Cisco IOS crypto isakmp key command subnet mask behavior

350-701 By islever Editorial Last updated

Describe site-to-site and remote access VPN deployment types such as virtual tunnel interfaces, standards-based IPsec, SSL VPN, DMVPN, FlexVPN, and GETVPN

Short answer

C Authenticates the IKEv1 peers in the 172.16.0.0/16 range by using the key ciscXXXXXXXX

Question

What is the result of running the crypto isakmp key ciscXXXXXXXX address 172.16.0.0 command?
  1. authenticates the IKEv2 peers in the 172.16.0.0/16 range by using the key ciscXXXXXXXX
  2. authenticates the IP address of the 172.16.0.0/32 peer by using the key ciscXXXXXXXX
  3. authenticates the IKEv1 peers in the 172.16.0.0/16 range by using the key ciscXXXXXXXX Correct Answer
  4. secures all the certificates in the IKE exchange by using the key ciscXXXXXXXX

Key Takeaways

This question tests the default behavior of the 'crypto isakmp key address' command regarding subnet masking and protocol version (IKEv1 vs IKEv2). The common trap is confusing the default /16 mask with a /32 host or assuming it applies to IKEv2.

The 'crypto isakmp key' command configures a pre-shared secret for IKEv1 authentication. When no subnet mask is explicitly specified, Cisco IOS defaults to a /16 network range.

Common mistake: Option A (IKEv2) is incorrect because this specific CLI syntax is deprecated/legacy for IKEv1; Option B (/32) is incorrect because the lack of a mask implies a network range, not a single host.

Expert Analysis

Why the Answer Is Correct

The command 'crypto isakmp key... address <ip>' is used to configure a pre-shared key for IKEv1 (ISAKMP) peer authentication. In Cisco IOS, if you do not specify a subnet mask after the IP address, the router assumes a default Class B mask of 255.255.0.0, which corresponds to a /16 prefix length. This allows the key to authenticate any peer within that 172.16.0.0/16 range.

Why the Other Options Are Wrong

Option A is incorrect because this legacy command syntax is associated with IKEv1, not IKEv2 (which uses different configuration structures like 'key ring'). Option B is incorrect because a /32 mask would require explicit specification (e.g., 'address 172.16.0.0 255.255.255.255'); without it, the system defaults to /16. Option D is incorrect because this command configures a pre-shared key, not certificate-based authentication.

Community Comment Notes

Community members verified this behavior through lab testing. As noted by user 'thefiresays', "It's weird that they used a network address, but this command authenticates a single VPN peer" (referring to the fact that while the command defines a range, it's often used for specific peers in smaller labs, but technically covers the range). User 'kwong328' confirmed: "because the command... did not specified the mask, the router will take is as /16". Multiple users (Ampersand, nospamls) validated that C is the correct answer based on the default /16 behavior.

Exam Strategy

Memorize that the 'crypto isakmp key' command is for IKEv1. Always check if a subnet mask is provided; if absent, assume the classful default mask (A: /8, B: /16, C: /24). Remember that modern exams may focus on IKEv2, so distinguish between legacy ISAKMP keys and modern Key Rings.

Frequently Asked Questions

Why is this command for IKEv1 and not IKEv2?

The 'crypto isakmp key' CLI is a legacy command specifically for IKEv1. IKEv2 uses 'key ring' configurations instead.

How do I specify a single host IP for the key?

You must explicitly add the subnet mask 255.255.255.255 (or /32) after the IP address in the command.

