Route-based VPN using IKEV2 on ASR 1001X?

[davinci]

Is a route-based VPN using IKEv2 supported on ASR1001X?  If yes, can someone share a a basic config template or link for instructions? I'm having a hard time finding anything online for this scenario and specific requirements.

hash-sha256

authentication-PSK

group-14

lifteime-3600

encryption-aes 

[Francesco Molino]

Hi

You can check this link for examples:

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnips/configuration/xe-16-6/sec-sec-for-vpns-w-ipsec-xe-16-6-book/sec-ipsec-virt-tunnl.html

Examples are based on ikev1 but you can change the crypto to be in ikev2.

[Rob Ingram]

@davinci 

Route-based IKEv2 VPNs on a Cisco router is referred to as FlexVPN.

The reference link below has guides with configuration for different scenarios.

https://www.cisco.com/c/en/us/support/security/flexvpn/products-configuration-examples-list.html

Refer to this guide the information on the latest algorithms to use in the VPN

https://tools.cisco.com/security/center/resources/next_generation_cryptography

[davinci]

Thanks for the links but something remains unclear.  If I want to use a pre-shared key with FlexVPN, then do I use the Keyring feature or the commands below under IKEv2 profile? 

crypto ikev2 keyring abc
peer x.x.x.x
address x.x.x.x
pre-shared-key XYZ

OR

crypto ikev2 profile testprofile
match identity remote address 1.1.1.1
identity local address abcd
authentication local pre-share ????
authentication remote pre-share ????

[Rob Ingram · Accepted solution]

@davinci 

You can use either. If you use the ikev2 keyring you could specify different PSK per spoke/peer. Or if you defined the PSK under the ikev2 profile, then that PSK would apply to all connections.

HTH