Configuring Internet Key Exchange Security Protocol

For a complete description of the IKE commands used in this chapter, refer to the "Internet Key Exchange Security Protocol Commands" chapter in the Cisco IOS Security Command Reference. To locate documentation of other commands that appear in this chapter, use the command reference master index or search online.

• IPSec---IP Security Protocol. IPSec is a framework of open standards that provides data confidentiality, data integrity, and data authentication between participating peers. IPSec provides these security services at the IP layer; it uses IKE to handle negotiation of protocols and algorithms based on local policy, and to generate the encryption and authentication keys to be used by IPSec. IPSec can be used to protect one or more data flows between a pair of hosts, between a pair of security gateways, or between a security gateway and a host.

For more information on IPSec, see the "Configuring IPSec Network Security" chapter.

The component technologies implemented for use by IKE include:

Cisco IOS also implements Triple DES (168-bit) encryption, depending on the software versions available for a specific platform. Triple DES (3DES) is a strong form of encryption that allows sensitive information to be transmitted over untrusted networks. It enables customers, particularly in the finance industry, to utilize network layer encryption.

---

Note Cisco IOS images with strong encryption (including, but not limited to, 56-bit data encryption feature sets) are subject to United States government export controls, and have a limited distribution. Images to be installed outside the United States require an export license. Customer orders might be denied or subject to delay due to United States government regulations. Contact your sales representative or distributor for more information, or send e-mail to export@cisco.com.

---

IKE interoperates with the following standard:

data authentication---Includes two concepts:

• Data integrity (verify that data has not been altered).

• Data origin authentication (verify that the data was actually sent by the claimed sender).

Data authentication can refer either to integrity alone or to both of these concepts (although data origin authentication is dependent upon data integrity).

peer---In the context of this chapter, a peer refers to a router or other device that participates in IPSec and IKE.

After the two peers agree upon a policy, the security parameters of the policy are identified by a security association established at each peer, and these security associations apply to all subsequent IKE traffic during the negotiation.

You can create multiple, prioritized policies at each peer to ensure that at least one policy will match a remote peer's policy.

If you are interoperating with a device that supports only one of the values for a parameter, your choice is limited to the other device's supported value. Aside from this, there is often a trade-off between security and performance, and many of these parameter values represent such a trade-off. You should evaluate the level of your network's security risks and your tolerance for these risks. Then the following tips might help you select which value to specify for each parameter:

MD5 has a smaller digest and is considered to be slightly faster than SHA-1. There has been a demonstrated successful (but extremely difficult) attack against MD5; however, the HMAC variant used by IKE prevents this attack.

	Command	Purpose
Step1	Router (config)# crypto isakmp policy priority	Identifies the policy to create. (Each policy is uniquely identified by the priority number you assign.) (This command puts you into the config-isakmp command mode.)
Step2	Router (config-isakmp)# encryption {des | 3des}	Specifies the encryption algorithm.
Step3	Router (config-isakmp)# hash {sha | md5}	Specifies the hash algorithm.
Step4	Router (config-isakmp)# authentication {rsa-sig | rsa-encr | pre-share}	Specifies the authentication method.
Step5	Router (config-isakmp)# group {1 | 2}	Specifies the Diffie-Hellman group identifier.
Step6	Router (config-isakmp)# lifetime seconds	Specifies the security association's lifetime.
Step7	Router (config-isakmp)# exit	Exits the config-isakmp command mode.
Step8	Router (config)# exit	Exits the global configuration mode.
Step9	Router# show crypto isakmp policy	(Optional) Displays all existing IKE policies. (Use this command in EXEC mode.)

If you do not specify a value for a parameter, the default value is assigned.

NoteThe default policy and the default values for configured policies do not show up in the configuration when you issue a show running command. Instead, to see the default policy and any default values within configured policies, use the show crypto isakmp policy command.

Each authentication method requires additional companion configuration as follows:

If you specify RSA signatures as the authentication method in a policy, you must configure the peers to obtain certificates from a certification authority (CA). (And, of course, the CA must be properly configured to issue the certificates.) Configure this certificate support as described in the "Configuring Certification Authority Interoperability" chapter.

The certificates are used by each peer to securely exchange public keys. (RSA signatures requires that each peer has the remote peer's public signature key.) When both peers have valid certificates, they will automatically exchange public keys with each other as part of any IKE negotiation in which RSA signatures are used.

To manually configure RSA keys, perform these tasks at each IPSec peer that uses RSA encrypted nonces in an IKE policy:

	Command	Purpose
Step1	Router (config)# crypto key generate rsa [usage-keys]	Generates RSA keys.
Step2	Router# show crypto key mypubkey rsa	Displays the generated RSA public key (in EXEC mode).

Remember to repeat these tasks at each peer (without CA support) that uses RSA encrypted nonces in an IKE policy.

When two peers use IKE to establish IPSec security associations, each peer sends its identity to the remote peer. Each peer sends either its host name or its IP address, depending on how you have the router's ISAKMP identity set.

