What is ISAKMP and do I need it?

Posted on 2012-09-04
Medium Priority
Last Modified: 2012-09-04
After running a vulnerability scan on my Cisco 1921 router (IOS device) I got the following message back:

ISAKMP Allows Weak IPsec Encryption Settings

Apparently this service uses UDP on port 500. Can anyone tell me what it's for, why I need it or if I need it?

Additionally, if I do need it how do I change the setting to set strong encryption? If I don't need it how do I disable it?

I'm still fairly green when it comes to configuring a Cisco router so please pretend I'm dumb (not much of a stretch really).
Question by:Russ Suter

Expert Comment

ID: 38364743
its for key exchange when setting up IPSEC VPN.  So if you use VPN on that router, then yes you need it.  If you dont, then you can probably disable.

This vulnerability shows up a lot on scanners - and it is usually a false positive.  see my answer to this question for an explanation:

LVL 43

Accepted Solution

Adam Brown earned 2000 total points
ID: 38364744
ISAKMP is a key management and exchange protocol. It's used to allow devices to exchange key information for encryption. Using it isn't the problem. The problem is that your configuration is allowing weak keys to be generated and used through ISAKMP. http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/ike.pdf should give you a good overview of ISAKMP. There's a section devoted to ISAKMP configuration you'll want to look at particularly. I'm not a Cisco guy, so I can't give you specific instructions, but you'll want to make sure that your devices are configured so that DES is not allowed. Cisco devices use 3DES by default, so this isn't a huge problem (DES was cracked 16 years ago, 3DES is still marginally secure. Use AES if you can).

Featured Post

NFR key for Veeam Backup for Microsoft Office 365

Veeam is happy to provide a free NFR license (for 1 year, up to 10 users). This license allows for the non‑production use of Veeam Backup for Microsoft Office 365 in your home lab without any feature limitations.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the hope of saving someone else's sanity... About a year ago we bought a Cisco 1921 router with two ADSL/VDSL EHWIC cards to load balance local network traffic over the two broadband lines we have, but we couldn't get the routing to work consi…
There’s a movement in Information Technology (IT), and while it’s hard to define, it is gaining momentum. Some call it “stream-lined IT;” others call it “thin-model IT.”
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question