crypto isakmp key [key] address [peer]
Configures a pre-shared key for IKE (ISAKMP) authentication with a specific peer IP address, used to establish IPsec VPN tunnels.
Definition: crypto isakmp key [key] address [peer] is a Cisco IOS global config command. Configures a pre-shared key for IKE (ISAKMP) authentication with a specific peer IP address, used to establish IPsec VPN tunnels.
Overview
The `crypto isakmp key` command is a fundamental building block for establishing IPsec VPN tunnels on Cisco IOS devices. It configures a pre-shared key (PSK) that is used during Internet Key Exchange (IKE) Phase 1 authentication. IKE, originally defined as ISAKMP (Internet Security Association and Key Management Protocol), is the protocol responsible for negotiating security associations (SAs) and generating keys for IPsec.
The pre-shared key serves as a shared secret between two peers, proving their identity to each other before any encrypted traffic flows. This command is critical because without a matching PSK on both ends, IKE negotiation fails, and the VPN tunnel never comes up. Network engineers reach for this command when setting up site-to-site VPNs, remote-access VPNs (with a different command for client groups), or any scenario where two devices need to authenticate using a simple shared secret.
Alternatives include digital certificates (PKI) or RSA keys, which offer stronger security but require a certificate authority and more complex configuration. The `crypto isakmp key` command is typically used in the initial VPN setup workflow: first, configure IKE policies (crypto isakmp policy), then set the PSK with this command, then define the IPsec transform set, and finally apply everything in a crypto map. Important IOS behavior: the command is stored in the running configuration in clear text by default, which is a security concern; using 'encrypted' or 'password' options can obscure it.
The command requires global configuration mode (privilege level 15). It does not produce buffered output; it directly modifies the running config. When you issue the command, the router immediately uses the key for any new IKE negotiations with the specified peer.
If you change the key, existing tunnels using the old key will be rekeyed only after the current SA expires or is cleared. The command can be removed with 'no crypto isakmp key [key] address [peer]'. It is important to note that the peer address must match the IP address of the remote VPN endpoint (usually the peer's public interface).
For dynamic peers (e.g., dial-up VPN), you can use '0.0.0.0' as the peer address, but this is less secure. The command also supports IPv6 addresses in later IOS versions. In summary, this command is a simple yet essential tool for IKE authentication, and understanding its nuances is key to successful VPN deployments.
crypto isakmp key [key] address [peer]When to Use This Command
- Setting up a site-to-site VPN between two branch offices using pre-shared keys.
- Configuring remote access VPN where a remote user connects to the corporate network.
- Establishing a VPN tunnel between a Cisco router and a third-party firewall that supports IKE.
- Replacing an expired or compromised pre-shared key for an existing VPN peer.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| key | text string (e.g., MySecretKey123) | The pre-shared key used for authentication. It can be any alphanumeric string up to 128 characters. Common mistakes include using weak keys (e.g., 'cisco') or mismatched keys between peers. The key is case-sensitive and must be identical on both ends. |
| peer | A.B.C.D (IPv4 address) or X:X:X:X::X (IPv6 address) | The IP address of the remote IKE peer. This is typically the public IP address of the remote VPN gateway. For dynamic peers, use 0.0.0.0 to match any peer. Common mistakes include using the wrong IP address (e.g., internal IP instead of public) or forgetting to update the address if the peer's IP changes. |
Command Examples
Basic pre-shared key configuration for a single peer
crypto isakmp key MySecretKey address 192.168.1.100Router(config)# crypto isakmp key MySecretKey address 192.168.1.100 Router(config)#
The command enters global configuration mode and sets the pre-shared key 'MySecretKey' for the peer at IP 192.168.1.100. No output is generated if successful; the prompt returns.
Verifying the ISAKMP key configuration
show crypto isakmp keyKeyring : default Key : MySecretKey Address : 192.168.1.100 Port : 500 Conn-id : 1
The output shows the keyring (default), the pre-shared key (masked in real output but shown here), peer address, UDP port 500 (ISAKMP), and a connection ID. This confirms the key is configured.
