Configuring ISAKMP Key for Specific Peer IP on Cisco IOS

350-701 By islever Editorial Last updated

Describe site-to-site and remote access VPN deployment types such as virtual tunnel interfaces, standards-based IPsec, SSL VPN, DMVPN, FlexVPN, and GETVPN

Short answer

D Use the command crypto isakmp key <key-string> <peer-ip> to assign a pre-shared key exclusively to the specified peer IP address.

Question

An administrator is establishing a new site-to-site VPN connection on a Cisco IOS router. The organization needs to ensure that the ISAKMP key on the hub is
used only for terminating traffic from the IP address of 172.19.20.24. Which command on the hub will allow the administrator to accomplish this?
  1. crypto isakmp identity address 172.19.20.24
  2. crypto ca identity 172.19.20.24
  3. crypto enrollment peer address 172.19.20.24
  4. crypto isakmp key Cisco0123456789 172.19.20.24 Correct Answer

Key Takeaways

The exam tests knowledge of legacy site-to-site VPN configuration syntax, specifically distinguishing between identity-based and address-based key assignment commands.

This question tests the specific syntax for assigning an ISAKMP pre-shared key to a remote peer in Cisco IOS XE. It establishes that the correct command explicitly binds the key material to the peer's IP address.

Common mistake: Many candidates choose Option A because 'crypto isakmp identity' exists, but this command sets the local identity type (e.g., FQDN or IP) rather than binding a specific key to a specific peer IP.

Expert Analysis

Why the Answer Is Correct

The correct answer is D: crypto isakmp key Cisco0123456789 172.19.20.24. This command configures a pre-shared key (Cisco0123456789) for IKE Phase 1 negotiation with the specific peer at IP 172.19.20.24. In traditional Cisco IOS crypto maps, this syntax ensures the hub router uses this exact key only when communicating with that specific IP address.

Why the Other Options Are Wrong

Option A (crypto isakmp identity address) is used to configure the local device to use its IP address as its identity during IKE negotiation, not to assign a key to a peer. Option B (crypto ca identity) relates to Certificate Authority enrollment identities, not pre-shared keys. Option C (crypto enrollment peer) is not a valid command for configuring ISAKMP keys.

Community Comment Notes

Community consensus strongly favors D. User testtaker13 noted that while D is likely correct, the strict syntax often requires the keyword address before the IP (i.e., crypto isakmp key <key> address <ip>). However, in the context of many certification exams, the abbreviated form without the address keyword is accepted as the primary identifier for the peer. Users like itashraf and CyberGhost666 confirmed D as the definitive answer for this specific scenario.

Exam Strategy

Memorize the distinction between crypto isakmp identity (which defines how you identify yourself) and crypto isakmp key (which defines the secret shared with a peer). Always look for the peer IP address immediately following the key string in the options.

Frequently Asked Questions

What is the difference between crypto isakmp identity and crypto isakmp key?

Identity sets how the local router identifies itself (e.g., by IP or FQDN), while the key command assigns the actual secret passphrase to a specific remote peer.

Is the 'address' keyword required in crypto isakmp key?

In modern IOS versions, the keyword 'address' is often required before the IP. However, exam questions may present the simplified syntax where the IP directly follows the key string.

More 350-701 FAQ →

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. testtaker13 👍 10
    probably D. However the correct command should be crypto isakmp key <cisco123> address <host ip>
  2. itashraf 👍 3
    Ans: D
  3. XBfoundX 👍 1 Answered D
    The answer is D, the command crypto isakmp identity address, is needed to specify which identity is going to be specified during the phase1, in that case the ip address will be used as the specified identity.
  4. CyberGhost666 👍 1 Answered D
    Correct option is D. This command tells the router to only accept and use the specified key (Cisco0123456789) when communicating with the peer at IP 172.19.20.24.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide