Chapter8 Site-to-Site VPN
Create Site to Site VPN
8-50
Cisco Router and Security Device Manager Version 2.2 User’s Guide
OL-4015-08
Pre-Shared Key
Click this button if the VPN peers use a pre-shared key for authentication and then
enter the pre-shared key, and then reenter it for confirmation. Exchange the
pre-shared key with the administrator of the remote site through some secure and
convenient method, such as an encrypted e-mail message. Qu estion marks (?) and
spaces must not be used in the pre-shared key.
Note •The characters that you enter for the pre-shared key are not displa yed in the
field as you enter them. You may find it helpful to write down the key before
you enter it so that you can communicate it to the administrator of the remote
system.
•Pre-shared keys must be exchanged between each pair of IPSec peers that
need to establish secure tunnels. This authentication method is appropriate
for a stable network with a limited number of IPSec peers. It may cause
scalability problems in a network with a large or increasing number of IPSec
peers.
Digital Certificate
Click this button if the VPN peers will use digital certificates for authentication.
The router must have a digital certificate issued by a Certificate Authority to
authenticate itself. If you have not configured a digital certificate for the router,
go to VPN components, and use the Digital Certificate wizard to enroll for a
digital certificate.
Note If you are authenticating using digital certificates, the VPN tunnel mi ght not be
created if the CA server contacted during IKE negotiation is not configured to
respond to Certificate Revocation List (CRL) requests. To correct this problem,
go to the Digital Certificates page, select the configured trustpoint, and select
None for Revocation.