ASA IPSEC peer using DNS name

[sticano]

I have a 5510 running 7.2 code. For some reason I am unable to set a lan-to-lan peer using dns resolution. This used to work for PIX peers. Does anyone know the way to do this?

[irisrios]

Probably,it is related to config changes.Try with following steps

1) DNS for sbs server was not able to resolve

2) took access of asa and connected vpn client to asa

3) checked the config and added split-dns

[balinem]

In 7.x, the name of the tunnel group MUST be the IP address of the remote peer.

tunnel-group 172.16.10.10 type ipsec-l2l

You can provide any name you want for the group if it is type ipsec-ra, but for l2l, the name must be the IP address. I believe this is because the ASA borrows its VPN foundation from the VPN3k, where the rules are the same.

Thanks,

Matt

[sticano]

This is true unless you are using agressive mode IKE or certificates. Although even when I tried agressive mode it still fails to allow it. This seems like a step backwards. The PIX was able to do this.