This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

site-to-site with CISCO Pix

I tried to create a ipsec-tunnel between a CISCO Pix and an Astaro Gateway (sry. I don´t know which kind). The Astaro get an error message in main mode, that the Pix doesn´t send the peer address but the FQDN. On Pix I´m not able to configure specially for IP or FQDN. A few tunnels with other peers (checkpoint, sonicwall) works fine with Pix so I think this is a problem with Astaro. Is it?

Regards
Helmut

This thread was automatically locked due to age.

Parents

0 BarryG over 19 years ago

There are some docs on the knowledgebase about VPN configs, including Cisco.
http://docs.astaro.org/

If that doesn't help, check the logs on Astaro.

Barry
Cancel
Vote Up 0 Vote Down

Cancel
0 hegl over 19 years ago in reply to BarryG

Thanks, but I don´t find anything for this problem.

The Astaro-log-file said: we require peer to have ID 200.200.200.200, but peer declares '@domain.com

Helmut
Cancel
Vote Up 0 Vote Down

Cancel
0 NimmdirKeks over 19 years ago in reply to hegl

Under remote key's you should see, what the Cisco Cert is using for VPN_ID.
If you use X509 and the remote Key says that the VPN ID is the IP-Adress and the Pix sends the FQDN as ID than you should generate a new Cert with the FQDN as ID.
Cancel
Vote Up 0 Vote Down

Cancel
0 hegl over 19 years ago in reply to NimmdirKeks

Thanks all,

the problem is fixed.
There is a specially command at PIX-site!!!

Helmut
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 19 years ago in reply to hegl

Out of curiosity, what did you change on the PIX to fix the problem?

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel
0 hegl over 19 years ago in reply to BrucekConvergent

You can configure to send IP-address:

isakmp identity address

I´havent found this command in any sample configuration and in no description but in command listing.

Regards
Helmut
Cancel
Vote Up 0 Vote Down

Cancel
0 NimmdirKeks over 19 years ago in reply to hegl

Ok, I did just send you the same, seems I'm getting slow in my old days. ;-)
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 NimmdirKeks over 19 years ago in reply to hegl

Ok, I did just send you the same, seems I'm getting slow in my old days. ;-)
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data