To specify the local and remote authentication methods in an Internet Key Exchange Version 2 (IKEv2) profile, use the
authentication command in IKEv2 profile configuration mode. To delete the authentication method, use the
no form of this command.
authentication {local {rsa-sig | pre-share [key password] | ecdsa-sig | eap | [gtc | md5 | mschapv2 | {username username} | {password password}]} | remote {eap [query-identity | timeout seconds] | rsa-sig | pre-share [key password] | ecdsa-sig}}
no authentication {local {rsa-sig | pre-share [key password] | ecdsa-sig | eap | [gtc | md5 | mschapv2 | {username username} | {password password}]} | remote {eap [query-identity | timeout seconds] | rsa-sig | pre-share [key password] | ecdsa-sig}}
Syntax Description
|
local
|
Specifies the local authentication method.
|
|
rsa-sig
|
Specifies Rivest, Shamir, and Adelman (RSA) signature as the authentication method.
|
|
pre-share
|
Specifies preshared key as the authentication method.
|
|
key
|
Specifies a preshared key.
|
|
password
|
Specifies a password for preshared key.
This argument defines the following values:
- 0 —Specifies that the password is unencrypted.
- 6 —Specifies that the password is encrypted.
- password —Specifies an unencrypted user password.
|
|
ecdsa-sig
|
Specifies Elliptic Curve Digital Signature Algorithm (ECDSA) signature (ECDSA-sig) as the authentication method.
|
|
eap
|
Specifies Extensible Authentication Protocol (EAP) as the authentication method.
|
|
gtc
|
(Optional) Specifies Extensible Authentication Protocol (EAP) as the authentication method using Generic Token Card (GTC)
for verifying the credentials.
|
|
md5
|
(Optional) Specifies Extensible Authentication Protocol (EAP) as the authentication method using Message Digest 5 (MD5)
for verifying the credentials.
|
|
mschapv2
|
(Optional) Specifies Extensible Authentication Protocol (EAP) as the authentication method using Microsoft Challenge Handshake
Authentication Protocol version 2 (MSCHAPv2) for verifying the credentials.
|
|
username username |
Specifies the EAP user name.
|
| password |
Specifies the EAP password.
|
|
remote
|
Specifies the remote authentication method.
|
|
query-identity
|
(Optional) Queries EAP identity from the peer.
|
|
timeout
seconds
|
(Optional) Specifies the duration, in seconds, to wait for the next IKE_AUTH request after sending the first IKE_AUTH response.
The range is from 45 to 180, and the default is 90.
|
Command Default
The default local and remote authentication method is not configured.
Command Modes
IKEv2 profile configuration (crypto-ikev2-profile)
Command History
|
Release
|
Modification
|
|
15.1(1)T
|
This command was introduced.
|
|
15.1(2)T
|
This command was modified. The
ecdsa-sig keyword was added.
|
|
15.1(3)T
|
This command was modified. The
eap and
query-identity keywords were added.
|
|
Cisco IOS XE Release 3.3S
|
This command was integrated into Cisco IOS XE Release 3.3S.
|
|
15.2(3)T
|
This command was modified. The
eap keyword was added for the local authentication method and the
timeout
seconds keyword-argument pair was added for the remote EAP authentication method.
|
|
15.2(4)S
|
This command was integrated into Cisco IOS Release 15.2(4)S.
|
|
15.3(3)M
|
This command was modified. The following keywords and arguments were added:
- password
-
gtc
-
md5
-
mschapv2
- username username
- username
|
Usage Guidelines
Note
|
Security threats, as well as the cryptographic technologies to help protect against them, are constantly changing. For more
information about the latest Cisco cryptographic recommendations, see the
Next Generation Encryption (NGE) white paper.
|
Use this command to specify the local and remote authentication methods in an IKEv2 profile. You can configure only one local
authentication method and multiple remote authentication methods. Multiple remote authentication methods are allowed because
the profile caters to multiple peers, and the authentication method that a peer uses is not known. However, each remote authentication
method must be specified in a separate command.
