Cisco IOS crypto isakmp key command subnet mask behavior

Describe site-to-site and remote access VPN deployment types such as virtual tunnel interfaces, standards-based IPsec, SSL VPN, DMVPN, FlexVPN, and GETVPN
Answer Correct answer: C — authenticates the IKEv1 peers in the 172.16.0.0/16 range by using the key ciscXXXXXXXX

What is the result of running the crypto isakmp key ciscXXXXXXXX address 172.16.0.0 command?

  1. authenticates the IKEv2 peers in the 172.16.0.0/16 range by using the key ciscXXXXXXXX
  2. authenticates the IP address of the 172.16.0.0/32 peer by using the key ciscXXXXXXXX
  3. authenticates the IKEv1 peers in the 172.16.0.0/16 range by using the key ciscXXXXXXXX Correct Answer
  4. secures all the certificates in the IKE exchange by using the key ciscXXXXXXXX

Community Insight

This question tests the default behavior of the 'crypto isakmp key address' command regarding subnet masking and protocol version (IKEv1 vs IKEv2). The common trap is confusing the default /16 mask with a /32 host or assuming it applies to IKEv2.

The 'crypto isakmp key' command configures a pre-shared secret for IKEv1 authentication. When no subnet mask is explicitly specified, Cisco IOS defaults to a /16 network range.

Option A (IKEv2) is incorrect because this specific CLI syntax is deprecated/legacy for IKEv1; Option B (/32) is incorrect because the lack of a mask implies a network range, not a single host.

Community Discussion (56 comments)

