Sunday, May 28, 2017

Retrieving Encrypted Pre-Shared Keys from a Cisco ASA Configuration

Have you ever forgotten to document the ASA pre-shared keys for a VPN or VPN client connection?   Do you need to see the unencrypted password?  Try a show run on your Cisco ASA and you will likely find that all of your IKE pre-shared keys show up as *****.  Fortunately, for me anyway, the one who tends to be slack on documenting, there is a method to retrieve those keys.

The command:

 more system:running-config

See the difference in the results of “show run” and “more system:running-config”.  Note that I filtered the output to only include the items of interest here.
ciscoasa# sh run | inc shared
 ikev1 pre-shared-key *****
 ikev1 pre-shared-key *****
ciscoasa# more system:running-config | inc shared
 ikev1 pre-shared-key 1!&rGU2Ptu
 ikev1 pre-shared-key con!@#@Dmin

No comments: