300-730 · Question #204
An engineer is setting up a site-to-site VPN on a Cisco Router running IOS XE using a pre-shared key Cisco@0S1963896#. The configurations have already been completed: ISAKMP Policy IPSec Transform…
The correct answer is D. crypto isakmp profile. In IOS XE IKEv1 site-to-site VPN, a keyring is associated with a peer by referencing it inside the crypto isakmp profile.
Question
- ISAKMP Policy
- IPSec Transform Set
- Crypto Map Configuration Where must the engineer configure the keyring?
Options
- Acrypto isakmp policy
- Btunnel interface
- Ccrypto ipsec profile
- Dcrypto isakmp profile
How the community answered
(69 responses)- A1% (1)
- B1% (1)
- C4% (3)
- D93% (64)
Why each option
In IOS XE IKEv1 site-to-site VPN, a keyring is associated with a peer by referencing it inside the crypto isakmp profile.
The 'crypto isakmp policy' defines Phase 1 parameters such as encryption algorithm, hash, DH group, and lifetime - it has no mechanism to reference or accept a keyring.
A tunnel interface is used in FlexVPN and DMVPN configurations for IKEv2-based tunnels, not in traditional IKEv1 crypto map-based VPN deployments.
The 'crypto ipsec profile' binds a transform set for IPSec Phase 2 and is used with virtual tunnel interfaces - it does not manage IKEv1 peer authentication or keyrings.
The 'crypto isakmp profile' uses the 'keyring' sub-command to bind a named keyring - containing the pre-shared key - to a specific peer identity or address range. This profile-based approach separates key storage from peer matching and is required when using keyring-based PSK instead of a global 'crypto isakmp key' command.
Concept tested: IKEv1 keyring assignment within crypto isakmp profile
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ikevpn/configuration/xe-16/sec-conn-ikevpn-xe-16-book/sec-conn-cfg-ikev1.html
Topics
Community Discussion
No community discussion yet for this question.