topic Hex value for a pre-shared IKE key? in Next-Generation Firewall Discussions

Hex value for a pre-shared IKE key?

brianjsmith7 — Tue, 07 Feb 2023 16:00:45 GMT

Hi,

Is it possible to set a IKEv2 pre-shared key to a hex value in a PAN-OS 9.1 or later NG firewall? Don't see an option with the GUI or CLI.

thanks,

Brian

Re: Hex value for a pre-shared IKE key?

murali438 — Wed, 08 Feb 2023 11:14:52 GMT

Hello

From PA Admin guide "The Pre-Shared Key value is a string that the administrator creates using a maximum of 255 ASCII or non-ASCII characters. Generate a key that is difficult to crack with dictionary attacks; use a pre-shared key generator, if necessary. "

Re: Hex value for a pre-shared IKE key?

brianjsmith7 — Wed, 08 Feb 2023 16:34:01 GMT

yes, but that does not answer my question. How does PAN-OS know the key entry format to convert to binary? Otherwise, I assume it considers the entry ascii. Can I use, for example, 0x before a hex string?

Re: Hex value for a pre-shared IKE key?

brianjsmith7 — Wed, 08 Feb 2023 17:20:53 GMT

nope. How does PAN-OS know the key entry format to convert to binary? Otherwise, I assume it considers the entry ascii. Can I use, for example, using 0x before a hex string does not work.

Re: Hex value for a pre-shared IKE key?

murali438 — Thu, 09 Feb 2023 04:11:51 GMT

Hello Brianjsmith7, I think, according to the documentation, what they meant is that you can also use Unicode. I don't think it allows you to use '0x' when giving hexadecimal characters. It reads that as a string of characters. For example, '48656C6C'.

Re: Hex value for a pre-shared IKE key?

brianjsmith7 — Thu, 09 Feb 2023 20:47:42 GMT

Thank you for your answer. I get something similar from support. So I conclude PA does not support binary keys, since I dont think all bit combinations are supported by unicode characters that could be entered, such as control keys.