Corporate Headquarters

3-21
Cisco IOS VPN Configuration Guide
OL-8336-01
Chapter 3 Site-to-Site and Extranet VPN Business Scenarios
Step 3—Configuring Encryption and IPSec
Configuring a Different Shared Key
Because pre-shared keys were specified as the authentication method for policy 1 in the 
“Configuring 
IKE Policies” section on page 3-15
, (the policy that will also be used on the business partner router) 
complete the following steps at the headquarters router as well as the business partner router:
Step 1
Set each peer Internet Security Association & Key Management Protocol (ISAKMP) identity. Each peer 
identity should be set to either its host name or by its IP address. By default, a peer identity is set to its 
IP address. In this scenario, you only need to complete this task at the 
business partner
router.
Step 2
Specify the shared keys at each peer. Note that a given pre-shared key is shared between two peers. At 
a given peer, you could specify the same key to share with multiple remote peers; however, a more secure 
approach is to specify different keys to share between different pairs of peers.
Note
The following procedure is based on the 
“Extranet Scenario” section on page 3-4
.
To configure a different pre-shared key for use between the headquarters router and the business partner 
router, complete the following steps in global configuration mode:
Note
Set an ISAKMP identity whenever you specify pre-shared keys. The 
address
keyword is typically used 
when there is only one interface (and therefore only one IP address) that will be used by the peer for IKE 
negotiations, and the IP address is known. Use the 
hostname
keyword if there is more than one interface 
on the peer that might be used for IKE negotiations, or if the interface IP address is unknown (such as 
with dynamically-assigned IP addresses).