If the RSA signature is configured as the local or remote authentication method, you must specify the PKI trustpoints to
obtain the signing and verification certificates using the
pki trustpoint command.
If a preshared key is configured as the local or remote authentication method, you must separately configure the preshared
keys and the keyring using the
keyring command to specify the local and remote keys.
If the
query-identity keyword is specified, the EAP identity request is sent when the remote peer indicates the intent to use EAP authentication
by omitting the Auth payload in the IKE-AUTH request and the local policy allows EAP authentication for the remote peer. The
remote EAP identity is used in the following scenarios:
-
The EAP identity is used to switch to another IKEv2 profile.
-
The remote EAP identity is passed to the RADIUS EAP server as the username for the peer to be authenticated for external
EAP.
-
The remote EAP identity is used to derive a name for requests using a name mangler.
The
timeout
seconds keyword-argument pair is used with the remote EAP authentication method and specifies the duration to obtain EAP credentials
on the EAP client.
Extensible Authentication Protocol (EAP) as the local authentication method is supported only on the IKEv2 initiator and EAP
as the remote authentication is supported only on the IKEv2 responder. If EAP is specified as the local authentication method,
the remote authentication method must be certificate based. If the
authentication remote eap query-identity command is not configured on the FlexVPN server, the client cannot have an IPv4 or IPv6 address as the local identity because
the IP address cannot be used as the username for the EAP authentication method.
Examples
The following example shows how to specify an authentication method in an IKEv2 profile:
Device(config)# crypto ikev2 profile profile1
Device(config-ikev2-profile)# match identity remote address 192.168.1.1
Device(config-ikev2-profile)# authentication local rsa-sig
Device(config-ikev2-profile)# authentication remote eap query-identity
Device(config-ikev2-profile)# authentication remote rsa-sig
Device(config-ikev2-profile)# identity local email user1@example.com
Device(config-ikev2-profile)# keyring keyring-1
Device(config-ikev2-profile)# pki trustpoint tp-remote verify
In the above example, the profile profile1 specifies preshare as the local authentication method and rsa-sig and EAP query
identity as the remote authentication methods that use keyring keyring-1 and the trustpoint tp-remote.
The following example shows how to configure an IKEv2 profile for two peers using different authentication methods:
Device(config)# crypto ikev2 profile profile2
Device(config-ikev2-profile)# match identity local email user1@example.com
Device(config-ikev2-profile)# match identity remote email user2@example.com
Device(config-ikev2-profile)# authentication local eap
Device(config-ikev2-profile)# authentication remote rsa-sig
The above profile caters to two peers, user1@example.com authenticated with EAP and user2@example.com authenticated with
preshare.
The following example shows how to configure the EAP as the local authentication method on the IKEv2 initiator:
Device(config)# crypto ikev2 profile prof-flex
Device(config-ikev2-profile)# match identity remote address 0.0.0.0
Device(config-ikev2-profile)# match certificate cmap-1
Device(config-ikev2-profile)# authentication remote rsa-sig
Device(config-ikev2-profile)# authentication local eap
Device(config-ikev2-profile)# keyring local key
Device(config-ikev2-profile)# pki trustpoint ca-server
The following example shows how to configure EAP as the remote authentication method on the IKEv2 responder:
Device(config)# crypto ikev2 profile prof-flex
Device(config-ikev2-profile)# match identity remote address 0.0.0.0
Device(config-ikev2-profile)# identity local dn
Device(config-ikev2-profile)# authentication remote eap query-identity
Device(config-ikev2-profile)# authentication local rsa-sig
Device(config-ikev2-profile)# keyring local key
Device(config-ikev2-profile)# pki trustpoint ca-server
Device(config-ikev2-profile)# aaa authentication eap rad
Feedback