# FlexVPN PKI Authentication

**URL:** https://forum.networklessons.com/t/flexvpn-pki-authentication/13240
**Category:** Lessons Discussion
**Created:** [January 4, 2021, 1:42pm UTC](https://forum.networklessons.com/t/flexvpn-pki-authentication/13240 "2021-01-04T13:42:27Z")
**Posts on this page:** 1
**Showing post:** 6

<div class="post-metadata">

### Author: ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)
#### Post date: [April 8, 2025, 6:07am UTC](https://forum.networklessons.com/t/flexvpn-pki-authentication/13240/6 "2025-04-08T06:07:27Z")

</div>

Hello Ravi

I’ll do my best to answer your questions.

> [@raviluchmun](#):
>
> In the final configs section, why do you provide PSK for both remote and local, since one will only be using a cert ?

The reason both `pre-shared-key local` and `pre-shared-key remote` are configured on both routers, even though only one side uses a certificate, is because of how IKEv2 mutual authentication works in Cisco IOS when using a mixed mode of RSA-sig and PSK:

- R1 uses local authentication, where an RSA signature is used, and the certificate is from its PKI trustpoint. R1 also uses PSK for remote authentication.
- R2 uses PSK for local authentication and RSA signature for its remote authentication (it expects R1’s certificate

So why are both local and remote PSK configured? Because in Cisco IOS, the `pre-shared-key local` = the key each router sends to authenticate itself, and the `pre-shared-key remote` = the key each router expects from the peer.

So even though R1 authenticates itself with a certificate, it still expects a PSK from R2, and R2 authenticates itself with a PSK, but expects a certificate from R1. Therefore, each side must define both directions of the PSK. Does that make sense?

I hope this has been helpful!

Laz

---

_[View the full topic](https://forum.networklessons.com/t/flexvpn-pki-authentication/13240)._