Peer Address vs Peer Identification in IPSec IKE Site to Site VPN with VM Firewall in Azure

[DKh Al Obaidi]

In IPSec, specifically in Phase 1 IKE, the term "peer" refers to the entity that is communicating with the local device, and there are two different ways to identify the peer:

Peer Address: This is the IP address or domain name that is used to identify the remote device with which the local device is communicating. The peer address is used to establish the initial connection between the two devices, and it is also used to route the encrypted traffic between them.

Peer Identification: This is a unique identifier that is used to authenticate the remote device during the IPSec negotiation process. The peer identification can be an IP address, a domain name, or a fully qualified domain name (FQDN). It is used to ensure that the remote device is authorized to communicate with the local device and to prevent unauthorized access.

Palo Alto VM firewall in Azure VPN site to site

If you are outside the Azure cloud (Azure will be doing the NAT) So the Peer Address and Peer Identification will be a bit confusing.

The main difference between peer address and peer identification is their purpose.

The peer address is used to establish the initial connection and to route the encrypted traffic, while the peer identification is used to authenticate the remote device during the IPSec negotiation process. Both are important for securing the IPSec communication and ensuring that only authorized devices are allowed to communicate with each.