I'm trying to work with another party to set up a site-to-site IPsec VPN between us and them. We are behind NAT, so need their Cisco (ASA 5510 on IOS 9.1.7) to match on our IKE id (key-id in Cisco parlance). The problem is the other party has said that they can only enable key-id on a global level, not on a tunnel-level, so they aren't able to do so due to impacting other VPNs.

Is this correct, key-id matching is an all or nothing thing? If enabled it's used for all tunnels, not just the ones that require it? The only literature I've found on it is from Cisco itself and does seem to imply a global scope, but I'm not an expert in Cisco config hence this question.

To change the peer identification method, enter the following command:

crypto isakmp identity {address | hostname | key-id id-string | auto}

Are there any other alternatives to get an IPsec tunnel correctly matching when we are NAT'd? We are restricted to IPsec and IKEv1 using PSK. Certificates aren't an option unfortunately.


In the documentation you provided it states the following:

"The security appliance uses the Phase I ID to send to the peer. This is true for all VPN scenarios except LAN-to-LAN connections in main mode that authenticate with preshared keys."

Rather than authenticating with the Key ID, I would use Pre-Shared-Keys. Replace x.x.x.x with your globally known IP. z.z.z.z would be their globally known address.

The remote ASA Code would look something like this:

tunnel-group x.x.x.x type ipsec-l2l
tunnel-group x.x.x.x ipsec-attributes
 ikev1 pre-shared-key 0 secretp@ssw0rd

If you have a Cisco IOS Router, your code may looks something like this:

crypto isakmp key 0 secretp@ssw0rd address z.z.z.z

key 0 or pre-shared-key 0 denotes that the following PSK is unencypted. It is not a unique value that must be the same on both sides of the tunnel.

  • Yes we are authenticating using PSK already, however the issue is identification which operates on either IP, Key-ID, or Certificate DN/Alt Subject Name (we don't support certs). Once the traffic is identified, the Cisco can then find the relevant PSK for it. – Mike Dec 14 '16 at 9:25
  • Sorry, re-read your answer. So you're saying it's possible to identify based on the PSK, which is sent unencrypted across the tunnel? – Mike Dec 14 '16 at 9:37
  • Yes, but keep in mind that the tunnel group / peer address + the PSK is how the tunnel is distinctly identified. The PSK is not sent clear-text. The initiator sends a hash of the PSK and the recipient checks the hash against the PSK. – TDurden Dec 14 '16 at 14:57
  • The encrypted / non-encrypted key in the example above is to protect against shoulder surfing. It does not affect how the key is used in the tunnel. – TDurden Dec 14 '16 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.