Understanding the Output
The 'show crypto isakmp key' command displays configured pre-shared keys. The 'Keyring' field indicates the keyring name (default if not specified). 'Key' shows the key value (often masked as asterisks in live output).
'Address' is the peer IP. 'Port' is always 500 for ISAKMP. 'Conn-id' is an internal identifier.
A missing entry means no key is configured for that peer. Multiple keys can appear for different peers. If the key is incorrect or missing, IKE negotiation will fail with 'invalid payload' or 'authentication failure' errors.
Configuration Scenarios
Site-to-Site VPN between two branch routers
Two branch offices need to securely communicate over the internet. Each office has a Cisco router with a public IP address. The goal is to establish an IPsec VPN tunnel between them using pre-shared key authentication.
Topology
Branch1 (Gi0/0: 203.0.113.1)---Internet---(Gi0/0: 198.51.100.1) Branch2Steps
- 1.Step 1: Enter global configuration mode on Branch1: configure terminal
- 2.Step 2: Configure IKE policy: crypto isakmp policy 10
- 3.Step 3: Set authentication method: authentication pre-share
- 4.Step 4: Set encryption and hash (optional): encryption aes 256; hash sha
- 5.Step 5: Set Diffie-Hellman group: group 14
- 6.Step 6: Configure the pre-shared key: crypto isakmp key MySecretKey123 address 198.51.100.1
- 7.Step 7: Configure IPsec transform set: crypto ipsec transform-set AES256-SHA esp-aes 256 esp-sha-hmac
- 8.Step 8: Create crypto map: crypto map VPN-MAP 10 ipsec-isakmp
- 9.Step 9: Set peer, transform set, and ACL: set peer 198.51.100.1; set transform-set AES256-SHA; match address VPN-ACL
- 10.Step 10: Apply crypto map to interface: interface GigabitEthernet0/0; crypto map VPN-MAP
- 11.Step 11: Repeat similar steps on Branch2 with the key and peer address reversed.
! Branch1 configuration crypto isakmp policy 10 authentication pre-share encryption aes 256 hash sha group 14 crypto isakmp key MySecretKey123 address 198.51.100.1 crypto ipsec transform-set AES256-SHA esp-aes 256 esp-sha-hmac access-list 100 permit ip 10.1.1.0 0.0.0.255 10.2.2.0 0.0.0.255 crypto map VPN-MAP 10 ipsec-isakmp set peer 198.51.100.1 set transform-set AES256-SHA match address 100 interface GigabitEthernet0/0 ip address 203.0.113.1 255.255.255.0 crypto map VPN-MAP
Verify: Use 'show crypto isakmp sa' to verify IKE Phase 1 status. Expected output shows 'MM_ACTIVE' state for the peer. Use 'show crypto ipsec sa' to verify IPsec SAs. Expected output shows packets encrypted/decrypted.
Watch out: A common mistake is forgetting to configure the ACL on both routers to match interesting traffic. Without a matching ACL, the router will not initiate the VPN tunnel.
Remote-access VPN with dynamic peer (0.0.0.0)
A company wants to allow remote employees to connect to the corporate network using VPN clients. The corporate router has a static public IP, but remote clients have dynamic IPs. The pre-shared key must be configured to accept any peer address.
Topology
Remote Client (Dynamic IP)---Internet---(Gi0/0: 203.0.113.1) Corporate RouterSteps
- 1.Step 1: Enter global configuration mode on Corporate Router: configure terminal
- 2.Step 2: Configure IKE policy: crypto isakmp policy 10
- 3.Step 3: Set authentication: authentication pre-share
- 4.Step 4: Configure pre-shared key for any peer: crypto isakmp key ClientPSK123 address 0.0.0.0
- 5.Step 5: Configure IPsec transform set: crypto ipsec transform-set AES128-SHA esp-aes 128 esp-sha-hmac
- 6.Step 6: Create dynamic crypto map: crypto dynamic-map DYN-MAP 10
- 7.Step 7: Set transform set: set transform-set AES128-SHA
- 8.Step 8: Create crypto map and apply dynamic map: crypto map CLIENT-MAP 10 ipsec-isakmp dynamic DYN-MAP
- 9.Step 9: Apply crypto map to interface: interface GigabitEthernet0/0; crypto map CLIENT-MAP
- 10.Step 10: Configure the VPN client with the same pre-shared key and the corporate router's public IP.
! Corporate Router configuration crypto isakmp policy 10 authentication pre-share crypto isakmp key ClientPSK123 address 0.0.0.0 crypto ipsec transform-set AES128-SHA esp-aes 128 esp-sha-hmac crypto dynamic-map DYN-MAP 10 set transform-set AES128-SHA crypto map CLIENT-MAP 10 ipsec-isakmp dynamic DYN-MAP interface GigabitEthernet0/0 ip address 203.0.113.1 255.255.255.0 crypto map CLIENT-MAP
Verify: Use 'show crypto isakmp sa' to see active IKE SAs. The peer address will be the client's public IP. Use 'show crypto ipsec sa' to verify IPsec SAs. Use 'show crypto map' to see the dynamic map applied.
Watch out: Using 0.0.0.0 as the peer address is less secure because any peer with the correct PSK can initiate a connection. It is recommended to use a strong PSK and consider additional authentication methods like XAUTH.
Troubleshooting with This Command
When troubleshooting IKE authentication issues, the `crypto isakmp key` command is often the first place to check. A healthy IKE Phase 1 negotiation results in an active security association (SA) in state MM_ACTIVE (Main Mode) or AG_INIT_EXCH (Aggressive Mode). Use `show crypto isakmp sa` to view the state.
If the state is MM_NO_STATE or MM_KEY_EXCH, the pre-shared key may be mismatched or missing. Common symptoms include: the VPN tunnel never comes up, 'ISAKMP: Unable to find a matching SA' messages in logs, or 'invalid payload' errors. To diagnose, first verify that the pre-shared key is configured on both peers using `show running-config | include crypto isakmp key`.
Ensure the key string is identical (case-sensitive) and that the peer address matches the remote device's IP address. If using dynamic peers (0.0.0.0), confirm that the key is correct and that the router is not configured with a more specific key for a different peer that might override it. Next, check IKE policies: `show crypto isakmp policy` to ensure both peers have a matching policy (same encryption, hash, DH group, authentication method).
If policies match but authentication fails, use `debug crypto isakmp` to see detailed negotiation messages. Look for 'authentication failure' or 'pre-shared key mismatch' lines. The debug output will show the proposed and accepted transforms.
If the key is correct but the peer address is wrong, the router will not find a matching key entry. Also, verify that the crypto map is applied to the correct interface and that ACLs permit the traffic. For IPsec SAs, use `show crypto ipsec sa` to see if packets are being encrypted/decrypted.
If the SA shows 'pkts encaps' and 'pkts decap' as zero, the tunnel may not be passing traffic. Another useful command is `show crypto session` which provides a summary of active crypto sessions. In summary, a systematic approach: 1) Verify key configuration, 2) Check IKE policies, 3) Enable debugs, 4) Verify crypto map application, 5) Check ACLs.
Correlate `show crypto isakmp sa` with `debug crypto isakmp` to pinpoint the exact failure point.
CCNA Exam Tips
CCNA exam tip: The 'crypto isakmp key' command is used in Phase 1 of IPsec; the key must match exactly on both peers.
CCNA exam tip: The key is case-sensitive and can include special characters; exam questions may test this.
CCNA exam tip: Use 'show crypto isakmp sa' to verify Phase 1 SA status; if it shows MM_NO_STATE, the key may be mismatched.
CCNA exam tip: The 'address' parameter can be '0.0.0.0' to match any peer (dynamic VPN), but this is less secure.
