IKE Certificate Authentication Peer ID

[Chris.Billett]

Hi,

Im trying to setup a VPN connection using certificate based authentication. When Phase 1 tries to establish I'm getting the following error

Peer's ID payload ' IPv4_address:xxx.xxx.xxx.xxx' does not match certificate ID, Error: failed to get subjectAltName.

I have added the peer's IP address to the IP(SAN) of the  certificate and also tried using 'Permit peer identification and certificate payload identification mismatch' with no luck.

Any further suggestions on how to bring up phase 1?

Thanks

[BeardedTree]

The error seems to suggest that either A. The other side is sending a local identification that does not match any SAN that is present on the certificate or B. Does not contain a SAN attribute on the certificate at all.

Are both sides under your control, where you're able to generate a new certificate if need be or inspect the current attributes of the certificate it's using?

Also make sure the Certificate Profile on the VPN contains the Intermediate, Root or Self Signed certificate and is marked as a Trusted certificate in the local device store.

[Chris.Billett]

Hi,

I can generate a new certificate if required.

The issue is that it's looking for the peer id which is an IP address in the SAN. I have added this into the cert and verified its there in the SAN but it still doesn't not get picked up during the phase 1 verification - would it be work adding another san entry like hostname and adding the IP address?

[BeardedTree]

If you can generate a new certificate it would defiantly be worth generating a new one containing additional SAN entries.

I'd suggest tagging on the SANs Hostname, FQDN and IP address and check if you can get the firewall to recognize these attributes as the Peer Identification.

[Chris.Billett]

New certificate didn't do the trick. PA Support also don't seem to know either 😞