IPSEC Tunnel to ASA - PeerID issues

[SDorsey]

I am setting up an IPSec tunnel to an ASA. I am getting an error message about the PEERID type only allowing IP but received FQDN. Per the other KB article, I changed the PAN Exchange mode to Aggressive.

Now the PAN received a FQDN of the ASA side and gave listed the FQDN in the system logs.

My question.. where in the ASA can you configure PEER and LOCAL ID in the Phase1 settings? I am not seeing that option so I cannot figure out how the PAN is getting the FQDN.

[sjamaluddin]

Your config on the firewall is expecting IP instead of  FQDN

Check below. Choose the appropriate option and the error should go away.

[SDorsey]

I appreciate the input but that's not quite it...

The issue is that it is receiving a FQDN for the PEER ID from the Cisco ASA. I am looking for how to determine in the ASA where it is sending its FQDN as an ID because I do not see anything in the ASA that would send its FQDN.

[HULK · Accepted solution]

A related DOC, it shows configuration sample for both PAN and CISCO firewall.

VPN Tunnel Down Between Palo Alto Networks Firewall Static IP Address and Cisco VTI on Dynamic IP Ad...

( On CISCO: crypto isakmp profile XYZ self-identity user-FQDN/IP XYZ )

Thanks

[SDorsey]

The crypto settings under number 2 showed me what to change. Thank you!

[mgordon · Accepted solution]

Hello all! If anyone runs across this article and would like to use the link referenced in the solution please see the below link:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClHVCA0