configure ISAKMP Policy with MD5 for Legacy Compatibility

A legacy remote site (R3) only supports MD5 hash. The central site (R1) must use MD5 for this specific peer while using SHA for others. A separate ISAKMP policy with lower priority is created.

Topology

R1(Gi0/0)---10.0.13.0/30---(Gi0/0)R3

Steps

  1. 1.Step 1: On R1, create a second ISAKMP policy with priority 20: R1(config)# crypto isakmp policy 20
  2. 2.Step 2: Set hash to md5: R1(config-isakmp-policy)# hash md5
  3. 3.Step 3: Set authentication to pre-share: R1(config-isakmp-policy)# authentication pre-share
  4. 4.Step 4: Set encryption to 3DES (legacy): R1(config-isakmp-policy)# encryption 3des
  5. 5.Step 5: Set group 2: R1(config-isakmp-policy)# group 2
  6. 6.Step 6: Set lifetime to 86400: R1(config-isakmp-policy)# lifetime 86400
  7. 7.Step 7: Exit and configure pre-shared key for R3: R1(config-isakmp-policy)# exit
  8. 8.Step 8: On R3, configure matching policy (priority 10 or any): R1(config)# crypto isakmp key legacykey address 10.0.13.2
Configuration
! R1 ISAKMP Policy for legacy peer
crypto isakmp policy 20
 hash md5
 authentication pre-share
 encryption 3des
 group 2
 lifetime 86400
crypto isakmp key legacykey address 10.0.13.2
! R3 ISAKMP Policy
crypto isakmp policy 10
 hash md5
 authentication pre-share
 encryption 3des
 group 2
 lifetime 86400
crypto isakmp key legacykey address 10.0.13.1

Verify: Use `show crypto isakmp policy` to see both policies. Use `show crypto isakmp sa` to see active security associations; for the legacy peer, the hash algorithm should be MD5. Use `debug crypto isakmp` to confirm negotiation; look for 'hash algorithm: MD5' in the debug output.

Watch out: Common mistake: Using MD5 in a mixed environment where other peers expect SHA. Ensure the correct policy is matched by priority; the peer will propose its own policy, and the responder will match based on the highest priority (lowest number) that matches all parameters. If no match, Phase 1 fails.

Troubleshooting with This Command

When troubleshooting ISAKMP Phase 1 issues, the hash command is often a suspect if peers cannot agree on a proposal. Healthy output from `show crypto isakmp policy` shows the configured hash algorithm (SHA or MD5) for each policy. Problem indicators include mismatched hash algorithms between peers, which results in Phase 1 failure with messages like 'ISAKMP: No acceptable proposal' or 'SA payload proposal not acceptable'.

In debug output (`debug crypto isakmp`), you will see the peer's proposal details; focus on the 'hash algorithm' field. If one peer sends SHA and the other expects MD5, negotiation fails. Common symptoms: VPN tunnel does not come up, 'show crypto isakmp sa' shows state MM_NO_STATE or MM_KEY_EXCH.

To diagnose, follow this flow: 1) Verify ISAKMP policies on both peers with `show crypto isakmp policy`. Ensure the hash algorithm matches. 2) Check the order of policies; the responder will use the first matching policy (lowest priority number) that matches all parameters. 3) Use `debug crypto isakmp` to see the exact proposals exchanged. Look for lines like 'ISAKMP (0:0): processing SA payload. proposal #1' and then 'ISAKMP (0:0): checking ISAKMP transform 1 against priority 10 policy'.

The debug will show which parameters are being compared. 4) If hash mismatch, correct the hash on one peer to match the other. 5) Also verify that the authentication method (pre-share or rsa-sig) and encryption algorithm match. Correlate with `show crypto isakmp sa detail` to see the negotiated parameters. If the tunnel is up, the hash algorithm used is displayed.

Another useful command is `show crypto ipsec sa` to see Phase 2 parameters, but hash is Phase 1. For advanced troubleshooting, use `debug crypto condition peer <ip>` to filter debug output for a specific peer. Remember that changing the hash algorithm requires re-negotiation; clear the existing SA with `clear crypto isakmp <connection-id>` or `clear crypto sa` to force rekey.