By default, a peer's ISAKMP identity is the peer's IP address. If appropriate, you could change the identity to be the peer's host name instead. As a general rule, set all peers' identities the same way---either all peers should use their IP address, or all peers should use their host name. If some peers use their host name and some peers use their IP address to identify themselves to each other, IKE negotiations could fail if a remote peer's identity is not recognized and a DNS lookup is unable to resolve the identity.

To set a peer's ISAKMP identity, use the following commands in global configuration mode:

	Command	Purpose
Step1	Router (config)# crypto isakmp identity {address | hostname}	At the local peer: Specifies the peer's ISAKMP identity by IP address or by host name.1
Step2	Router (config)# ip host hostname address1 [address2...address8]	At all remote peers: If the local peer's ISAKMP identity was specified using a host name, maps the peer's host name to its IP address(es) at all the remote peers. (This step might be unnecessary if the host name/address is already mapped in a DNS server.)

1See the crypto isakmp identity command description for guidelines for when to use the IP address vs. the host name.

Remember to repeat these tasks at each peer that uses pre-shared keys in an IKE policy.

	Command	Purpose
Step1	Router (config)# crypto key pubkey-chain rsa	Enters public key chain configuration mode.
Step2	Router (config-pubkey-c)# named-key key-name [encryption | signature] or Router (config-pubkey-c)# addressed-key key-address [encryption | signature]	Indicates which remote peer's RSA public key you are going to specify. Enters public key configuration mode. If the remote peer uses its host name as its ISAKMP identity, use the named-key command and specify the remote peer's fully qualified domain name (such as somerouter.example.com) as the key-name. If the remote peer uses its IP address as its ISAKMP identity, use the addressed-key command and specify the remote peer's IP address as the key-address.
Step3	Router (config-pubkey-k)# address ip-address	If you used a fully qualified domain name to name the remote peer in Step2 (using the named-key command), you can optionally specify the remote peer's IP address.
Step4	Router (config-pubkey-k)# key-string key-string	Specifies the remote peer's RSA public key. This is the key viewed by the remote peer's administrator previously when he generated his router's RSA keys.
Step5	Router (config-pubkey-k)# quit	Returns to public key chain configuraiton mode.
Step6	---	Repeat Steps 2 through 4 to specify the RSA public keys of all the other IPSec peers that use RSA encrypted nonces in an IKE policy.
Step7	Router (config-pubkey-c)# exit	Returns to global configuration mode.

Remember to repeat these tasks at each peer that uses RSA encrypted nonces in an IKE policy.

Command	Purpose
Router# show crypto key pubkey-chain rsa {name key-name | address key-address}	Displays a list of all the RSA public keys stored on your router, or displays details of a particular RSA public key stored on your router.

	Command	Purpose
Step1	Router (config)# crypto isakmp key keystring address peer-address or Router (config)# crypto isakmp key keystring hostname peer-hostname	At the local peer: Specifies the shared key to be used with a particular remote peer. If the remote peer specified their ISAKMP identity with an address, use the address keyword in this step; otherwise use the hostname keyword in this step.
Step2	Router (config)# crypto isakmp key keystring address peer-address or Router (config)# crypto isakmp key keystring hostname peer-hostname	At the remote peer: Specifies the shared key to be used with the local peer. This is the same key you just specified at the local peer. If the local peer specified their ISAKMP identity with an address, use the address keyword in this step; otherwise use the hostname keyword in this step.
Step3	---	Repeat the previous two steps for each remote peer.

Remember to repeat these tasks at each peer that uses pre-shared keys in an IKE policy.

To implement IPSec Virtual Private Networks (VPNs) between remote access clients with dynamic IP addresses and a corporate gateway, you have to dynamically administer scalable IPSec policy on the gateway once each client is authenticated. With IKE Mode Configuration, the gateway can set up scalable policy for a very large set of clients irrespective of the IP addresses of those clients.

• Gateway initiation---Gateway initiates the configuration mode with the client. Once the client responds, the IKE modifies the sender's identity, the message is processed, and the client receives a response.

• Client initiation---Client initiates the configuration mode with the gateway. The gateway responds with an IP address it has allocated for the client.

• Interfaces with crypto maps which are configured for IKE Mode Configuration may experience a slightly longer connection set up time. This is true even for IKE peers that refuse to be configured or do not respond to the configuration mode request. In both cases, the gateway initiates the configuration of the client.

• At the time of this publication, this feature is an IETF draft with limited support. Therefore, this feature was not designed to enable the configuration mode for every IKE connection by default. Configure this feature at the global crypto map level.

• The following items in the IETF draft are not currently supported:

  • Configuration attributes other than INTERNAL_IP_ADDRESS

  • Unprotected exchanges

There are two steps to configuring IKE Mode Configuration on a router:

1. Define the pool of IP addresses.

2. Define which crypto maps should attempt to configure clients.

	Command	Purpose
Step1	router(config)# ip local pool pool-name start-addr end-addr	Existing local address pools are used to define a set of addresses. To define a local address pool, use the existing ip local pool command. For more information on the ip local pool command, refer to the Cisco IOS Dial Services Command Reference.
Step2	router(config)# crypto isakmp client configuration address-pool local pool-name	The local pool references the IKE configuration. To reference this local address pool in the IKE configuration, use the new crypto isakmp client configuration address-pool local command. For more information on the crypto isakmp client configuration address-pool local command, refer to the Cisco IOS Security Command Reference.
Step3	router(config)# crypto map tag client configuration address [initiate | respond]	To configure IKE Mode Configuration in global crypto map configuration mode, use the new crypto map client configuration address command. For more information on the crypto map client configuration address command, refer to the CiscoIOS Security Command Reference.

Dynamic Tunnel Endpoint Discovery allows IPSec to scale to large networks by reducing multiple encryptions, reducing the setup time, and allowing for simple configurations on participating peer routers. Each node has a simple configuration that defines the local network that the router is protecting and the IPSec transforms that are required.

• The Internet Key Exchange (IKE) cannot occur until the peer is identified. You can identify the peer using the crypto dynamic-map command. Using the discover keyword with this command, the receiving router sends a probe out to receive a response from the peer router.

• This feature is only available on dynamic crypto maps. The dynamic crypto map template is based on the dynamic crypto map performing peer discovery. Although there are no access-list restrictions on the dynamic crypto map template, the dynamic crypto map template should cover data sourced from the protected traffic and the receiving router using the any keyword. When using the any keyword, include explicit deny statements to exempt routing protocol traffic prior to entering the permit any command.

To create a dynamic crypto map entry with Tunnel Endpoint Discovery configured, use the following commands, beginning in crypto-map configuration mode:

	Command	Purpose
Step1	Router (config)# crypto dynamic-map dynamic-map-name dynamic-map-number Router (config-crypto-m)# set transform-set transform-set-name1 [transform-set-name2...transform-set-name6] Router (config-crypto-m)# match address access-list-id Router (config-crypto-m)# set peer {hostname | ip-address} Router (config-crypto-m)# set security-association lifetime seconds seconds and/or Router (config-crypto-m)# set security-association lifetime kilobytes kilobytes Router (config-crypto-m)# set pfs [group1 | group2] Router (config-crypto-m)# exit	Configures a dynamic crypto map using the crypto dynamic-map command. For more information on the crypto dynamic-map command, refer to the "IPSec Network Security Commands" chapter of the Cisco IOS Security Command Reference.
Step2	Router (config)# crypto map map-name map-number ipsec-isakmp dynamic dynamic-map-name [discover]	(Optional) Adds a crypto map set to a static crypto map set. For more information on the crypto map command, refer to the "IPSec Network Security Commands" chapter of the Cisco IOS Security Command Reference. (Optional) Enter the discover keyword on the dynamic crypto map to enable peer discovery. After the dynamic crypto map template permits an outbound packet, peer discovery occurs when the packet reaches an interface configured with the dynamic crypto map.

	Command	Purpose
Step1	Router# show crypto isakmp sa	Displays existing IKE connections; note the connection identifiers for connections you wish to clear.
Step2	Router# clear crypto isakmp [connection-id]	Clears IKE connections.

Command	Purpose
Router# show crypto isakmp policy	Displays the parameters for each configured IKE policy.
Router# show crypto isakmp sa	Displays all current IKE security associations.
Router# show running-config	Verifies IKE configuration.
Router# debug crypto isakmp	Displays debug messages about IKE events.

crypto isakmp policy 15
encryption 3des
hash md5
authentication rsa-sig
group 2
lifetime 5000
crypto isakmp policy 20
authentication pre-share
lifetime 10000
crypto isakmp key 1234567890 address 192.168.224.33
 

In the preceding example, the encryption des of policy 15 would not appear in the written configuration because this is the default value for the encryption algorithm parameter.

If the show crypto isakmp policy command is issued with this configuration, the output would be as follows:

Protection suite priority 15
	encryption algorithm:	DES - Data Encryption Standard (56 bit keys)
	hash algorithm:	Message Digest 5
	authentication method:	Rivest-Shamir-Adleman Signature
	Diffie-Hellman group:	#2 (1024 bit)
	lifetime:	5000 seconds, no volume limit
Protection suite priority 20
	encryption algorithm:	DES - Data Encryption Standard (56 bit keys)
	hash algorithm:	Secure Hash Standard
	authentication method:	Pre-Shared Key
	Diffie-Hellman group:	#1 (768 bit)
	lifetime:	10000 seconds, no volume limit
Default protection suite
	encryption algorithm:	DES - Data Encryption Standard (56 bit keys)
	hash algorithm:	Secure Hash Standard
	authentication method:	Rivest-Shamir-Adleman Signature
	Diffie-Hellman group:	#1 (768 bit)
	lifetime:	86400 seconds, no volume limit
 

Note that although the output shows "no volume limit" for the lifetimes, you can currently only configure a time lifetime (such as 86,400 seconds); volume limit lifetimes are not configurable.