Configuring ISAKMP Key for Specific Peer IP on Cisco IOS
An administrator is establishing a new site-to-site VPN connection on a Cisco IOS router. The organization needs to ensure that the ISAKMP key on the hub is used only for terminating traffic from the IP address of 172.19.20.24. Which command on the hub will allow the administrator to accomplish this?
Community Insight
The exam tests knowledge of legacy site-to-site VPN configuration syntax, specifically distinguishing between identity-based and address-based key assignment commands.
This question tests the specific syntax for assigning an ISAKMP pre-shared key to a remote peer in Cisco IOS XE. It establishes that the correct command explicitly binds the key material to the peer's IP address.
Many candidates choose Option A because 'crypto isakmp identity' exists, but this command sets the local identity type (e.g., FQDN or IP) rather than binding a specific key to a specific peer IP.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is D:crypto isakmp key Cisco0123456789 172.19.20.24. This command configures a pre-shared key (Cisco0123456789) for IKE Phase 1 negotiation with the specific peer at IP 172.19.20.24. In traditional Cisco IOS crypto maps, this syntax ensures the hub router uses this exact key only when communicating with that specific IP address.Why the Other Options Are Wrong
Option A (crypto isakmp identity address) is used to configure the local device to use its IP address as its identity during IKE negotiation, not to assign a key to a peer. Option B (crypto ca identity) relates to Certificate Authority enrollment identities, not pre-shared keys. Option C (crypto enrollment peer) is not a valid command for configuring ISAKMP keys.Community Comment Notes
Community consensus strongly favors D. User testtaker13 noted that while D is likely correct, the strict syntax often requires the keywordaddress before the IP (i.e., crypto isakmp key <key> address <ip>). However, in the context of many certification exams, the abbreviated form without the address keyword is accepted as the primary identifier for the peer. Users like itashraf and CyberGhost666 confirmed D as the definitive answer for this specific scenario. Exam Strategy
Memorize the distinction between crypto isakmp identity (which defines how you identify yourself) and crypto isakmp key (which defines the secret shared with a peer). Always look for the peer IP address immediately following the key string in the options.
Frequently Asked Questions
What is the difference between crypto isakmp identity and crypto isakmp key?
Identity sets how the local router identifies itself (e.g., by IP or FQDN), while the key command assigns the actual secret passphrase to a specific remote peer.
Is the 'address' keyword required in crypto isakmp key?
In modern IOS versions, the keyword 'address' is often required before the IP. However, exam questions may present the simplified syntax where the IP directly follows the key string.