topic Re: IPSEC Tunnel to ASA - PeerID issues in General Topics

IPSEC Tunnel to ASA - PeerID issues

SDorsey — Fri, 11 Jul 2014 15:56:15 GMT

I am setting up an IPSec tunnel to an ASA. I am getting an error message about the PEERID type only allowing IP but received FQDN. Per the other KB article, I changed the PAN Exchange mode to Aggressive.

Now the PAN received a FQDN of the ASA side and gave listed the FQDN in the system logs.

My question.. where in the ASA can you configure PEER and LOCAL ID in the Phase1 settings? I am not seeing that option so I cannot figure out how the PAN is getting the FQDN.

Re: IPSEC Tunnel to ASA - PeerID issues

sjamaluddin — Fri, 11 Jul 2014 16:01:01 GMT

Your config on the firewall is expecting IP instead of FQDN

Check below. Choose the appropriate option and the error should go away.

Re: IPSEC Tunnel to ASA - PeerID issues

SDorsey — Fri, 11 Jul 2014 16:03:14 GMT

I appreciate the input but that's not quite it...

The issue is that it is receiving a FQDN for the PEER ID from the Cisco ASA. I am looking for how to determine in the ASA where it is sending its FQDN as an ID because I do not see anything in the ASA that would send its FQDN.

Re: IPSEC Tunnel to ASA - PeerID issues

HULK — Fri, 11 Jul 2014 16:04:12 GMT

A related DOC, it shows configuration sample for both PAN and CISCO firewall.

VPN Tunnel Down Between Palo Alto Networks Firewall Static IP Address and Cisco VTI on Dynamic IP Address

( On CISCO: crypto isakmp profile XYZ self-identity user-FQDN/IP XYZ )

Thanks

Re: IPSEC Tunnel to ASA - PeerID issues

SDorsey — Fri, 11 Jul 2014 16:08:32 GMT

The crypto settings under number 2 showed me what to change. Thank you!

Re: IPSEC Tunnel to ASA - PeerID issues

mgordon — Tue, 03 Jan 2023 21:36:19 GMT

Hello all! If anyone runs across this article and would like to use the link referenced in the solution please see the below link:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHVCA0