Configuring IKE

isakmp policy priority
 

  For example:

isakmp policy 20 
 

   b. Specify the encryption algorithm:

isakmp policy priority encryption des | 3des
 

  For example:

isakmp policy 20 encryption des
 

   c. Specify the hash algorithm:

isakmp policy priority hash md5 | sha
 

  For example:

isakmp policy 20 hash md5
 

   d. Specify the authentication method:

isakmp policy priority authentication pre-share | rsa-sig
 

  For example:

isakmp policy 20 authentication rsa-sig
 

Note   If you specify the authentication method of pre-shared keys, you are required to manually configure these keys. See "Configuring IKE Pre-Shared (Authentication) Keys Manually."

   e. Specify the Diffie-Hellman group identifier:

isakmp policy priority group 1 | 2
 

  For example:

isakmp policy 20 group2
 

   f. Specify the security association's lifetime:

isakmp policy priority lifetime seconds
 

  For example:

isakmp policy 20 lifetime 5000
 

The following example shows two policies with policy 20 as the highest priority, policy 30 as the next priority, and the existing default policy as the lowest priority:

isakmp policy 20 encryption des
isakmp policy 20 hash md5
isakmp policy 20 authentication rsa-sig
isakmp policy 20 group 2
isakmp policy 20 lifetime 5000
 
isakmp policy 30 authentication pre-share
isakmp policy 30 lifetime 10000
 

In this example, the encryption des of policy 20 would not appear in the written configuration because this is the default for the encryption algorithm parameter.

Step 2   (Optional) View all existing IKE policies:

show isakmp policy
 

The following is an example of the output after the policies 20 and 30 in the previous example were configured:

Protection suite priority 20
        encryption algorithm:   DES - Data Encryption Standard (56 bit keys)
        hash algorithm: Message Digest 5
        authentication method:  Rivest-Shamir-Adleman Signature
        Diffie-Hellman group:   #2 (1024 bit)
        lifetime:       5000 seconds, no volume limit
Protection suite priority 30
        encryption algorithm:   DES - Data Encryption Standard (56 bit keys)
        hash algorithm: Secure Hash Standard
        authentication method:  Pre-Shared Key
        Diffie-Hellman group:   #1 (768 bit)
        lifetime:       10000 seconds, no volume limit
Default protection suite
        encryption algorithm:   DES - Data Encryption Standard (56 bit keys)
        hash algorithm: Secure Hash Standard
        authentication method:  Rivest-Shamir-Adleman Signature
        Diffie-Hellman group:   #1 (768 bit)
        lifetime:       86400 seconds, no volume limit

Note   Although the output shows "no volume limit" for the lifetimes, you can currently only configure a time lifetime (such as 86,400 seconds) with IKE; volume limit lifetimes are not currently configurable.

isakmp key keystring address peer-address [netmask mask]
 

For example:

isakmp key 1234567890 address 192.168.1.100
 

The pre-shared key is 1234567890, and the peer's address is 192.168.1.100.

Note   Netmask allows you to configure a single key to be shared among multiple peers. You would use the netmask of 0.0.0.0. However, Cisco strongly recommends using a unique key for each peer.

Note   The pre-shared key must be configured at both the PIX Firewall and its peer, otherwise the policy cannot be used.

Note   Configure a pre-shared key associated with a given security gateway to be distinct from a wildcard, pre-shared key (pre-shared key plus a netmask of 0.0.0.0) used to identify and authenticate the remote VPN clients.