Using PKI for Authentication only

[Brian Green]

Hello,

We are looking to use PKI in our DMVPN config, but I wanted to ask - can the certs be used just for authentication and not encryption?  We have traffic encryptors outside the DMVPN tunnel so we wouldn't need to double-encrypt the traffic and wanted to reduce the load on the routers (if we can).

Thanks,

Brian

[Marcin Latosiewicz]

Brian, 

The certs (actually RSA sig) are only used to authenticate IKE exchange. The key material used for encryption/decryption is different. 

Additionally most new Cisco routers have an onboard crypto acceleration chip handling encryption and decryption processes. 

M.