In summary, the hash command is a key parameter that must match; otherwise, Phase 1 fails. Always verify both sides.

CCNA Exam Tips

1.

CCNA exam tip: The default hash algorithm is SHA-1; MD5 is considered weaker and less secure.

2.

CCNA exam tip: The hash command is configured under ISAKMP policy config mode; you must first create a policy with 'crypto isakmp policy <priority>'.

3.

CCNA exam tip: Both peers must have matching hash algorithms (and other parameters) for IKE Phase 1 to succeed.

4.

CCNA exam tip: The exam may test that SHA is more secure than MD5; MD5 is still supported for backward compatibility.

Common Mistakes

Mistake 1: Forgetting to enter ISAKMP policy configuration mode before using the hash command, resulting in '% Invalid input detected'.

Mistake 2: Using 'hash sha256' or other unsupported algorithms; only 'sha' and 'md5' are valid.

Mistake 3: Configuring hash on one peer but not the other, causing IKE negotiation to fail.

hash [sha|md5] vs crypto isakmp policy [priority]

Both commands are part of ISAKMP Phase 1 configuration for IPsec VPNs, often confused because hash is a subcommand within an ISAKMP policy, while crypto isakmp policy creates the policy itself. Understanding their distinct roles is crucial for correct VPN setup.

Aspecthash [sha|md5]crypto isakmp policy [priority]
ScopeHash algorithm only (SHA or MD5) within a policyEntire ISAKMP policy (encryption, auth, DH group, lifetime)
Configuration modeISAKMP Policy Config (submode of global config)Global configuration mode
PersistenceSaved as part of the policy configurationSaved globally as a numbered policy entry
PrecedencePart of a policy; lower priority number = higher match precedenceSets the policy priority; lower number means higher match precedence
Typical useSpecify SHA or MD5 for data integrity and peer authenticationCreate or modify an IKE proposal with multiple parameters

Use hash [sha|md5] when you need to define the authentication hash algorithm within an existing ISAKMP policy.

Use crypto isakmp policy [priority] when you need to create a new ISAKMP policy or modify its overall parameters like encryption, authentication, and key exchange.

Platform Notes

In IOS-XE (e.g., 16.x), the `hash` command syntax is identical to classic IOS. The command is entered in ISAKMP Policy Configuration mode. However, IOS-XE also supports IKEv2, which uses different configuration (crypto ikev2 proposal).

For IKEv2, the hash algorithm is configured under `crypto ikev2 proposal` with the `integrity` command (e.g., `integrity sha256`). The `hash` command is specific to IKEv1 (ISAKMP). In NX-OS (e.g., Nexus 9000), the equivalent command is `crypto isakmp policy <priority>` and then `hash {sha | md5}`.

The syntax is similar, but NX-OS uses `crypto isakmp` instead of `crypto isakmp`. Note that NX-OS may have additional hash options like sha256. On ASA (Adaptive Security Appliance), the equivalent is `crypto isakmp policy <priority>` and then `hash {sha | md5}`.

ASA also supports `sha256`, `sha384`, `sha512` in newer versions. The command is the same but the prompt is `ciscoasa(config-isakmp-policy)#`. In IOS-XR, the command does not exist as a direct equivalent; IOS-XR uses IKEv2 with different configuration (e.g., `crypto ikev2 proposal` with `integrity`).

For IOS versions, the `hash` command has been available since at least IOS 12.x. In 15.x and 16.x, the command remains unchanged, but newer versions may support additional hash algorithms like `sha256` (introduced in some 15.x trains). Always check the specific IOS version documentation.

The command is not available in IOS-XR. When migrating from IOS to IOS-XE, the configuration is directly compatible. For NX-OS, be aware of the different prompt and potential additional hash options.

For ASA, the command is identical but the platform may have different default policies. In summary, the `hash` command is consistent across IOS, IOS-XE, and ASA, with minor variations in supported algorithms. NX-OS supports it similarly.

IOS-XR does not use this command.

Related Commands

crypto isakmp policy [priority]

Creates or modifies an ISAKMP (IKE) policy for IPsec VPN negotiations, defining encryption, authentication, and key exchange parameters.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions