Crypto

Cryptographic services provide comprehensive security capabilities including Public Key Infrastructure (PKI), IPsec VPN tunnels, Internet Key Exchange version 2 (IKEv2), and crypto engine compliance controls for secure communication between network devices and endpoints. These services enable encryption, authentication, and integrity protection for data in transit, supporting both site-to-site and remote access VPN scenarios. The crypto subsystem manages certificates, trust relationships, encryption policies, security associations, and cryptographic algorithm compliance settings necessary for establishing and maintaining secure communications across untrusted networks.

Diagram

Classes

configuration (iosxe.devices)

Name	Type	Constraint	Mandatory	Default Value
crypto	Class	`[crypto]`	No

crypto (iosxe.devices.configuration)

Name	Type	Constraint	Mandatory
ipsec_profiles	List	`[ipsec_profiles]`	No
ipsec_transform_sets	List	`[ipsec_transform_sets]`	No
ikev2	Class	`[ikev2]`	No
pki	Class	`[pki]`	No
engine	Class	`[engine]`	No

ipsec_profiles (iosxe.devices.configuration.crypto)

Name	Type	Constraint	Mandatory
name	String		Yes
set_ikev2_profile	String		No
set_isakmp_profile	String		No
set_pfs_group	Choice	`group1`, `group2`, `group5`, `group14`, `group15`, `group16`, `group19`, `group20`, `group21`, `group24`	No
set_security_association_lifetime_seconds	Integer	min: `120`, max: `2592000`	No
set_security_association_lifetime_seconds_legacy	Integer	min: `120`, max: `2592000`	No
set_transform_set	List	String	No

ipsec_transform_sets (iosxe.devices.configuration.crypto)

Name	Type	Constraint	Mandatory
name	String		Yes
esp	Choice	`esp-3des`, `esp-aes`, `esp-des`, `esp-gcm`, `esp-gmac`, `esp-null`, `esp-seal`	Yes
esp_hmac	Choice	`esp-md5-hmac`, `esp-sha-hmac`, `esp-sha256-hmac`, `esp-sha384-hmac`, `esp-sha512-hmac`	Yes
mode_tunnel	Boolean	`true`, `false`	No

ikev2 (iosxe.devices.configuration.crypto)

Name	Type	Constraint	Mandatory
nat_keepalive	Integer	min: `5`, max: `3600`	No
dpd_interval	Integer	min: `10`, max: `3600`	No
dpd_query	Choice	`on-demand`, `periodic`	No
dpd_retry	Integer	min: `2`, max: `60`	No
http_url_certificate_lookup	Boolean	`true`, `false`	No
profiles	List	`[profiles]`	No
keyrings	List	`[keyrings]`	No
policies	List	`[policies]`	No
proposals	List	`[proposals]`	No

pki (iosxe.devices.configuration.crypto)

Name	Type	Constraint	Mandatory	Default Value
trustpoints	List	`[trustpoints]`	No

engine (iosxe.devices.configuration.crypto)

Name	Type	Constraint	Mandatory	Default Value
compliance_shield_disable	Boolean	`true`, `false`	No

profiles (iosxe.devices.configuration.crypto.ikev2)

Name	Type	Constraint	Mandatory
name	String		Yes
authentication_local_pre_share	Boolean	`true`, `false`	No
authentication_remote_pre_share	Boolean	`true`, `false`	No
config_exchange_request	Boolean	`true`, `false`	No
description	String		No
dpd_interval	Integer	min: `10`, max: `3600`	No
dpd_query	Choice	`on-demand`, `periodic`	No
dpd_retry	Integer	min: `2`, max: `60`	No
identity_local_address	IP		No
identity_local_key_id	String		No
ivrf	String		No
keyring_local	String		No
lifetime	Integer	min: `120`, max: `86400`	No
match_address_local_interface_loopback	List	`[match_address_local_interface_loopback]`	No
match_address_local_interface_loopback_legacy	Integer	min: `0`, max: `2147483647`	No
match_address_local_ip	IP		No
match_fvrf	String		No
match_fvrf_any	Boolean	`true`, `false`	No
match_identity_remote_ipv4_addresses	List	`[match_identity_remote_ipv4_addresses]`	No
match_identity_remote_ipv6_prefixes	List	String	No
match_identity_remote_keys	List	String	No
match_inbound_only	Boolean	`true`, `false`	No

keyrings (iosxe.devices.configuration.crypto.ikev2)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
peers	List	`[peers]`	No

policies (iosxe.devices.configuration.crypto.ikev2)

