Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

VPN with hostnames and not IP addresses

Unanswered Question
Apr 2nd, 2003
User Badges:

Can the pix handel a VPN with hostnames as peers and not ip adresses. I want the pix to use DNS to go out and get the ip for the hostname because all sites except one uses dynamic ip's

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
mklaphek Wed, 04/02/2003 - 13:26
User Badges:

I don't think it uses DNS resolution; I believe that it uses the hostname supplied by the initiating device

From the Cisco Docs:

"When two peers use IKE to establish IPSec security associations, each peer sends its ISAKMP identity to the remote peer. It will send either its IP address or host name depending on how each has its ISAKMP identity set. By default, the PIX Firewall unit's ISAKMP identity is set to the IP address. As a general rule, set the PIX Firewall and its peer's identities in the same way to avoid an IKE negotiation failure. This failure could be due to either the PIX Firewall or its peer not recognizing its peer's identity. "

Hope this helps.

gfullage Wed, 04/02/2003 - 17:38
User Badges:
  • Cisco Employee,

The previous post is correct, the PIX will not use a DNS server to look up its peers IP address.

johan.blom Wed, 04/02/2003 - 22:51
User Badges:

Thank you. Will this be changed in future releases? I know that dns is a unreiable structure so it can be a security problem yes. But what else could I use If I want to open a tunnel and both ip adresses are dynamical


This Discussion