an approach that's still being deployed uses pre-shared keys for isakmp phase 1, and xauth in phase 2.
These are persistent passwords that can also be used to access anything else in the networks affected.