Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Can you have multiple crypto isakmp policies on a router?

I have an 1841 router acting as a hub for multiple IPSec tunnels. I have one ISAKMP policy that looks like this:

crypto isakmp policy 1

encr 3des

authentication pre-share

group 2

crypto isakmp key ******** address x.x.x.x

crypto isakmp key ******** address y.y.y.y

crypto isakmp key ******** address z.z.z.z

I want to start using AES as the ISAKMP encryption protocol, but I can't be there to change the other ends of all of the other tunnels. Can I create another crypto isakmp policy 2 and just put the pre-shared key for the new connections under that one while I am migrating?

Thanks,

Chris

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Blue

Re: Can you have multiple crypto isakmp policies on a router?

Chris

You can have multiple isakmp policies on your router. The router will run through them in order until it finds a match. So you just need to add a new isakmp policy with a different sequence number eg.

crypto isakmp policy 2

encr aes

auth pre-share

group 2

This will not affect your original isakmp policy.

Not sure what you mean by putting the pre-shared key "under" the isakmp policy. The key is not tied to anyone isakmp policy - you can see this from the configuration you supply above.

All you need to do to switch over is to configure the isakmp policy on your 1841 router and then change the remote sites over as and when you can. The ones you have changed will use AES, the one you haven't yet changed will continue to use 3DES.

HTH

Jon

2 REPLIES
Hall of Fame Super Blue

Re: Can you have multiple crypto isakmp policies on a router?

Chris

You can have multiple isakmp policies on your router. The router will run through them in order until it finds a match. So you just need to add a new isakmp policy with a different sequence number eg.

crypto isakmp policy 2

encr aes

auth pre-share

group 2

This will not affect your original isakmp policy.

Not sure what you mean by putting the pre-shared key "under" the isakmp policy. The key is not tied to anyone isakmp policy - you can see this from the configuration you supply above.

All you need to do to switch over is to configure the isakmp policy on your 1841 router and then change the remote sites over as and when you can. The ones you have changed will use AES, the one you haven't yet changed will continue to use 3DES.

HTH

Jon

New Member

Re: Can you have multiple crypto isakmp policies on a router?

Jon,

Thanks! That helps a lot.

You are also right that the crypto isakmp key ****** address x.x.x.x are not part of the crypto isakmp policy. I had assumed they were as they were always directly underneath the isakmp policy with no blank lines between. Now that I have added the second policy, the keys moved down.

Thanks!

1586
Views
0
Helpful
2
Replies