topic ikev2 with cisco Router using certificate problem in General Topics

ikev2 with cisco Router using certificate problem

Luping — Thu, 20 Aug 2020 11:56:15 GMT

after I finished the ikev2 configuration(using Distinguished Name (Subject) from PAN and Cisco Router using identity local dn ), I got this isse:

received ID_I (type dn [CN=externalrouter.robinlab.org,unstructuredName=externalrouter.robinlab.org]) does not match peers id

after this:

IKEv2 IKE SA negotiation is failed as responder

any ideas?

regards

Luping

Re: ikev2 with cisco Router using certificate problem

SutareMayur — Thu, 20 Aug 2020 12:57:54 GMT

@LupingThere seems to be mismatch in the DN name you have configured under IKE gateway and the certificate present under certificate profile. Also verify IKE version configuration at both ends.

Re: ikev2 with cisco Router using certificate problem

Luping — Thu, 20 Aug 2020 13:05:59 GMT

I changed the configuration using preshare for Ikev2, it works. Just if I change to certificate, it show me this error message. it should no IKE missconfigure...

and DN, I just use the subject-name CN, you can see both find the same DN "externalrouter.robinlab.org".

"CN=externalrouter.robinlab.org,unstructuredName=externalrouter.robinlab.org" --- what is "unstructuredName"?

PKI Configuration from Router:

crypto pki trustpoint CA
enrollment terminal
serial-number none
fqdn externalrouter.robinlab.org
ip-address none
subject-name CN=externalrouter.robinlab.org
revocation-check none
rsakeypair sslkey