Description

Trying to use FQDN instead of IP in the IPSec tunnel between. When the provided FQDN is configured in the IP sec tunnel, the tunnel is not coming up

Symptoms

VPN tunnel is in a down state and unable to access the resource via VPN while using FQDN.

 

VPN tunnel is coming up while using IP address instead of FQDN and there is no issue with the traffic flow

Solution

 

The reason for the VPN down is due to an authentication issue upon further investigation found that FQDN has been configured as a local identity

 

On the Peer device, there is no local or remote identity configured.

 

Suggested the following changes on the SRX

 

edit

delete security ike gateway <gateway name> address <ip address>

set security ike gateway <gateway name> dynamic hostname <FQDN>

commit

 

On the Peer device, add FQDN as local-IKE identity

Modification History

2024-08-20 : Article Created