Hex value for a pre-shared IKE key?

[brianjsmith7]

Hi,

Is it possible to set a IKEv2 pre-shared key to a hex value in a PAN-OS 9.1 or later NG firewall?  Don't see an option with the GUI or CLI.

thanks,

Brian

[murali438 · Accepted solution]

Hello 

From PA Admin guide "The Pre-Shared Key value is a string that the administrator creates using a maximum of 255 ASCII or non-ASCII characters. Generate a key that is difficult to crack with dictionary attacks; use a pre-shared key generator, if necessary. " 

[brianjsmith7]

yes, but that does not answer my question.  How does PAN-OS know the key entry format to convert to binary? Otherwise, I assume it considers the entry ascii.  Can I use, for example, 0x before a hex string?

[brianjsmith7]

nope. How does PAN-OS know the key entry format to convert to binary? Otherwise, I assume it considers the entry ascii.  Can I use, for example, using 0x before a hex string does not work.

[murali438 · Accepted solution]

Hello Brianjsmith7, I think, according to the documentation, what they meant is that you can also use Unicode. I don't think it allows you to use '0x' when giving hexadecimal characters. It reads that as a string of characters. For example, '48656C6C'.

[brianjsmith7]

Thank you for your answer. I get something similar from support. So I conclude PA does not support binary keys, since I dont think all bit combinations are supported by unicode characters that could be entered, such as control keys.