Cisco 7100 Series Especificaciones descargar pdf (Pagina 82)

Step 2—Configuring Encryption and an IPSec Tunnel

Cisco 7100 Series VPN Configuration Guide

4-10

Conﬁguring a Different Shared Key

Because preshared keys were speciﬁed as the authentication method for policy 1 in the

“Conﬁguring IKE Policies” section on page 3-13, (the policy that will also be used on the

business partner router) complete the following tasks at the headquarters router as well as

the business partner router:

1 Set each peer’s Internet Security Association & Key Management Protocol (ISAKMP)

identity. Each peer’s identity should be set to either its host name or by its IP address.

By default, a peer’s identity is set to its IP address. In this scenario, you only need to

complete this task at the business partner router.

2 Specify the shared keys at each peer. Note that a given preshared key is shared between

twopeers. At a given peer,you could specify the same keyto share with multiple remote

peers; however, a more secure approach is to specify different keys to share between

different pairs of peers.

To conﬁgure a different preshared key for use between the headquarters router and the

business partner router, complete the following steps in global conﬁguration mode:

Step Command Purpose

hq-sanjose(config)# crypto isakmp key

67890 address 172.16.2.7

At the local peer: Specify the shared key the

headquarters router will use with the business

partner router. This example conﬁgures the shared

key 67890 to be used with the remote peer

172.16.2.7 (serial interface 1/0 on the business

partner router).

bus-ptnr(config)# crypto isakmp

identity address

At the remote peer: Specify the ISAKMP identity

(address or hostname) the business partner router

will use when communicating with the headquarters

router during IKE negotiations. (This task was

already completed on the headquarters router when

policy 1 was conﬁgured in the “Conﬁguring IKE

Policies” section on page 3-13.) This example

speciﬁes the address keyword, which uses IP

address 172.16.2.7 (serial interface 1/0 of the

business partner router) as the identity for the

business partner router.

1 2 ... 77 78 79 80 81 82 83 84 85 86 87 ... 111 112

Sin comentarios

Cisco 7100 Series Especificaciones Pagina 82