%Key pair with hostname xxxx will be invalid

[sjamison]

Our domain name has changed. I also want to change the hostname of the firewall. However, when I do, I get this error.

We have a few Tunnels built between some firewalls. Is this what is generating that error? What do I need to do to get everything changed over?

[gfullage · Accepted solution]

You have previously generated a public/private key pair on this pix, and the pix uses the configured hostname and domain name to generate these. These keys are used for PDM/SSH access, and for VPN's if you're using certificates.

If the tunnels you have are using pre-shared keys, then regenerating a new key pair won't affect those. It will affect your SSH access, but your SSH client will just exchange the new key pair and everything should be fine.

The best way to do this will be to remove your existing key pair, change the domain and hostname, then regenerate the new key pair as follows:

ca zeroize rsa

domain-name blah.com

hostname blahblahblah

ca generate rsa key 1024

ca save all

If you are using certificates for your tunnels, then you'll need to re-enroll your PIX with your CA server and get a new identity cert.

See http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/c.htm#wp1025473 for details.

[sjamison]

That fixed it up exactly as I needed it to! Thanks!