Cisco VPN peer id configuration

[omera]

Hey Everyone,

I have been troubleshooting a VPN issue and hit a wall. The VPN runs between a Cisco IOS XE and Palo Alto FW.

The problem that I am hitting is with phase 1, on Cisco the debug shows that the negotiation is stuck on MM_KEY_EXCH, I have double-checked the pre-shared key and the policy they both match. On PA FW the error that I am getting is 

"description contains 'IKE phase-1 negotiation is failed. When pre-shared key is used, peer-ID must be type IP address. Received type FQDN"

I have looked into how to change the peer id for that specific tunnel, but no luck there.

Thanks.

[MHM Cisco World]

crypto isakmp identity {address | hostname | key-id id-string | auto}

this command for identity 

[omera]

Hey MHM, the identity for the whole router is set to hostname, and I honestly cannot set it to address as that might impact other VPN connections. 

Thanks for the help .

[Rob Ingram]

@omera as I said in my first response, you need to use an ISAKMP profile to define the IP address as the identity, to override the global setting. Example:

crypto isakmp profile CUSTOMERA
 keyring CUSTOMERA-KEY
 self-identity address
 match identity address 1.1.1.1 255.255.255.255

crypto map CMAP 1 ipsec-isakmp
 set isakmp-profile CUSTOMERA

[MHM Cisco World]

 then as @Rob Ingram  suggest use iskamp profile with self-identity 
link below how you can config it
Internet Key Exchange for IPsec VPNs Configuration Guide, Cisco IOS XE Fuji 16.9.x - VRF-Aware IPsec [Cisco ASR 1000 Series Aggregation Services Routers] - Cisco

[Rob Ingram · Accepted solution]

@omera As default the router would send the address and the identity, so I assume your IOS-XE router is explictly configured to send a FQDN and that is configured globally? If, so and you reconfigure the router globally to send the address as the identity, that might impact (break) any other VPN on the router.

You might be better to create an ISAKMP profile, specifically for the VPN to the PA firewall. Specify the "self-identity" as address - hence sending your IP address and overriding the global setting of hostname.

[omera]

Thanks, Rob and MHM for the help much appreciated.