Common Mistakes
Mistake 1: Typing the key incorrectly or with extra spaces, causing authentication failure and no VPN establishment.
Mistake 2: Forgetting to configure the same key on both peers; IKE will fail with 'authentication failure' messages.
Mistake 3: Using a weak or easily guessable key; best practice is to use a complex string.
crypto isakmp key [key] address [peer] vs crypto isakmp policy [priority]
These two commands are often considered together because both configure IKE (ISAKMP) parameters for IPsec VPNs. However, 'crypto isakmp key' defines the pre-shared key for authenticating a specific peer, while 'crypto isakmp policy' defines the negotiation parameters (encryption, hash, DH group, etc.) for the IKE phase 1 exchange. Understanding their distinct roles is crucial for building a working VPN.
| Aspect | crypto isakmp key [key] address [peer] | crypto isakmp policy [priority] |
|---|---|---|
| Scope | Defines shared secret for a peer | Defines IKE proposal parameters |
| Function | Authenticates peer identity | Sets encryption, hash, auth, DH group, lifetime |
| Configuration Mode | Global config | Global config (then subcommands) |
| Persistence | Applies to all policies for that peer | Part of policy list, ordered by priority |
| Precedence | Key must match on both ends | Policies negotiated; higher priority tried first |
| Typical Use | Single remote peer with pre-shared key | Multiple policies for different security levels |
Use crypto isakmp key [key] address [peer] when you need to specify a pre-shared authentication key for a specific remote peer in IPsec VPN.
Use crypto isakmp policy [priority] when you need to define the IKE phase 1 parameters (encryption, hash, authentication, DH group, lifetime) to be proposed during VPN negotiation.
Platform Notes
In IOS-XE (e.g., CSR1000v, ISR 4000 series), the `crypto isakmp key` command syntax is identical to classic IOS. However, IOS-XE often uses the newer IKEv2 by default, which uses `crypto ikev2 key-ring` instead. For IKEv1, the command remains the same.
In NX-OS (Cisco Nexus switches), the equivalent command is `crypto isakmp key [key] address [peer]` but note that NX-OS uses a different configuration hierarchy: you must first create an IKE policy and then apply the key under a keyring. For example: `crypto keyring MYKEYRING; pre-shared-key address 10.0.0.1 key MySecret`. The command `crypto isakmp key` is not directly used in NX-OS; instead, keys are defined within keyrings.
On Cisco ASA firewalls, the equivalent is `crypto isakmp key [key] address [peer] netmask [mask]` (the netmask is optional). The ASA syntax is very similar but requires a netmask for the peer address. For example: `crypto isakmp key MySecret address 198.51.100.1 netmask 255.255.255.255`.
In IOS-XR (Cisco routers running IOS-XR), the command does not exist; instead, IKEv1 is not supported, and IKEv2 uses a different configuration model with key chains. For example: `crypto ikev2 key chain MYCHAIN; key 1; key-string MySecret; match identity address 10.0.0.1`. Therefore, the `crypto isakmp key` command is specific to IOS/IOS-XE and ASA.
In terms of version differences, IOS 12.x and 15.x support the same syntax, but 15.x introduced support for IPv6 addresses. IOS 16.x (IOS-XE) maintains backward compatibility. Always check the specific platform documentation, as some features like 'encrypted' key storage may vary.
Related Commands
crypto ipsec transform-set [name] esp-aes esp-sha-hmac
Defines an IPsec transform set specifying the encryption and authentication algorithms to protect VPN traffic, used when configuring an IPsec VPN policy.
crypto isakmp policy [priority]
Creates or modifies an ISAKMP (IKE) policy for IPsec VPN negotiations, defining encryption, authentication, and key exchange parameters.
crypto map [name] [seq] ipsec-isakmp
Creates or modifies a crypto map entry for IPsec VPN configuration, defining the security policies and peer parameters for IKE and IPsec negotiations.
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions