Perform this task to configure the IKEv2 keyring if the local or remote authentication method is a preshared key.
Configure the IKEv2 keyring keys in the peer configuration submode that defines a peer subblock. An IKEv2 keyring can have
multiple peer subblocks. A peer subblock contains a single symmetric or asymmetric key pair for a peer or peer group. Any
combination of the hostname, identity, and IP address identifies the peer or the peer group.
IKEv2 keyrings are independent of IKEv1 keyrings. The key differences are as follows:
-
IKEv2 keyrings support symmetric and asymmetric preshared keys.
-
IKEv2 keyrings don't support Rivest, Shamir, and Adleman (RSA) public keys.
-
IKEv2 keyrings are specified in the IKEv2 profile and aren’t looked up, unlike IKEv1 keys. IKEv1 keys are looked up on receipt
of MM1 to negotiate the preshared key authentication method. IKEv2 doesn't negotiate the authentication method.
-
IKEv2 keyrings aren't associated with VPN routing and forwarding (VRF) during configuration. The VRF of an IKEv2 keyring
is the VRF of the IKEv2 profile that refers to the keyring.
-
You can specify a single keyring in an IKEv2 profile, unlike an IKEv1 profile, which can specify multiple keyrings.
-
If peers matching different profiles share the same keys, you can specify a single keyring in more than one IKEv2 profile,
.
-
An IKEv2 keyring is structured as one or more peer subblocks.
On an IKEv2 initiator, the IKEv2 keyring key lookup is performed using the hostname or the address of the peer, in that order.
On an IKEv2 responder, the key lookup is performed using the IKEv2 identity or the address of the peer, in that order.
![](https://www.cisco.com/content/dam/en/us/td/i/templates/note.gif)
Note
|
You can't configure the same identity in more than one peer.
|