topic Re: VPN WITH PIX AND FQDN in General Topics

VPN WITH PIX AND FQDN

alle — Thu, 05 Apr 2012 13:39:46 GMT

hello,

I try to migrate a vpn between pix and palo-alto

when I try to generate traffic I can see the following error :

IKE phase-1 negotiation is failed. When pre-shared key is used, peer-ID must be type IP address. Received type FQDN

I understand that my pix need to have a fqdn configured on PALO ALTO in the field -> IKE-GATEWAY

Peer identification -> fqdn(hostnname)

But this is strange because the same configuration between pix and checkpoint works fine without add an fqdn on checkpoint. it is possible on PAlo alto to ignore fqdn like checkpoint??

thanks for your help

Re: VPN WITH PIX AND FQDN

mhuels — Thu, 05 Apr 2012 14:54:59 GMT

Hi alle,

checkpoint is not really choosy on building VPNs with others. I suppose, checkpoint tries to identificate with the peer name, and will make the tunnel without this identification, if it dont works.

We have several VPNs with foreign PIXes, but all with "identification none".

greetings

Manfred

Re: VPN WITH PIX AND FQDN

alle — Thu, 05 Apr 2012 15:42:23 GMT

hi mhuels,

do you have already create a vpn between pix and palo-alto? it's works fine?

Re: VPN WITH PIX AND FQDN

mhuels — Thu, 05 Apr 2012 15:44:30 GMT

alle schrieb:

hi mhuels,

do you have already create a vpn between pix and palo-alto? it's works fine?

yes we do so. No problems.

regards

manfred

Re: VPN WITH PIX AND FQDN

alle — Fri, 06 Apr 2012 12:13:32 GMT

hello,

the problem is solve. pix use isakmp identity hostname

Checkpoint not check this parameters if you want use ip address psk between pix and PALO ALTO

you must use the parameter isakmp identity ip-address on pix

Re: VPN WITH PIX AND FQDN

alle — Fri, 06 Apr 2012 12:18:16 GMT

resolved!