Name	Type	Constraint	Mandatory
name	String		Yes
proposals	List	String	Yes
device	String		No
match_address_local_ip	List	IP	No
match_fvrf	String		No
match_fvrf_any	Boolean	`true`, `false`	No
match_inbound_only	Boolean	`true`, `false`	No

proposals (iosxe.devices.configuration.crypto.ikev2)

Name	Type	Constraint	Mandatory
name	String		Yes
encryption	List	Choice[`aes_cbc_128`, `aes_cbc_192`, `aes_cbc_256`, `aes_gcm_128`, `aes_gcm_256`, `en_3des`]	No
group	List	Choice[`1`, `2`, `14`, `15`, `16`, `19`, `20`, `21`, `24`]	No
integrity	List	Choice[`md5`, `sha1`, `sha256`, `sha384`, `sha512`]	No
prf	List	Choice[`md5`, `sha1`, `sha256`, `sha384`, `sha512`]	No

trustpoints (iosxe.devices.configuration.crypto.pki)

Name	Type	Constraint	Mandatory
id	String		Yes
enrollment_mode_ra	Boolean	`true`, `false`	No
enrollment_pkcs12	Boolean	`true`, `false`	No
enrollment_selfsigned	Boolean	`true`, `false`	No
enrollment_terminal	Boolean	`true`, `false`	No
hash	Choice	`md5`, `sha1`, `sha256`, `sha384`, `sha512`	No
revocation_check	List	String	No
rsakeypair	String		No
source_interface	String		No
subject_name	String		No
usage	Choice	`ike`, `ssl-client`, `ssl-server`	No

match_address_local_interface_loopback (iosxe.devices.configuration.crypto.ikev2.profiles)

Name	Type	Constraint	Mandatory	Default Value
loopback_number	Integer	min: `0`, max: `2147483647`	Yes

match_identity_remote_ipv4_addresses (iosxe.devices.configuration.crypto.ikev2.profiles)

Name	Type	Constraint	Mandatory	Default Value
address	IP		Yes
mask	IP		No

peers (iosxe.devices.configuration.crypto.ikev2.keyrings)

Name	Type	Constraint	Mandatory
name	String		Yes
description	String		No
hostname	String		No
identity_address	IP		No
identity_email_domain	String		No
identity_email_name	String		No
identity_fqdn_domain	String		No
identity_fqdn_name	String		No
identity_key_id	String		No
ipv4_address	IP		No
ipv4_mask	IP		No
ipv6_prefix	String		No
pre_shared_key	String		No
pre_shared_key_encryption	Choice	`0`, `6`	No
pre_shared_key_local	String		No
pre_shared_key_local_encryption	Choice	`0`, `6`	No
pre_shared_key_remote	String		No
pre_shared_key_remote_encryption	Choice	`0`, `6`	No

Guidelines and Limitations

The identity_fqdn_name and identity_fqdn_domain attributes (under keyrings[].peers[]) are mutually exclusive. Use identity_fqdn_name for a specific FQDN (e.g., gateway5), or identity_fqdn_domain for a domain suffix (e.g., example.com).

Sample Configuration

crypto pki trustpoint trustpoint1
 enrollment selfsigned
 enrollment pkcs12
 usage ike
 subject-name cn=Router1
 rsakeypair mykey
 hash sha256
!
crypto ipsec transform-set TEST esp-aes esp-sha-hmac
 mode tunnel
!
crypto ipsec profile vpn200
 set transform-set TEST
 set ikev2-profile PROFILE1
 set isakmp-profile PROFILE1
 set pfs group20
 set security-association lifetime seconds 3600
!
crypto ikev2 proposal PROPOSAL1
 encryption aes-cbc-256
 integrity sha256
 group 16
!
crypto ikev2 proposal PROPOSAL2
 encryption aes-gcm-256
 integrity sha384
 group 20
!
crypto ikev2 policy POLICY1
 proposal PROPOSAL1
 match address local 1.2.3.4
 match fvrf any
!
crypto ikev2 policy POLICY2
 proposal PROPOSAL1
 match fvrf VRF1
!
crypto ikev2 keyring KEYRING1
 peer PEER1
  description My description
  address 1.2.3.4 255.255.255.248
  identity key-id key1
  pre-shared-key local 6 cisco123
  pre-shared-key remote 6 cisco123
 peer PEER2
  description temp
  hostname gateway1
  identity email-domain cisco.com
  pre-shared-key 6 cisco123
 peer PEER3
  description temp2
  hostname gateway4
  identity email abc
 peer PEER4
  description FQDN name identity example
  hostname gateway5.example.com
  identity fqdn gateway5
  pre-shared-key 6 cisco123
!
crypto ikev2 profile PROFILE1
 description My description
 match identity remote address 1.2.3.4 255.255.255.0
 match identity remote key-id key1
 match address local 1.2.3.4
 match address local interface Loopback100
 match fvrf any
 match inbound-only
 identity local key-id KEY1
 authentication remote pre-share
 authentication local pre-share
 keyring local KEYRING1
 lifetime 28800
 dpd 10 2 periodic
 no config-exchange request
!
crypto ikev2 profile PROFILE2
 description VRF-specific profile
 match fvrf VRF1
 authentication remote pre-share
 authentication local pre-share
!
crypto engine compliance shield disable

Examples

iosxe:
  devices:
    - name: Device1
      configuration:
        crypto:
          pki:
            trustpoints:
              - id: trustpoint1
                enrollment_selfsigned: true
                enrollment_pkcs12: false
                rsakeypair: mykey
                subject_name: cn=Router1
                hash: sha256
                usage: ike
          ipsec_profiles:
          - name: vpn200
            set_transform_set: [TEST]
            set_isakmp_profile: PROFILE1
            set_pfs_group: group20
            set_security_association_lifetime_seconds: 3600
          ipsec_transform_sets:
            - name: TEST
              esp: esp-aes
              esp_hmac: esp-sha-hmac
              mode_tunnel: true
          ikev2:
            nat_keepalive: 20
            dpd_interval: 10
            dpd_query: periodic
            dpd_retry: 5
            http_url_certificate_lookup: true
            profiles:
              - name: PROFILE1
                description: My description
                authentication_remote_pre_share: true
                authentication_local_pre_share: true
                identity_local_key_id: KEY1
                lifetime: 28800
                match_address_local_interface_loopback_legacy: 100 # IOS-XE versions before 17.18.x
                match_address_local_interface_loopback: # IOS-XE 17.18.x and later
                  - loopback_number: 100
                match_address_local_ip: 1.2.3.4
                match_fvrf_any: true
                match_inbound_only: true
                match_identity_remote_ipv4_addresses:
                  - address: 1.2.3.4
                    mask: 255.255.255.0
                match_identity_remote_keys: [key1]
                keyring_local: KEYRING1
                dpd_interval: 10
                dpd_retry: 2
                dpd_query: periodic
                config_exchange_request: false
              - name: PROFILE2
                description: VRF-specific profile
                authentication_remote_pre_share: true
                authentication_local_pre_share: true
                match_fvrf: VRF1
            keyrings:
              - name: KEYRING1
                peers:
                  - name: PEER1
                    description: My description
                    ipv4_address: 1.2.3.4
                    ipv4_mask: 255.255.255.248
                    identity_key_id: key1
                    pre_shared_key_local_encryption: "6"
                    pre_shared_key_local: cisco123
                    pre_shared_key_remote_encryption: "6"
                    pre_shared_key_remote: cisco123
                  - name: PEER2
                    description: temp
                    hostname: gateway1
                    ipv6_prefix: 2001::1/128
                    identity_email_domain: cisco.com
                    pre_shared_key_encryption: "6"
                    pre_shared_key: cisco123
                  - name: PEER3
                    description: temp2
                    hostname: gateway4
                    ipv6_prefix: 2001::2/128
                    identity_email_name: abc
                  - name: PEER4
                    description: FQDN name identity example
                    hostname: gateway5.example.com
                    identity_fqdn_name: gateway5
                    pre_shared_key_encryption: "6"
                    pre_shared_key: cisco123
            policies:
              - name: POLICY1
                proposals: [PROPOSAL1]
                match_address_local_ip: [1.2.3.4]
                match_fvrf_any: true
                match_inbound_only: false
              - name: POLICY2
                proposals: [PROPOSAL1]
                match_fvrf: VRF1
            proposals:
              - name: PROPOSAL1
                encryption_aes_cbc_256: true
                group_sixteen: true
                integrity_sha256: true
              - name: PROPOSAL2
                encryption_aes_gcm_256: true
                group_twenty: true
                integrity_sha384: true
          engine:
            compliance_shield_disable: true

Cryptographic services provide comprehensive security capabilities including Public Key Infrastructure (PKI), IPsec VPN tunnels, and Internet Key Exchange version 2 (IKEv2) for secure communication between network devices and endpoints. These services enable encryption, authentication, and integrity protection for data in transit, supporting both site-to-site and remote access VPN scenarios. The crypto subsystem manages certificates, trust relationships, encryption policies, and security associations necessary for establishing and maintaining secure communications across untrusted networks.