Facing issue after config-key password-encrypt command

[mandeepku]

Hi,

I configured command:

key config-key password-encrypt **********Router(config)#password encryption aes

  to encrypt all other keys in the router configuration       with the use of an Advance Encryption Standard (AES) symmetric cipher.

I specifically do this for encypting ISAKMP key in router configuration.

I am facing a problem whenever router reboot, after reboot it is not taking encrpted key in encrypted form but considering it as plaintext.

Due to this IPSEC is not working after reboot and throwing an error message "IKE message from x.x.x.x failed its  sanity check or is malformed"

Pls let me know the solution to overcome the problem.

like to add one more thing, whenever i reboot the router i need to run key config-key password-encrypt command to establish phase one of IPSEC.

Thanks in advance.

[mandeepku]

hi guys,

anybody having any clue about the problem???

Pls help

[rpadwal]

Hi Mandeep,

Please follow the link and let me know if it helps.

http://www.cisco.com/en/US/docs/ios/sec_secure_connectivity/configuration/guide/sec_encrypt_preshare.pdf

Please write the config to mem and test, after reload the keys still remain encrypted.

Thanks and Regards,

        ROHAN 

[mandeepku]

Thanks Rohan for info shared by you.

I am facing problem only when router reboot, once router reboot ISAKMP keys are shown in encrypted form only in configuration file but i have to execute  key config-key password-encrypt **********  command to make router understand that it is encrypted password. 

Till the time i will not run key config-key command it will not be able to know that password stored in configuration file is encrypted. (definetly i am doing wr mem every time).

note --> After router reboot when i configure "key config-key" command, at that time it is not asking for old key that means command become null and void after reboot.

DOC shared by you is not providing any help o the existing problem.

Pls share some other method to resolve the issue.

Thanks for your reply:)

[rpadwal]

Hi Mandeep,

will try and recreate this and will update soon

when router reboots can you share the debug output for the follwoing command

debug cry isa 255

Thanks

ROHAN 

[mandeepku]

Hi Rohan,

At the time of problem i get the following error for ipsec:

%CRYPTO-4-IKMP_BAD_MESSAGE: IKE message from 172.16.6.2
  failed its sanity check or is malformed

Pls assist.

Thanks n regards

mandeep