More 350-701 FAQ →

Discussion 54 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 54

  1. Ampersand 👍 18
    B is correct. When you use “address” it is referring to the remote peer you share the key with. If you want to add more than 1 ip add, you will have to use group key.
  2. nospampls 👍 16
    C is correct did this ins GNS3 R1(config)#crypto isakmp key 123123 address 172.16.0.0 R1(config)#end R1#show crypto isakmp key Keyring Hostname/Address Preshared Key default 172.16.0.0 [255.255.0.0] 123123 same as Seawanderer did
  3. thefiresays 👍 10
    It's weird that they used a network address, but this command authenticates a single VPN peer. Leaving B correct.
  4. Seawanderer 👍 6
    ISP(config)#crypto isakmp key asdasd address 172.16.0.0 ISP#sh crypto isakmp key Keyring Hostname/Address Preshared Key default 172.16.0.0 [255.255.0.0] asdasd
  5. angry 👍 6
    C is the correct answer!
Show 25 more comments
  1. Dead_Adriano 👍 5
    Moreover, I reproduced this in the lab with routers having 172.16.1.1 and .2 addresses. Auth goes correctly, the tunnel is up and working.
  2. JGW 👍 4 Answered C
    Command reference is not decisive. Testing without a netmask shows that command interpretation has a preference for /16 and /24. CSR-1(config)#crypto isakmp key cisco123 address 172.16.0.0 CSR-1(config)#do show crypto isakmp key | i cisco default 172.16.0.0 [255.255.0.0] cisco123 CSR-1(config)#no crypto isakmp key cisco123 address 172.16.0.0 CSR-1(config)#crypto isakmp key cisco123 address 172.16.1.0 CSR-1(config)#do show crypto isakmp key | i cisco default 172.16.1.0 [255.255.255.0] cisco123 CSR-1(config)#no crypto isakmp key cisco123 address 172.16.1.0 CSR-1(config)#crypto isakmp key cisco123 address 172.16.1.128 CSR-1(config)#do show crypto isakmp key | i cisco default 172.16.1.128 cisco123 CSR-1(config)#
  3. ARound 👍 4
    Selected Answer: C 7200 Software (C7200-ADVENTERPRISEK9-M), Version 15.3(3)XB12 command keyed in is, crypto isakmp key cisco address 172.16.0.0 Router#show crypto isakmp key Keyring Hostname/Address Preshared Key default 172.16.0.0 [255.255.0.0] cisco Router(config)#crypto isakmp key cisco ? address define shared key with IP address hostname define shared key with hostname if using ikev2, the command set should be, crypto ikev2 keyring keys peer hostname address 172.16.10.2 pre-shared-key local cisco pre-shared-key remote cisco
  4. JGW 👍 4
    C is correct. It is not unusual in older Cisco commands to interpret IP addresses without mask as classfull CSR-1(config)#crypto isakmp key cisco123 address 172.16.0.0 CSR-1(config)#crypto isakmp key cisco123 address 172.16.0.0 255.255.0.0 A pre-shared key for address mask 172.16.0.0 255.255.0.0 already exists!
  5. kwong328 👍 4
    You are correct, I have verified in IOU. because the command "crypto isakmp key ciscXXXXXXXX address 172.16.0.0" did not specified the mask, the router will take is as /16, unless you specify the mask as "crypto isakmp key ciscXXXXXXXX address 172.16.0.0 255.255.255.0", the router will take it as /24.
  6. loiphin 👍 4
    This is not always a network address.... for example on this subnet 172.16.4.0/23, 172.16.5.0 is a valid IP address, and nothing to do with network address. It just looks weird because people tend to subnet on /24's mostly.
  7. Jeeves69 👍 4
    For it to have been a /16 a mask of 255.255.0.0 would've had to have been provided after the address statement, so B is correct.
  8. jaciro11 👍 4
    Man this is not true....
  9. RafaelSTI 👍 3
    C is correct, o IOS assumes a /16 mask if you omit the mask, like when you put at the and 0.0.0.0 and the IOS assumes a /0 mask (any). I test in the lab: ... Router(config)# crypto isakmp key Mudar@123 address 172.16.0.0 Router(config)#do show crypto isakmp key Keyring Hostname/Address Preshared Key default 172.16.0.0 [255.255.0.0] Mudar@123 Router(config)#
  10. Gabs20L 👍 3
    Correct answer ir B, not C. Here is the reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr-book/sec-cr-c4.html#wp6039879000
  11. Seawanderer 👍 3
    So it’s C
  12. jaciro11 👍 2
    When using IKE main mode, preshared keys are indexed by IP address only because the identity payload has not yet been received. This means that the hostname keyword in the identity statement is not used to look up a preshared key and will be used only when sending and processing the identity payloads later in the main mode exchange. The identity keyword can be used when preshared keys are used with IKE aggressive mode, and keys may be indexed by identity types other than IP address as the identity payload is received in the first IKE aggressive mode packet. B and C are correct but you need to check something crypto isakmp key ciscXXXXXXXX address 172.16.0.0 It talks about one host not /16 Note: If you specify mask, you must use a subnet address. (The subnet address 0.0.0.0 is not recommended because it encourages group preshared keys, which allow all peers to have the same group key, thereby reducing the security of your user authentication.) The answer is B
  13. squirrel49 👍 2 Answered C
    The command crypto isakmp key you provided is related to IKEv1, not IKEv2. IKEv1 (Internet Key Exchange version 1) is configured using crypto isakmp commands, whereas IKEv2 (Internet Key Exchange version 2) is configured using crypto ikev2 commands. If you want to configure a pre-shared key for IKEv1, the crypto isakmp key command is used as shown in your original question. If you want to configure a pre-shared key for IKEv2, you would use crypto ikev2 keyring and crypto ikev2 profile commands. The distinction is important because the two versions of IKE have different configurations and characteristics. So IMHO - C is the right answer!
  14. Zoli6 👍 2
    Unlike IKEv1, the authentication method and SA lifetime are not negotiable in IKEv2, and they cannot be configured in the IKEv2 proposal. Though the crypto ikev2 proposal command looks similar to the IKEv1 crypto isakmp policycommand, the IKEv2 proposal configuration supports specifying multiple options for each transform type. not just part of IKEv1
  15. G33 👍 2
    C is correct Apart from reasons already given by other C campaigners ikev2 uses a different format for keys crypto ikev2 keyring IKEv2-KEYRING peer 1.2.3.4 address 1.2.3.4 pre-shared-key cisco123 apart from that whe you actually run the command in a lab it results in 172.16.0.0 [255.255.0.0] It assumes a subnet for anything that ends in .0
  16. Anonymous983475 👍 2 Answered C
    There should be a subnet mask at the end for it to take the /32 address This is the output from the IOS-XE router. IOU1(config)#crypto isakmp key cisco address 172.16.0.0 ? A.B.C.D Peer IP subnet mask no-xauth Bypasses XAuth for this peer
  17. haiderzaid 👍 2
    i tested it on a real router and the output was Keyring Hostname/Address Preshared Key default 172.16.0.0 [255.255.0.0] cisco but if i use 172.0.0.1 Keyring Hostname/Address Preshared Key default 172.16.0.1 cisco weird thing , not B
  18. deathfrom 👍 2
    I agree with C as isakmp is a part of IKEv1
  19. Seawanderer 👍 2
    No, check my CLI input and output
  20. saad_SEIU 👍 2 Answered B
    B with no doubt.
  21. angry 👍 2
    B is correct!
  22. Kris92 👍 2
    should be C
  23. xziomal9 👍 2 Answered C
    Answer C
  24. Emlia1 👍 2
    B or C
  25. ddev3737_111 👍 1
    B is incorrect, the command is used to authenticate the IKEv2 peers in the 172.16.0.0/16 range, not a single IP address. C is also incorrect, the command is used for IKEv2, not IKEv1. A The command "crypto isakmp key ciscXXXXXXXX address 172.16.0.0" is used to configure a preshared key for IKEv2 peers with IP addresses in the range of 172.16.0.0/16. The key "ciscXXXXXXXX" is used for authentication during the IKE Phase 1 negotiation. It's considered a secure method to authenticate the peers by using a shared secret key instead of using a public key infrastructure which could be vulnerable to Man-In-The-Middle attacks

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide