Cisco IOS Security Command Reference

Security Commands
crypto isakmp peer
Syntax Description
January 2008
Cisco IOS Security Command Reference
crypto isakmp peer
To enable an IP Security (IPSec) peer for Internet Key Exchange (IKE) querying of authentication,
authorization, and accounting (AAA) for tunnel attributes in aggressive mode, use the crypto isakmp
peer command in global configuration mode. To disable this functionality, use the no form of this
command.
Command Default No default behavior or values
Command Modes Global configuration
Command History
crypto isakmp peer {address {ipv4-address | ipv6 ipv6-address} | hostname fqdn-hostname}
no crypto isakmp peer {address {ipv4-address | ipv6 ipv6-address} | hostname fqdn-hostname}
address ip-address Address of the peer router.
ipv4-address IPv4 address of the peer router.
ipv6 ipv6-address IPv6 address of the peer router.
hostname Hostname of the peer router.
fqdn-hostname Fully qualified domain name (FQDN) of the peer router.
Release Modification
12.2(8)T This command was introduced.
12.2(15)T The vrf keyword and fvrf-name argument were added.
12.2(18)SXD This command was integrated into Cisco IOS Release 12.2(18)SXD.
12.4(4)T The ipv6 keyword and ipv6-address argument were added.
Usage Guidelines After enabling this command, you can use the set aggressive-mode client-endpoint and set
aggressive-mode password commands to specify RADIUS tunnel attributes in the Internet Security
Association and Key Management Protocol (ISAKMP) peer policy for IPSec peers.
Instead of keeping your preshared keys on the hub router, you can scale your preshared keys by storing
and retrieving them from an AAA server. The preshared keys are stored in the AAA server as Internet
Engineering Task Force (IETF) RADIUS tunnel attributes and are retrieved when a user tries to “speak”
to the hub router. The hub router retrieves the preshared key from the AAA server and the spokes (the
users) initiate aggressive mode to the hub by using the preshared key that is specified in the ISAKMP
peer policy as a RADIUS tunnel attribute.
SEC-517