XBfoundX 👍 1 Selected: C
Team the correct one is C! look the output: csrv-nat(config)#crypto isakmp key test address 172.16.0.1 255.255.255.255 A pre-shared key for address mask 172.16.0.1 255.255.255.255 already exists! csrv-nat(config)#crypto isakmp key test address 172.16.0.0 255.255.0.0 A pre-shared key for address mask 172.16.0.0 255.255.0.0 already exists! csrv-nat(config)# Actually remember that we are talking about isakmp, so ikev1 and actually when you put the 172.16.0.0 the router will take the subnet, when you put the ip address 172.16.0.1 it will take the /32 host. Just check the cli output :D
babsoly 👍 1 Selected: C
The command contain "crypto isakmp" this is a command for IKEv1 so C is the correct answer.
CyberGhost666 👍 1 Selected: C
Correct answer is C.
willroute 👍 1
C is correct. https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios/218432-configure-a-site-to-site-ipsec-ikev1-tun.html....ikev1 is key....no pun intended....ikev2 diff, see below. https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118652-configure-asa-00.html
luismg 👍 1 Selected: C
it is an IKE v1 command so the answer is C
Rockbo47 👍 1 Selected: C
isakmp command refers to IKEv1 and without specifying a mask it will use the default classful mask which in this case would be 255.255.0.0 for 172.16.0.0. So answer C is absolutely the correct answer. nospampls also demonstrates this with output.
c3qu1 👍 1
C is correct, the command crypto isakmp key ciscXXXXXXXX address 172.16.0.0 0.0.255.255 authenticates IKEv1 peers in the 172.16.0.0/16 range by using the preshared key ciscXXXXXXXX.
xziomal9 👍 2 Selected: C
Answer C
squirrel49 👍 2 Selected: C
The command crypto isakmp key you provided is related to IKEv1, not IKEv2. IKEv1 (Internet Key Exchange version 1) is configured using crypto isakmp commands, whereas IKEv2 (Internet Key Exchange version 2) is configured using crypto ikev2 commands. If you want to configure a pre-shared key for IKEv1, the crypto isakmp key command is used as shown in your original question. If you want to configure a pre-shared key for IKEv2, you would use crypto ikev2 keyring and crypto ikev2 profile commands. The distinction is important because the two versions of IKE have different configurations and characteristics. So IMHO - C is the right answer!
RafaelSTI 👍 3
C is correct, o IOS assumes a /16 mask if you omit the mask, like when you put at the and 0.0.0.0 and the IOS assumes a /0 mask (any). I test in the lab: ... Router(config)# crypto isakmp key Mudar@123 address 172.16.0.0 Router(config)#do show crypto isakmp key Keyring Hostname/Address Preshared Key default 172.16.0.0 [255.255.0.0] Mudar@123 Router(config)#
nep1019 👍 1 Selected: B
Some of you are overthinking this. Go here: https://www.cisco.com/c/en/us/td/docs/ios/12_2/security/command/reference/srfike.html#wp1017897 Search: crypto isakmp key and read. When you enter the peer using address, the mask is optional if you want to specify the subnet. If you specify no subnet then the address is to a single peer. In this case, 172.16.0.0/32 leaving B the only correct answer.
nep1019 👍 1
Explanation from the source: mask (Optional) Specify the subnet address of the remote peer. (The argument can be used only if the remote peer ISAKMP identity was set with its IP address.)
fdl543 👍 1 Selected: B
B Is always correct. Using IKEv1 or IKEv2. C will fail if I use IKEv2...
wizzlewazzle 👍 1
With the address keyword, you can also use the mask argument to indicate the remote peer ISAKMP identity will be established using the preshared key only. If the mask argument is used, preshared keys are no longer restricted between two users. Note If you specify mask, you must use a subnet address. (The subnet address 0.0.0.0 is not recommended because it encourages group preshared keys, which allow all peers to have the same group key, thereby reducing the security of your user authentication.)
G33 👍 2
C is correct Apart from reasons already given by other C campaigners ikev2 uses a different format for keys crypto ikev2 keyring IKEv2-KEYRING peer 1.2.3.4 address 1.2.3.4 pre-shared-key cisco123 apart from that whe you actually run the command in a lab it results in 172.16.0.0 [255.255.0.0] It assumes a subnet for anything that ends in .0
Kromwall 👍 1 Selected: B
B is correct
gc999 👍 1 Selected: B
This question is tricky, it is testing the concept I believe. According to the CLI, it should be "peer". In Option B, it is 172.16.0.0/32 "peer", but in Option C, it is 172.16.0.0 "range". No matter then can be reachable, I will select the one with "peer".
haiderzaid 👍 1
B "If the mask argument is used, preshared keys are no longer restricted between two users" so its restricted to 172.16.0.0 https://www.cisco.com/c/en/us/td/docs/ios/12_2/security/command/reference/srfike.html
haiderzaid 👍 2
i tested it on a real router and the output was Keyring Hostname/Address Preshared Key default 172.16.0.0 [255.255.0.0] cisco but if i use 172.0.0.1 Keyring Hostname/Address Preshared Key default 172.16.0.1 cisco weird thing , not B
angry 👍 6
C is the correct answer!
angry 👍 2
B is correct!
ARound 👍 4
Selected Answer: C 7200 Software (C7200-ADVENTERPRISEK9-M), Version 15.3(3)XB12 command keyed in is, crypto isakmp key cisco address 172.16.0.0 Router#show crypto isakmp key Keyring Hostname/Address Preshared Key default 172.16.0.0 [255.255.0.0] cisco Router(config)#crypto isakmp key cisco ? address define shared key with IP address hostname define shared key with hostname if using ikev2, the command set should be, crypto ikev2 keyring keys peer hostname address 172.16.10.2 pre-shared-key local cisco pre-shared-key remote cisco
Gabs20L 👍 3
Correct answer ir B, not C. Here is the reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr-book/sec-cr-c4.html#wp6039879000
Vlad_Is_Love_ua 👍 1 Selected: B
C is NOT correct because /16 is subnet, but an ip ADDRESS is mentioned
ddev3737_111 👍 1
Answer A https://www.cisco.com/c/en/us/td/docs/ios/12_2/security/command/reference/srfike.html Use this command to configure preshared authentication keys. You must perform this command at both peers. If an IKE policy includes preshared keys as the authentication method, these preshared keys must be configured at both peers—otherwise the policy cannot be used (the policy will not be submitted for matching by the IKE process). The crypto isakmp key command is the second task required to configure the preshared keys at the peers. (The first task is accomplished with the crypto isakmp identity command.)
ddev3737_111 👍 1
