Cisco Systems 520 series manual Configure the IKE Policy

Chapter 7 Configuring VPNs Using an IPsec Tunnel and Generic Routing Encapsulation

Configure a VPN

Configure the IKE Policy

Perform these steps to configure the Internet Key Exchange (IKE) policy, beginning in global configuration mode:

	Command or Action	Purpose
Step 1
	crypto isakmp policy priority	Creates an IKE policy that is used during IKE
		negotiation. The priority is a number from 1 to
	Example:	10000, with 1 being the highest.
	Router(config)# crypto isakmp policy 1	Also enters Internet Security Association and Key
	Router(config-isakmp)#	Management Protocol (ISAKMP) policy
		configuration mode.
Step 2
	encryption {des 3des aes aes 192 aes 256}	Specifies the encryption algorithm used in the
		IKE policy.
	Example:	The example uses 168-bit Data Encryption
	Router(config-isakmp)# encryption 3des	Standard (DES).
	Router(config-isakmp)#
Step 3
	hash {md5 sha}	Specifies the hash algorithm used in the IKE
		policy.
	Example:	The example specifies the Message Digest 5
	Router(config-isakmp)# hash md5	(MD5) algorithm. The default is Secure Hash
	Router(config-isakmp)#	standard (SHA-1).
Step 4
	authentication {rsa-sig rsa-encr pre-share}	Specifies the authentication method used in the
		IKE policy.
	Example:	The example uses a pre-shared key.
	Router(config-isakmp)# authentication
	pre-share
	Router(config-isakmp)#
Step 5
	group {1 2 5}	Specifies the Diffie-Hellman group to be used in
		the IKE policy.
	Example:
	Router(config-isakmp)# group 2
	Router(config-isakmp)#
Step 6
	lifetime seconds	Specifies the lifetime, 60–86400 seconds, for an
		IKE security association (SA).
	Example:
	Router(config-isakmp)# lifetime 480
	Router(config-isakmp)#
Step 7
	exit	Exits IKE policy configuration mode, and enters
		global configuration mode.
	Example:
	Router(config-isakmp)# exit
	Router(config)#

Cisco Secure Router 520 Series Software Configuration Guide

OL-14210-01 7-3