VPN WITH PIX AND FQDN

[alle]

hello,

I try to migrate a vpn between pix and palo-alto

when I try to generate traffic I can see the following error :

IKE phase-1 negotiation is failed. When pre-shared key is used, peer-ID must be type IP address. Received type FQDN

I understand that my pix need to have a fqdn configured on PALO ALTO in the field -> IKE-GATEWAY

Peer identification -> fqdn(hostnname)

But this is strange because the same configuration between pix and checkpoint works fine without add an fqdn on checkpoint. it is possible on PAlo alto to ignore fqdn like checkpoint??

thanks for your help

[mhuels]

Hi alle,

checkpoint is not really choosy on building VPNs with others. I suppose, checkpoint tries to identificate with the peer name, and will make the tunnel without this identification, if it dont works.

We have several VPNs with foreign PIXes, but all with "identification none".

greetings

Manfred

[alle]

hi mhuels,

do you have already create a vpn between pix and palo-alto? it's works fine?

[mhuels]

alle schrieb:
hi mhuels,
do you have already create a vpn between pix and palo-alto? it's works fine?

yes we do so. No problems.

regards

manfred

[alle]

hello,

the problem is solve. pix use isakmp identity hostname

Checkpoint not check this parameters if you want use ip address psk between pix and PALO ALTO

you must use the parameter isakmp identity ip-address on pix

[alle]

resolved!