Corporate Headquarters

Configuring Pre-shared Keys
To configure pre-shared keys, perform these steps at each peer that uses pre-shared keys in an IKE 
policy:
Step 1
Set each peer ISAKMP identity. Each peer identity should be set to either its host name or by its IP 
address. By default, a peer identity is set to its IP address. 

---

3-18
Cisco IOS VPN Configuration Guide
OL-8336-01
Chapter 3 Site-to-Site and Extranet VPN Business Scenarios
Step 3—Configuring Encryption and IPSec
Step 2
Specify the shared keys at each peer. Note that a given pre-shared key is shared between two peers. At 
a given peer, you could specify the same key to share with multiple remote peers; however, a more secure 
approach is to specify different keys to share between different pairs of peers.
Note
The following procedure is based on the 
“Site-to-Site Scenario” section on page 3-2
. However, the same 
configuration commands can be used in an extranet scenario.
To specify pre-shared keys at a peer, complete the following steps in global configuration mode:
Note
Set an ISAKMP identity whenever you specify pre-shared keys. The 
address
keyword is typically used 
when there is only one interface (and therefore only one IP address) that will be used by the peer for IKE 
negotiations, and the IP address is known. Use the 
hostname
keyword if there is more than one interface 
on the peer that might be used for IKE negotiations, or if the interface IP address is unknown (such as 
with dynamically-assigned IP addresses).
Command
Purpose
Step 1
hq-sanjose(config)#
crypto isakmp identity 
address
At the local peer
: Specify the ISAKMP identity (