topic Re: IPSec Tunnel Works with Static Peer, but not with Dynamic FQDN Peer in General Topics

IPSec Tunnel Works with Static Peer, but not with Dynamic FQDN Peer

StephenJennings — Tue, 12 Jun 2018 13:19:13 GMT

Hi,

I have an IPSec tunnel up and running with no issues using a staic IP for the peer in the IKE gateway, but it won't work when I set it to Dynamic and use the FQDN (hostname).

When I ping from the command line it translates to the correct IP, and replies with no issue, but the tunnel will not come up.

Are there some FQDN or DNS settings I need to change or is there a way to verify it works? Or am I putting the FQDN in using an incorrect format? ( name.domain.com )

Thanks.

Re: IPSec Tunnel Works with Static Peer, but not with Dynamic FQDN Peer

LukeBullimore — Tue, 12 Jun 2018 13:42:53 GMT

Hi Stephen,

Has "local/peer identification" been configured on the peer device with the matching confgiuration?

What error messages do you see in the system logs when attempting to use FQDN?

Thanks,

Luke.

Re: IPSec Tunnel Works with Static Peer, but not with Dynamic FQDN Peer

StephenJennings — Tue, 12 Jun 2018 14:23:38 GMT

Hi, thanks for helping.

The other side is configured and working when I use the staic IP, but not when I use FQDN. That's the only change.

And the logs say "ikev2 ike sa negotiation is failed as initiator non-rekey"

Re: IPSec Tunnel Works with Static Peer, but not with Dynamic FQDN Peer

LukeBullimore — Tue, 12 Jun 2018 14:27:15 GMT

Hi,

When you say you "use FQDN" please confirm if you you have an FQDN in the "local/peer identifdication"? of the IKE gateway? If yes: local/peer identification will need to be configured on peer end.

If it does not work after configuring this, could you ascertain detailed logs from:

>tail follow yes mp-log ikemgr.log

Thanks,

Luke.

Re: IPSec Tunnel Works with Static Peer, but not with Dynamic FQDN Peer

JoeAndreini — Tue, 12 Jun 2018 14:30:53 GMT

You do not mention it specifically in your question, but take note - only one side of an IPSEC tunnel can be dynamic.

Re: IPSec Tunnel Works with Static Peer, but not with Dynamic FQDN Peer

BPry — Tue, 12 Jun 2018 15:23:50 GMT

@StephenJennings,

I think your issue is what @LukeBullimore is getting at. When you configure the initiator or the responder to use FQDN in the peer identification it really doesn't matter what you put here as long as it matches. I can configure the Peer Identification as FQDN with the value 'SEN19' on my responder as long as my initiator has the local identification as FQDN and matches 'SEN19'. If these values don't match this will fail. The FQDN you enter doesn't matter at all, as long as the configured FQDN value matches on either end it doesn't need to resolve to anything or be the actual hostname of the device.

Re: IPSec Tunnel Works with Static Peer, but not with Dynamic FQDN Peer

StephenJennings — Tue, 12 Jun 2018 15:46:00 GMT

Hey, thanks.

On the IKE Gateway I've selcted Peer Type Dynamic, and the Peer Identification as FQDN (Houstname) Name.Domain.Com.

Is there somewhere else I need to enter the FQDN on the Palo Alto, or do I need to make a change on the peer device?

Re: IPSec Tunnel Works with Static Peer, but not with Dynamic FQDN Peer

BPry — Tue, 12 Jun 2018 18:31:12 GMT

@StephenJennings,

The peer device needs to have it's local identification set as FQDN as Name.Domain.Com.

Re: IPSec Tunnel Works with Static Peer, but not with Dynamic FQDN Peer

BPry — Tue, 12 Jun 2018 18:33:36 GMT

@StephenJennings,

Essentially how it works is one will have the Local Identification set as FQDN with whatever FQDN value you are setting, then the peer to that would need the Peer Identification set as FQDN with whatever FQDN value you setup above. These values must match.

Re: IPSec Tunnel Works with Static Peer, but not with Dynamic FQDN Peer

StephenJennings — Wed, 13 Jun 2018 06:54:41 GMT

Thanks, that was it.

Re: IPSec Tunnel Works with Static Peer, but not with Dynamic FQDN Peer

mhm_ameen — Tue, 30 Aug 2022 07:02:15 GMT

hi, is fqdn must be in format Name.Domain.Com or i can put IP address ??