B is incorrect, the command is used to authenticate the IKEv2 peers in the 172.16.0.0/16 range, not a single IP address. C is also incorrect, the command is used for IKEv2, not IKEv1. A The command "crypto isakmp key ciscXXXXXXXX address 172.16.0.0" is used to configure a preshared key for IKEv2 peers with IP addresses in the range of 172.16.0.0/16. The key "ciscXXXXXXXX" is used for authentication during the IKE Phase 1 negotiation. It's considered a secure method to authenticate the peers by using a shared secret key instead of using a public key infrastructure which could be vulnerable to Man-In-The-Middle attacks
yanyan20 👍 1 Selected: B
B is correct
psuoh 👍 1
crypto isakmpkey keystring address peer-address • The peer-address argument specifies the IP address of the remote peer. Configures a preshared authentication key. Example: Router (config)# crypto isakmp key cisco address 10.2.3.4
psuoh 👍 1
Output from IOS XE 17.3.5 9300-CR1(config)#crypto isakmp key cisco ? address define shared key with IP address hostname define shared key with hostname 9300-CR1(config)#crypto isakmp key cisco addre 9300-CR1(config)#crypto isakmp key cisco address ? A.B.C.D Peer IP address ipv6 define shared key with IPv6 address 9300-CR1(config)#crypto isakmp key cisco address 172.16.0.0 ? A.B.C.D Peer IP subnet mask no-xauth Bypasses XAuth for this peer <cr> <cr> 9300-CR1(config)#crypto isakmp key cisco address 172.16.0.0^Z 9300-CR1#
Net4dd 👍 1
B is correct. If no mask is specified it is assumed you are referring to a host IP https://www.cisco.com/c/en/us/td/docs/ios/12_2/security/command/reference/srfike.html#wp1017897
Anonymous983475 👍 2 Selected: C
There should be a subnet mask at the end for it to take the /32 address This is the output from the IOS-XE router. IOU1(config)#crypto isakmp key cisco address 172.16.0.0 ? A.B.C.D Peer IP subnet mask no-xauth Bypasses XAuth for this peer
Emlia1 👍 2
B or C
saad_SEIU 👍 2 Selected: B
B with no doubt.
wenorex222 👍 1
Why most people comment on C been the ans and exclude A as a possible ans. The only difference between C and A is ike version.
Thusi26 👍 1
B is correct.
TOO_EASY 👍 1
address Use this keyword if the remote peer Internet Security Association Key Management Protocol (ISAKMP) identity was set with its IP or IPv6 address. The peer-address argument specifies the IP or IPv6 address of the remote peer. peer-address Specifies the IP address of the remote peer.
JGW 👍 4 Selected: C
Command reference is not decisive. Testing without a netmask shows that command interpretation has a preference for /16 and /24. CSR-1(config)#crypto isakmp key cisco123 address 172.16.0.0 CSR-1(config)#do show crypto isakmp key | i cisco default 172.16.0.0 [255.255.0.0] cisco123 CSR-1(config)#no crypto isakmp key cisco123 address 172.16.0.0 CSR-1(config)#crypto isakmp key cisco123 address 172.16.1.0 CSR-1(config)#do show crypto isakmp key | i cisco default 172.16.1.0 [255.255.255.0] cisco123 CSR-1(config)#no crypto isakmp key cisco123 address 172.16.1.0 CSR-1(config)#crypto isakmp key cisco123 address 172.16.1.128 CSR-1(config)#do show crypto isakmp key | i cisco default 172.16.1.128 cisco123 CSR-1(config)#
ictman 👍 1
It's B. The command syntax is crypto isakmp key <keystring> address <peer-address>. Peer address is IP address and not network address.
jaciro11 👍 2
When using IKE main mode, preshared keys are indexed by IP address only because the identity payload has not yet been received. This means that the hostname keyword in the identity statement is not used to look up a preshared key and will be used only when sending and processing the identity payloads later in the main mode exchange. The identity keyword can be used when preshared keys are used with IKE aggressive mode, and keys may be indexed by identity types other than IP address as the identity payload is received in the first IKE aggressive mode packet. B and C are correct but you need to check something crypto isakmp key ciscXXXXXXXX address 172.16.0.0 It talks about one host not /16 Note: If you specify mask, you must use a subnet address. (The subnet address 0.0.0.0 is not recommended because it encourages group preshared keys, which allow all peers to have the same group key, thereby reducing the security of your user authentication.) The answer is B
kwong328 👍 4
You are correct, I have verified in IOU. because the command "crypto isakmp key ciscXXXXXXXX address 172.16.0.0" did not specified the mask, the router will take is as /16, unless you specify the mask as "crypto isakmp key ciscXXXXXXXX address 172.16.0.0 255.255.255.0", the router will take it as /24.
jaciro11 👍 4
Man this is not true....
itisfakemaillol 👍 3
B is correct
Seawanderer 👍 2
No, check my CLI input and output
Seawanderer 👍 6
ISP(config)#crypto isakmp key asdasd address 172.16.0.0 ISP#sh crypto isakmp key Keyring Hostname/Address Preshared Key default 172.16.0.0 [255.255.0.0] asdasd
JGW 👍 4
C is correct. It is not unusual in older Cisco commands to interpret IP addresses without mask as classfull CSR-1(config)#crypto isakmp key cisco123 address 172.16.0.0 CSR-1(config)#crypto isakmp key cisco123 address 172.16.0.0 255.255.0.0 A pre-shared key for address mask 172.16.0.0 255.255.0.0 already exists!
Dead_Adriano 👍 5
Moreover, I reproduced this in the lab with routers having 172.16.1.1 and .2 addresses. Auth goes correctly, the tunnel is up and working.
Seawanderer 👍 3
So it’s C
deathfrom 👍 2
I agree with C as isakmp is a part of IKEv1
Zoli6 👍 2
Unlike IKEv1, the authentication method and SA lifetime are not negotiable in IKEv2, and they cannot be configured in the IKEv2 proposal. Though the crypto ikev2 proposal command looks similar to the IKEv1 crypto isakmp policycommand, the IKEv2 proposal configuration supports specifying multiple options for each transform type. not just part of IKEv1
deathfrom 👍 1
I think the correct answer is C. ISAKP is used as a part of IKEv1. When configuring authentication on a router for IKEv2 it uses a concept of keys for authentication.
Ampersand 👍 18
B is correct. When you use “address” it is referring to the remote peer you share the key with. If you want to add more than 1 ip add, you will have to use group key.
nospampls 👍 16
C is correct did this ins GNS3 R1(config)#crypto isakmp key 123123 address 172.16.0.0 R1(config)#end R1#show crypto isakmp key Keyring Hostname/Address Preshared Key default 172.16.0.0 [255.255.0.0] 123123 same as Seawanderer did
thefiresays 👍 10
It's weird that they used a network address, but this command authenticates a single VPN peer. Leaving B correct.
loiphin 👍 4
This is not always a network address.... for example on this subnet 172.16.4.0/23, 172.16.5.0 is a valid IP address, and nothing to do with network address. It just looks weird because people tend to subnet on /24's mostly.
Jeeves69 👍 4
For it to have been a /16 a mask of 255.255.0.0 would've had to have been provided after the address statement, so B is correct.
Kris92 👍 2
should be C

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The command 'crypto isakmp key... address <ip>' is used to configure a pre-shared key for IKEv1 (ISAKMP) peer authentication. In Cisco IOS, if you do not specify a subnet mask after the IP address, the router assumes a default Class B mask of 255.255.0.0, which corresponds to a /16 prefix length. This allows the key to authenticate any peer within that 172.16.0.0/16 range.

Why the Other Options Are Wrong

Option A is incorrect because this legacy command syntax is associated with IKEv1, not IKEv2 (which uses different configuration structures like 'key ring'). Option B is incorrect because a /32 mask would require explicit specification (e.g., 'address 172.16.0.0 255.255.255.255'); without it, the system defaults to /16. Option D is incorrect because this command configures a pre-shared key, not certificate-based authentication.

Community Comment Notes

Community members verified this behavior through lab testing. As noted by user 'thefiresays', "It's weird that they used a network address, but this command authenticates a single VPN peer" (referring to the fact that while the command defines a range, it's often used for specific peers in smaller labs, but technically covers the range). User 'kwong328' confirmed: "because the command... did not specified the mask, the router will take is as /16". Multiple users (Ampersand, nospamls) validated that C is the correct answer based on the default /16 behavior.

Exam Strategy

Memorize that the 'crypto isakmp key' command is for IKEv1. Always check if a subnet mask is provided; if absent, assume the classful default mask (A: /8, B: /16, C: /24). Remember that modern exams may focus on IKEv2, so distinguish between legacy ISAKMP keys and modern Key Rings.

Frequently Asked Questions

Why is this command for IKEv1 and not IKEv2?

The 'crypto isakmp key' CLI is a legacy command specifically for IKEv1. IKEv2 uses 'key ring' configurations instead.

How do I specify a single host IP for the key?

You must explicitly add the subnet mask 255.255.255.255 (or /32) after the IP address in the command.

More 350-701 FAQ →

Related Analysis

Which two facts must be considered when deciding whether to

A-Grade

Which feature does the IaaS model provide?

S-Grade

An engineer is configuring guest WLAN access using Cisco ISE

A-Grade

← Back to 350-701 Study Guide