350-701 · Question #634
What describes the function of the crypto isakmp key C1$c451090787 address 0.0.0.0 0.0.0.0 command when configuring an IPsec VPN tunnel on a Cisco IOS router?
The correct answer is A. It allows connections from any hosts using the defined preshared key. The crypto isakmp key ... address 0.0.0.0 0.0.0.0 command configures a global pre-shared key for IPsec IKEv1, allowing any peer to use this key for authentication.
Question
What describes the function of the crypto isakmp key C1$c451090787 address 0.0.0.0 0.0.0.0 command when configuring an IPsec VPN tunnel on a Cisco IOS router?
Options
- AIt allows connections from any hosts using the defined preshared key.
- BIt defines that all data is going to be encrypted via the VPN.
- CIt configures the IP address and subnet mask of the VPN server.
- DIt drops spoofed VPN traffic using 0.0.0.0 as the source or destination IP address.
How the community answered
(28 responses)- A89% (25)
- B7% (2)
- C4% (1)
Why each option
The `crypto isakmp key ... address 0.0.0.0 0.0.0.0` command configures a global pre-shared key for IPsec IKEv1, allowing any peer to use this key for authentication.
The `address 0.0.0.0 0.0.0.0` portion of the `crypto isakmp key` command specifies that the pre-shared key `C1$c451090787` should be used for any remote IPsec peer attempting to establish an IKEv1 Phase 1 negotiation, essentially acting as a default key for all unspecified peers. This allows connections from any host that knows this specific pre-shared key, simplifying configuration for environments with dynamic or unknown peer IP addresses.
This command only configures the authentication key for the IKE negotiation; it does not define which data traffic is encrypted. Data encryption is defined by crypto maps and access lists.
The command configures a pre-shared key for IKE authentication, not the IP address or subnet mask of a VPN server.
This command is for IKE authentication key configuration, not for dropping spoofed VPN traffic; 0.0.0.0 0.0.0.0 specifies "any" peer, not a dropping condition.
Concept tested: IPsec IKEv1 global pre-shared key configuration
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_ikevpn/configuration/xe-3s/sec-ike-vpn-xe-3s-book/sec-ike-preshared-keys.html
Topics
Community Discussion
No community discussion yet for this question.